Get Runtime Parser

Looks up a parser that is currently loaded in the control node memory by its identifier. Unlike Get Parser, which returns a persisted parser definition, this API returns the configuration of the instance that is actually loaded in the node's runtime registry and used to parse logs.

The two results may differ in the following situations:

• Right after a parser is registered, before the change has propagated to the node
• After a parser is updated, while the change is still being propagated
• After a parser is removed, while the memory instance has not yet been released
• For built-in parsers registered in code by an app or bundle, which exist only in memory

Required Permissions

Available to any authenticated user.

HTTP Request

cURL Example

curl -H "Authorization: Bearer <API_KEY>" \
     https://HOSTNAME/api/sonar/parsers/syslog-rfc5424/runtime

Request Parameters

Success Response

{
  "parser": {
    "name": "syslog-rfc5424",
    "factory_name": "syslog",
    "config": {
      "structured_data": "true"
    }
  }
}

• parser (Object): Parser loaded in memory. null if no parser with the given identifier is registered
  • name (String): Parser identifier
  • factory_name (String): Parser factory identifier
  • config (Map): Parser configuration key/value pairs

Error Responses

Required argument is missing

HTTP status code 400

{
  "error_code": "null-argument",
  "error_msg": "code should be not null"
}