Edge Delta AI API
The AI API from Edge Delta — 10 operation(s) for ai.
OpenAPI Specification
swagger: '2.0'
info:
description: 'Edge Delta API provides endpoints to manage your configs/integrations/rehydrations and more. Generate an API token to get started: https://app.edgedelta.com/admin/organization#api-tokens'
title: Edge Delta Access AI API
contact:
name: API Support
email: support@edgedelta.com
version: '1.0'
host: api.edgedelta.com
basePath: ''
schemes:
- https
tags:
- name: AI
paths:
/v1/orgs/{org_id}/clustering/stats:
get:
security:
- ApiKeyAuth: []
description: Returns top log patterns (signatures of log messages) and their stats; count, proportion, sentiment and delta.
consumes:
- application/json
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Edge Delta Common Query Language expression
name: query
in: query
- type: boolean
description: If summary true call returns up to 50 interesting clusters with 10 top anomaly, top/bottom delta, top/bottom count. Param size is ignored
name: summary
in: query
- type: string
description: Max number of clusters in response. For AI search, limit should be 20.
name: limit
in: query
- type: string
description: Lookback period in golang duration format. e.g. '1h'. Either provide from/to or provide lookback/to or just lookback
name: lookback
in: query
- type: string
description: From datetime in ISO format 2006-01-02T15:04:05.000Z
name: from
in: query
- type: string
description: To datetime in ISO format 2006-01-02T15:04:05.000Z
name: to
in: query
- type: string
description: Comma separated fields to group by
name: groupby
in: query
- type: string
description: Valatility can be new, existing, gone, all. Default is all
name: volatility
in: query
- type: string
description: Comma separated offsets for delta stat calculation. Each offset is in golang duration format and order of offsets determines order of offset_ fields in cluster stat response. Default value is lookback duration. e.g. '24h'.
name: offset
in: query
- type: string
description: Window for on demand anomaly calculation histogram series. e.g. '5m', '1h', '2d'. Combined values like '5m3s' are NOT supported.
name: window
in: query
- type: boolean
description: Negative param is used to get negative sentiments.
name: negative
in: query
responses:
'200':
description: OK
schema:
$ref: '#/definitions/core.ClusterStatResponse'
/v1/orgs/{org_id}/dashboards:
get:
security:
- ApiKeyAuth: []
description: Returns all dashboards of users in the org.
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: boolean
description: Include definitions in the response
name: include_definitions
in: query
responses:
'200':
description: OK
schema:
type: array
items:
$ref: '#/definitions/dashboard.Dashboard'
/v1/orgs/{org_id}/dashboards/{dashboard_id}:
get:
security:
- ApiKeyAuth: []
description: Returns the dashboard for the given ID.
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Dashboard ID
name: dashboard_id
in: path
required: true
responses:
'200':
description: OK
schema:
type: array
items:
$ref: '#/definitions/dashboard.Dashboard'
/v1/orgs/{org_id}/events/search:
get:
security:
- ApiKeyAuth: []
description: Search query using Edge Delta events search syntax, for anomaly search query should include event.type:pattern_anomaly
consumes:
- application/json
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Lookback period in golang duration format. e.g. '1h'. Either provide from/to or provide lookback/to or just lookback
name: lookback
in: query
- type: string
description: From datetime in ISO format 2006-01-02T15:04:05.000Z
name: from
in: query
- type: string
description: To datetime in ISO format 2006-01-02T15:04:05.000Z
name: to
in: query
- type: string
description: Edge Delta Common Query Language expression
name: query
in: query
- type: integer
description: Limits the number of logs in the response. Default is 1000. It can be negative to move the cursor prev direction. Wraps to end if the cursor position is 0. For AI search, limit should be 20.
name: limit
in: query
- type: string
description: Cursor provided from previous response, pass it to next request so that we can move the cursor with given limit.
name: cursor
in: query
- type: string
description: Order of the logs in the response, either 'ASC', 'asc', 'DESC' or 'desc'
name: order
in: query
responses:
'200':
description: OK
schema:
$ref: '#/definitions/core.EventResponse'
/v1/orgs/{org_id}/logs/log_search/search:
get:
security:
- ApiKeyAuth: []
description: Returns time series log data for given query
consumes:
- application/json
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Lookback period in golang duration format. e.g. '1h'. Either provide from/to or provide lookback/to or just lookback
name: lookback
in: query
- type: string
description: From datetime in ISO format 2006-01-02T15:04:05.000Z
name: from
in: query
- type: string
description: To datetime in ISO format 2006-01-02T15:04:05.000Z
name: to
in: query
- type: string
description: Edge Delta Common Query Language expression
name: query
in: query
- type: integer
description: Limits the number of logs in the response. Default is 1000. It can be negative to move the cursor prev direction. Wraps to end if the cursor position is 0. For AI search, limit should be 20.
name: limit
in: query
- type: string
description: Scope can be audit or log
name: scope
in: query
- type: string
description: Cursor provided from previous response, pass it to next request so that we can move the cursor with given limit.
name: cursor
in: query
- type: string
description: Comma separated list of custom columns to include in the recent search queries
name: custom_columns
in: query
- type: string
description: Order of the logs in the response, either 'ASC', 'asc', 'DESC' or 'desc'
name: order
in: query
- type: string
description: Minimum log length to filter for
name: length
in: query
- type: string
description: Session ID to track the search session
name: sessionId
in: query
- type: string
description: Page ID to track the pagination state
name: pageId
in: query
- type: string
description: The boolean to decide whether to save the query in history
name: save
in: query
- type: string
description: Disable routing for the search
name: disable_routing
in: query
responses:
'200':
description: OK
schema:
$ref: '#/definitions/core.ArchiveResponseV1'
/v1/orgs/{org_id}/metrics_v2/graph:
get:
security:
- ApiKeyAuth: []
description: Returns metrics with common time series response for the given query.
consumes:
- application/json
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Edge Delta Common Query Language expression
name: query
in: query
- type: string
description: Lookback period in golang duration format. e.g. '1h'. Either provide from/to or provide lookback/to or just lookback
name: lookback
in: query
- type: string
description: From datetime in ISO format 2006-01-02T15:04:05.000Z
name: from
in: query
- type: string
description: To datetime in ISO format 2006-01-02T15:04:05.000Z
name: to
in: query
- type: string
description: If order_by is specified then metrics are sorted by given field. If no sort is given default sort will be asc
name: order
in: query
- type: string
description: 'Default is no sorting. If sort is specified then metrics are sorted by their value. Possible values: asc, desc'
name: sort
in: query
- type: integer
description: Limits the number of logs in the response. Default has no limit.
name: limit
in: query
- type: string
description: Time range adjustment it can be noop, inclusive or exclusive
name: time_range_adjustment
in: query
- type: string
description: The boolean to decide whether to save the query in history
name: save
in: query
responses:
'200':
description: Common time series response
schema:
$ref: '#/definitions/core.CommonTimeseriesResponse'
/v1/orgs/{org_id}/pipelines/base:
post:
description: Creates a Pipeline with base configuration according to environment and fleet subtype
consumes:
- application/json
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- description: Pipeline request
name: request
in: body
required: true
schema:
$ref: '#/definitions/core.BaseConfCreateRequest'
responses:
'200':
description: OK
schema:
$ref: '#/definitions/core.ConfCreateResponse'
/v1/orgs/{org_id}/pipelines/{conf_id}/add_source:
post:
description: 'Adds the given source node configuration to the pipeline and connect it to Edgedelta Destination. Saves the updated pipeline configuration without deploying changes.
Example request body for file_input node:
{
"node": {
"name": "my_file_input",
"type": "file_input",
"path": "path/to/my_logs/logs.txt",
"separate_source": true,
"description": "A user-defined description of the Node. Users may add any additional comments describing the function of their node.\nThis is useful to put some notes into the config file since YAML comment lines (\"#\") are not persisted due to automated marshal/unmarshal of YAML. It should be human readable and not too long."
}
}
Example request body for kubernetes_input node:
{
"node": {
"name": "my_k8s_input",
"type": "kubernetes_input",
"include": [
"k8s.pod.name=^apache.*$,k8s.namespace.name=.*web*"
],
"exclude": [
"k8s.namespace.name=^kube-nginx$",
"k8s.pod.name=.*nginx*,k8s.container.name=testing"
],
"auto_detect_line_pattern": true,
"boost_stacktrace_detection": true,
"enable_persisting_cursor": true,
"description": "A user-defined description of the Node. Users may add any additional comments describing the function of their node.\nThis is useful to put some notes into the config file since YAML comment lines (\"#\") are not persisted due to automated marshal/unmarshal of YAML. It should be human readable and not too long."
}
}
Example request body for demo_input node:
{
"node": {
"name": "my_demo_input",
"type": "demo_input",
"events_per_sec": 1,
"log_type": "apache_common",
"description": "A user-defined description of the Node. Users may add any additional comments describing the function of their node.\nThis is useful to put some notes into the config file since YAML comment lines (\"#\") are not persisted due to automated marshal/unmarshal of YAML. It should be human readable and not too long."
}
}'
consumes:
- application/json
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Conf ID
name: conf_id
in: path
required: true
- description: Source node configuration to add
name: request
in: body
required: true
schema:
$ref: '#/definitions/pipeline.AddSourceRequest'
responses:
'200':
description: OK
schema:
$ref: '#/definitions/configv3.Config'
/v1/orgs/{org_id}/pipelines/{conf_id}/deploy/{version}:
post:
description: Deploys the pipeline configuration. Version is the timestamp of the Pipeline history. Pipeline history should be called to get the version.
consumes:
- application/json
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Config ID
name: conf_id
in: path
required: true
- type: string
description: 'Version use lastUpdated field from pipeline in milliseconds timestamp format. Example: 1752190141312. This is the timestamp field of the most recent element in the result of pipeline history. So, pipeline_history should be called before this tool to get the latest version of the pipeline.'
name: version
in: path
required: true
responses:
'200':
description: OK
schema:
$ref: '#/definitions/pipeline.GetVisualPipelineResponse'
/v1/orgs/{org_id}/pipelines/{conf_id}/history:
get:
description: Returns the history of a Pipeline configuration. Timestamp of the Pipeline history is used as version when deploying the Pipeline.
consumes:
- application/json
produces:
- application/json
tags:
- AI
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Config ID
name: conf_id
in: path
required: true
- type: boolean
description: If true only retrieve latest history
name: only_latest
in: query
responses:
'200':
description: OK
schema:
type: array
items:
$ref: '#/definitions/core.ConfigHistory'
definitions:
core.FleetType:
type: string
enum:
- Edge
- Cloud
- IngestionPipeline
- Edge-extended
- Cloud-extended
x-enum-varnames:
- EdgeFleetType
- CloudFleetType
- IngestionPipelineFleetType
- EdgeExtendedFleetType
- CloudExtendedFleetType
core.ConfigHistoryStatus:
type: string
enum:
- Not Deployed
- Deployed
x-enum-varnames:
- ConfigHistoryNotDeployed
- ConfigHistoryDeployed
configv3.Authorization:
type: object
properties:
client_credentials:
$ref: '#/definitions/configv3.AuthorizationClientCredentials'
strategy:
type: string
configv3.MetricConfig:
type: object
properties:
aggregation:
description: Aggregation is required for "sum" and can be cumulative or delta
type: string
column_oids:
type: array
items:
$ref: '#/definitions/configv3.OID'
description:
description: Description is optional and describes what this metric represents
type: string
metric_type:
description: Type is required and can be either "gauge" or "sum".
type: string
monotonic:
description: Monotonic is required for "sum" and can be true or false
type: boolean
name:
description: 'Name is the name of the metric as it will be reported in the OpenTelemetry Collector.
It is required and must be unique across all metrics.'
type: string
scalar_oids:
description: 'Either ScalarOIDs or ColumnOIDs is required.
ScalarOIDs is used if one or more scalar OID values is used for this metric.
ColumnOIDs is used if one or more column OID indexed set of values is used for this metric.'
type: array
items:
$ref: '#/definitions/configv3.OID'
unit:
description: Unit is required
type: string
value_type:
description: ValueType is required and can be either int or double
type: string
configv3.ResourceFields:
type: object
properties:
namespace_labels:
description: NamespaceLabels is for K8s
type: array
items:
type: string
node_labels:
description: NodeLabels is for K8s
type: array
items:
type: string
pod_annotations:
description: PodAnnotations is for K8s
type: array
items:
type: string
pod_labels:
description: PodLabels is for K8s
type: array
items:
type: string
configv3.ResilienceConfig:
type: object
properties:
circuit_breaker:
description: Circuit breaker configuration
allOf:
- $ref: '#/definitions/configv3.CircuitBreakerConfig'
configv3.CustomLabels:
type: object
properties:
keep_overridden_path:
type: boolean
name:
type: string
path:
type: string
configv3.Link:
type: object
properties:
from:
type: string
path:
type: string
to:
type: string
core.HostedEnvState:
type: string
enum:
- startState
- createNamespace
- createSecret
- createServiceAccount
- createRoleAndBinding
- createPersistentVolumeClaim
- createIngress
- createDeployment
- createHorizontalPodAutoscaler
- createServiceAndBinding
- createExternalService
- createIngressRule
- deleteNamespace
- deleteExternalService
- deleteIngressRule
x-enum-varnames:
- HostedEnvStartState
- HostedEnvCreateNamespace
- HostedEnvCreateSecret
- HostedEnvCreateServiceAccount
- HostedEnvCreateRoleAndBinding
- HostedEnvCreatePersistentVolumeClaim
- HostedEnvCreateIngress
- HostedEnvCreateDeployment
- HostedEnvCreateHorizontalPodAutoscaler
- HostedEnvCreateServiceAndBinding
- HostedEnvCreateExternalService
- HostedEnvCreateIngressRule
- HostedEnvDeleteNamespace
- HostedEnvDeleteExternalService
- HostedEnvDeleteIngressRule
core.BaseConfCreateRequest:
type: object
required:
- environment
- tag
properties:
cluster_name:
description: Pipelines with same cluster name will be grouped together
type: string
description:
description: Description of the pipeline
type: string
environment:
description: Environment where the pipeline will be deployed
enum:
- Kubernetes
- Windows
- MacOS
- Linux
- Docker
allOf:
- $ref: '#/definitions/core.EnvironmentType'
fleet_subtype:
description: FleetSubtype is required when Environment is Kubernetes
enum:
- Edge
- Coordinator
- Gateway
allOf:
- $ref: '#/definitions/core.FleetSubtype'
tag:
description: Tag is used to identify the pipeline
type: string
core.ConfPurpose:
type: string
enum:
- user-defined
- edgedelta-ai
x-enum-varnames:
- ConfPurposeUserDefined
- ConfPurposeEdgedeltaAI
configv3.Key:
type: object
properties:
value:
type: string
configv3.OID:
type: object
properties:
attributes:
type: array
items:
$ref: '#/definitions/configv3.Attribute'
oid:
type: string
resource_attributes:
type: array
items:
type: string
core.CloudProviderType:
type: string
enum:
- aws
- gcp
- minio
- dos
- ibmos
- zenko
- azure
x-enum-varnames:
- AWS
- GCP
- Minio
- DigitalOceanSpaces
- IBMObjectStorage
- ZenkoCloudserver
- Azure
configv3.ExtractMetricSum:
type: object
properties:
aggregation_temporality:
type: string
is_monotonic:
type: boolean
value:
type: string
core.HostedAgentEnv:
type: object
properties:
agent_version:
type: string
cloud:
description: Cloud is the cloud provider name. By default it's AWS
allOf:
- $ref: '#/definitions/core.CloudProviderType'
compute_unit:
type: number
conf_id:
type: string
created:
description: Created & Updated are timestamps in core.StorageTimeFormat
type: string
creator:
type: string
enabled_endpoints:
description: EnabledEndpoints is a user supplied list of endpoints desired with respect to type
type: array
items:
type: string
endpoints:
description: Endpoints is map of URLs that can be used for accessing agent
type: object
additionalProperties:
type: string
env_id:
type: string
error:
type: string
has_auto_gen_config:
description: HasAutoGenConfig indicates this env has auto generated config (Generate one for me at the UI)
type: boolean
has_https_endpoint:
description: 'DEPRECATED
HasHTTPSEndpoint indicates this env has an HTTPS endpoint.'
type: boolean
https_endpoint:
description: 'DEPRECATED
HTTPSEndpoint is the URL of the HTTPS endpoint if provisioned.
It''s format is https://{region}.{cloud}.ingress.edgedelta.com/listen/{env_id}'
type: string
is_suspended:
description: IsSuspended indicates agents should scale down to zero or not
type: boolean
name:
type: string
orgID:
type: string
purpose:
description: Purpose denotes the reason for creating this cloud fleet
allOf:
- $ref: '#/definitions/core.HostedEnvPurpose'
region:
description: 'Region in the cloud provider. By default it''s us-west2.
We have to pre-provision hosted clusters in multiple regions so not all regions are applicable.'
type: string
state:
description: 'Last successful create resource step for this env to prevent duplicate resource creation
Default is StartState'
allOf:
- $ref: '#/definitions/core.HostedEnvState'
status:
$ref: '#/definitions/core.HostedEnvStatus'
updated:
type: string
updater:
type: string
version:
description: Version is the hosted agent version
type: string
pipeline.AddSourceRequest:
type: object
required:
- node
properties:
node:
description: Configuration of the source node to be added
allOf:
- $ref: '#/definitions/pipeline.Node'
dashboard.Screenshot:
type: object
properties:
dark_url:
type: string
last_triggered_at:
type: string
last_updated_at:
type: string
light_url:
type: string
status:
$ref: '#/definitions/dashboard.ScreenshotStatus'
configv3.LiveTailSettings:
type: object
properties:
enabled:
type: boolean
item_max_body_size:
$ref: '#/definitions/datasize.Size'
item_truncation_size:
$ref: '#/definitions/datasize.Size'
lower_threshold_size:
description: 'Deprecated: These fields are retained for backward compatibility with existing configs.
They are parsed but ignored at runtime. Use ItemTruncationSize and ItemMaxBodySize instead.'
allOf:
- $ref: '#/definitions/datasize.Size'
max_items:
type: integer
polling_interval:
type: string
retention:
type: string
upper_threshold_size:
$ref: '#/definitions/datasize.Size'
configv3.FieldMapping:
type: object
properties:
enabled:
description: Enabled controls whether this field mapping is active.
type: boolean
keep_in_item:
description: KeepInItem controls whether to keep the field in item data after extraction.
type: boolean
path:
description: 'Path is the OTTL expression to extract value from OTEL item.
Example: ''attributes["ed.gcl.name"]'', ''resource["host.name"]'', "severity_text"'
type: string
configv3.FieldMappings:
type: object
properties:
field_name:
type: string
override_if_exists:
type: boolean
value:
type: string
value_hint:
type: string
configv3.InputDiscovery:
type: object
properties:
file_path:
description: 'FilePath is used for globbing files for. For K8s, we will use this glob path
instead of well-known ones to handle non-stdout cases'
type: string
parsing_pattern:
description: 'ParsingPattern is used for extracting information out of literal file paths.
For K8s, it will be used for extracting pod UID (required) and container name (optional).'
type: string
configv3.LookupField:
type: object
properties:
append_mode:
type: boolean
default_value:
type: string
event_field:
type: string
lookup_field:
type: string
pipeline.GetVisualPipelineResponse:
type: object
properties:
clusterName:
type: string
content:
type: string
createdAt:
type: string
createdBy:
type: string
environment:
$ref: '#/definitions/core.EnvironmentType'
fleetSubtype:
$ref: '#/definitions/core.FleetSubtype'
fleetType:
$ref: '#/definitions/core.FleetType'
hostedEnv:
$ref: '#/definitions/core.HostedAgentEnv'
id:
type: string
lastUpdated:
type: string
orgID:
type: string
pipeline:
$ref: '#/definitions/pipeline.Pipeline'
pipelineNodes:
description: 'Deprecated: 6-2-23 This field will be removed in a future release. Please use Pipeline.Nodes instead'
type: array
items:
$ref: '#/definitions/pipeline.VisualizerNode'
rollout_task_id:
type: string
state:
$ref: '#/definitions/core.PipelineStateSummary'
updatedBy:
type: string
nodetype.NodeCategory:
type: string
enum:
- input
- output
- processor
- '*'
- invalid
x-enum-varnames:
- InputNodeCategory
- OutputNodeCategory
- ProcessorNodeCategory
- AnyNodeCategory
- InvalidNodeCategory
configv3.Node:
type: object
required:
- command
- run_interval
properties:
access_key:
description: '#nosec G117 -- AWS access key in config'
type: string
account_key:
type: string
account_name:
description: Azure Blob specific
type: string
active_gate_domain:
type: string
active_gate_port:
type: integer
active_request_limit:
type: integer
add_attributes:
type: boolean
add_ingestion_time:
type: boolean
address:
type: array
items:
type: string
aggregate_metric_rules:
type: array
items:
$ref: '#/definitions/configv3.AggregateMetricRule'
alert_as_log:
description: Alert as log is used to send alerts as log instead of events by default for some destinations
type: boolean
allow_skip_pri_header:
type: boolean
anomaly_coefficient:
type: number
anomaly_confidence_period:
type: string
anomaly_tolerance:
type: number
api_key:
description: '#nosec G117 -- API key in config'
type: string
api_version:
type: string
async:
type: boolean
attributes_from_header:
type: array
items:
type: string
auth_password:
description: 'AuthPassword is the authentication password used for this SNMP connection.
Only valid for version "v3" and if "no_auth_no_priv" is not selected for SecurityLevel'
type: string
auth_type:
description: 'AuthType is the type of authentication protocol to use for this SNMP connection.
Only valid for version “v3” and if “no_auth_no_priv” is not selected for SecurityLevel
Valid options: “md5”, “sha”, “sha224”, “sha256”, “sha384”, “sha512”
Default: "md5"'
type: string
authentication:
description: Since both inputs and outputs have these in common, this field is shared here
allOf:
- $ref: '#/definitions/configv3.AuthenticationConf'
authorization:
description: Authorization is used by HTTP pull and HTTP output node
allOf:
- $ref: '#/definitions/configv3.Authorization'
auto_create_container:
type: boolean
auto_detect_line_pattern:
description: For the next 3 bool, should these functionalities stay at the input level?
type: boolean
aws_key_id:
description: AWS related fields
type: string
aws_sec_key:
type: string
batch_bytes:
type: integer
batch_size:
description: Kafka + Port output specific
type: integer
batch_timeout:
type: string
body_mapping:
description: 'BodyMapping controls what gets sent as the payload body to destination.
When enabled, only the mapped OTTL path is sent as body.
When disabled, entire OTEL item is sent as body.'
allOf:
- $ref: '#/definitions/configv3.BodyMapping'
boost_stacktrace_detection:
type: boolean
brokers:
type: array
items:
type: string
bucket:
description: Archive specific (S3 + GCS)
type: string
bucket_expression:
type: string
buffer_length:
type: integer
buffer_max_bytesize:
description: DEPRECATED
allOf:
- $ref: '#/definitions/datasize.Size'
buffer_path:
description: 'Persistent retry buffer related fields
DEPRECATED'
type: string
buffer_size:
description: DEPRECATED
allOf:
- $ref: '#/definitions/datasize.Size'
buffer_ttl:
description: DEPRECATED
type: string
cache:
$ref: '#/definitions/configv3.SamplingCaches'
capture_group_masks:
description: 'the mapping for capture groups such as "pw: ******" or "pw: ''''" if removal without replacement desired. If '
# --- truncated at 32 KB (154 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/edge-delta/refs/heads/main/openapi/edge-delta-ai-api-openapi.yml