API

• Field Aggregations
• Document Lookup
• Event Logging
• Fields
• Indices
• Ping
• Version
• Examples

Malcolm provides a REST API that can be used to programatically query some aspects of Malcolm’s status and data.

In addition to the items listed above, Malcolm will also forward requests to some of its components’ APIs at the following URIs:

• /mapi/logstash/ - the Logstash /_node/stats/ API
• /mapi/opensearch/ - the OpenSearch API
• /mapi/netbox/ - the NetBox API (also accessible at /netbox/api/)
• /arkime/api/ - the Arkime Viewer API