Come join our live training webinar every other Wednesday at 11am PST and hear LogicMonitor experts explain best practices and answer common questions. We understand these are uncertain times, and we are here to help!
Note that LogicMonitor has a REST API equivalent for this API available.
The LogicMonitor API allows users to manage alerts programmatically with the getAlerts call. With the getAlerts call you can retrieve information about alerts in your LogicMonitor account. Add filter parameters to narrow down the number of alerts returned. If no input parameters are specified, alert data for all alerts will be returned. LogicMonitor limits the number of alerts returned by getAlerts in cases where a large number of alerts are being requested. Therefore, if you are retrieving alert data for a large number of alerts, you’ll need to use multiple getAlerts requests to get the data (using start and results parameters).
Notes:
https://accountName.logicmonitor.com/santaba/rpc/getAlerts?c=accountName&u=user&p=password&id=alertId&type=alertType&group=hostgroupName&host=hostName&hostId=hostId&dataSource=dataSourceName&dataPoint=dataPointName&startEpoch=startTime&endEpoch=endTime&ackFilter=all&filterSDT=false&level=alertLevel&orderBy=orderBy&orderDirection=asc&includeInactive=false&needTotal=false&results=numberOfResults&start=startResult&needMessage=false
Request Parameters: You can include the following as query parameters in a getAlerts request:
Note: if you are trying to get all alerts for the instances of a multi-instance datasource, you need to include * at the end of the datasource name. For example, consider the multi-instance datasource Host Uptime-, you need to specify Host Uptime-* to get all alerts for all instances of Host Uptime.
all: Both non-acknowledged alerts and acknowledged alerts will be returned.
acked: Alerts that have been acknowledged will be returned.
nonacked: Alerts that have not been acknowledged will be returned.
true: Alerts associated with hosts or datasources that are experiencing an SDT will not be returned.
false: Alerts associated with hosts or datasources that are experiencing an SDT will be included in the returned alerts.
sdt: Alerts associated with hosts or datasources that are experiencing an SDT will be returned.
true: Both active and cleared alert records will be returned (i.e. both active and inactive alert details).
false: Only active alert details will be returned.
Note:the results parameters is required if you set includeInactive=true
All outputs will be in the format: { [status], [data], [errmsg] }, where status is the status of the response, errmsg is the error message associated with the response, and the data object includes the following:
curl "https://apiAccount.logicmonitor.com/santaba/rpc/getAlerts?c=apiAccount&u=apiUser&p=password&ackFilter=nonacked&level=warn&dataPoint=idleInterval"
Response:
{ "status": 200, "data": { "total": 2, "alerts": [ { "nextRecipient": 12, "dataSourceInstance": "HostStatus", "alertRuleName": "Dev-QA Warn", "dataSource": "HostStatus", "endOn": 0, "hostId": 196, "type": "alert", "dataSourceId": 119, "ackedOnLocal": "", "id": 3871, "thresholds": "> 300 300 300", "level": "critical", "endOnLocal": "", "ackComment": "", "value": "601011.43", "alertEscalationChainName": "Warn", "hostGroups": [{ "alertEnable": true, "createdOn": 1424128277, "groupType": 0, "id": 6, "parentId": 1, "description": "", "appliesTo": "", "name": "Dev-QA", "fullPath": "Dev-QA" }], "startOnLocal": "2015-11-09 11:25:39 PST", "dataPoint": "idleInterval", "ackedBy": "", "host": "10.0.1.35", "dataSourceInstanceId": 2008, "ackedOn": 0, "escalationChainId": 14, "escalationSubChainId": 0, "alertRecipients": "{\"hipchat_warn\":[\"admin\"]}", "startOn": 1447097139, "duration": "166h 52m", "dataSourceInstanceDescription": "", "active": true, "hostDataSourceId": 4850, "acked": false, "displayName": "Host Status" }, { "nextRecipient": 45, "dataSourceInstance": "HostStatus", "alertRuleName": "Dev-QA Warn", "dataSource": "HostStatus", "endOn": 0, "hostId": 201, "type": "alert", "dataSourceId": 119, "ackedOnLocal": "", "id": 3230, "thresholds": "> 300 300 300", "level": "critical", "endOnLocal": "", "ackComment": "", "value": "2820495.43", "alertEscalationChainName": "Warn", "hostGroups": [{ "alertEnable": true, "createdOn": 1424128277, "groupType": 0, "id": 6, "parentId": 1, "description": "", "appliesTo": "", "name": "Dev-QA", "fullPath": "Dev-QA" }], "startOnLocal": "2015-10-14 19:54:53 PDT", "dataPoint": "idleInterval", "ackedBy": "", "host": "172.16.19.128", "dataSourceInstanceId": 2162, "ackedOn": 0, "escalationChainId": 14, "escalationSubChainId": 0, "alertRecipients": "{\"hipchat_warn\":[\"admin\"]}", "startOn": 1444877693, "duration": "783h 23m", "dataSourceInstanceDescription": "", "active": true, "hostDataSourceId": 5083, "acked": false, "displayName": "Host Status" } ] }, "errmsg": "OK" }
The following example returns the 1st to 100th alerts (0-based) in apiAccount by specifying start and results:
curl "https://apiAccount.logicmonitor.com/santaba/rpc/getAlerts?c=apiAccount&u=apiUser&p=example&start=1&results=100"
The following example returns alerts 100-200 in apiAccount by specifying start and results:
curl "https://apiAccount.logicmonitor.com/santaba/rpc/getAlerts?c=apiAccount&u=apiUser&p=example&start=100&results=100"
The following example returns all alerts for the host group “webservers”:
curl "https://apiAccount.logicmonitor.com/santaba/rpc/getAlerts?c=apiAccount&u=apiUser&p=example&group=webservers"
The following example returns all non-acknowledged alerts for the host group “webservers”:
curl "https://apiAccount.logicmonitor.com/santaba/rpc/getAlerts?c=apiAccount&u=apiUser&p=example&group=webservers&ackFilter=nonacked"
The following example returns all alerts for the datasource “WinLogicDisk” of the host “Server1”, where returned alerts are sorted by the alert starting time in descending order:
curl "https://apiAccount.logicmonitor.com/santaba/rpc/getAlerts?c=apiAccount&u=apiUser&p=example&host=Server1&dataSource=WinLogicDisk&orderBy=startOn&orderDirection=desc"
In This Article