Clickhouse Facade

Query the flow metadata database: tables, graphs, suggestions, host names and reports

The flow metadata is stored in a ClickHouse database and queried through the data queries service (clickhouse-facade). Table and graph queries are asynchronous: a POST with the query parameters returns a uuid, the pages of the result are fetched with GET .../{uuid} and the query is interrupted or released with DELETE .../{uuid}. The columns endpoints describe the columns a table or graph offers, the match_ratio endpoints report how many rows a filter matches. Custom host names and host groups enrich the metadata with your own naming; report configurations run table queries on a schedule and store the results.

Common properties
- Minimum user role: viewer for all query, column and result endpoints and for reading host names, host groups and reports; operator for creating, changing or deleting host names, host groups, report configurations and report runs
- Responses use the standard {"message": ..., "data": ...} envelope; the linked pages show the content of data
- Response on an unknown uuid (404 Not Found): {"message": "Failed to retrieve the page for query (<uuid>)", "data": null}
- Response on failure (500 Internal Server Error): {"message": "Failed to redirect request: <reason>", "data": null} when the data queries service cannot be reached

Base Table

Endpoint	Method and path
Make base table SQL query	`POST /api/chf/tables/base`
Get results of base table query	`GET /api/chf/tables/base/{uuid}`
Remove base table query	`DELETE /api/chf/tables/base/{uuid}`
Get default column properties of base table	`GET /api/chf/tables/base/columns`

Base Graph

Endpoint	Method and path
Make base graph SQL query	`POST /api/chf/graph/base`
Get results of base graph query	`GET /api/chf/graph/base/{uuid}`
Remove base graph query	`DELETE /api/chf/graph/base/{uuid}`

Overview Graph

Endpoint	Method and path
Make overview graph SQL query	`POST /api/chf/graph/overview`
Get results of overview graph query	`GET /api/chf/graph/overview/{uuid}`
Remove overview graph query	`DELETE /api/chf/graph/overview/{uuid}`
Get default column properties of overview graph	`GET /api/chf/graph/overview/columns`

Top IP Connections Graph

Endpoint	Method and path
Make top IP connections graph SQL query	`POST /api/chf/graph/top_ip_connections`
Get results of top IP connections graph query	`GET /api/chf/graph/top_ip_connections/{uuid}`
Remove top IP connections graph query	`DELETE /api/chf/graph/top_ip_connections/{uuid}`
Get default column properties of top IP connections graph	`GET /api/chf/graph/top_ip_connections/columns`

Top Applications Graph

Endpoint	Method and path
Make top applications graph SQL query	`POST /api/chf/graph/top_applications`
Get results of top applications graph query	`GET /api/chf/graph/top_applications/{uuid}`
Remove top applications graph query	`DELETE /api/chf/graph/top_applications/{uuid}`
Get default column properties of top applications graph	`GET /api/chf/graph/top_applications/columns`

Top Applications Breakdown Graph

Endpoint	Method and path
Make top applications breakdown graph SQL query	`POST /api/chf/graph/top_applications/breakdown`
Get results of top applications breakdown graph query	`GET /api/chf/graph/top_applications/breakdown/{uuid}`
Remove top applications breakdown graph query	`DELETE /api/chf/graph/top_applications/breakdown/{uuid}`

Top DNS Queries Graph

Endpoint	Method and path
Make top DNS queries graph SQL query	`POST /api/chf/graph/top_dns_queries`
Get results of top DNS queries graph query	`GET /api/chf/graph/top_dns_queries/{uuid}`
Remove top DNS queries graph query	`DELETE /api/chf/graph/top_dns_queries/{uuid}`
Get default column properties of top DNS queries graph	`GET /api/chf/graph/top_dns_queries/columns`

Top DNS Servers Graph

Endpoint	Method and path
Make top DNS servers graph SQL query	`POST /api/chf/graph/top_dns_servers`
Get results of top DNS servers graph query	`GET /api/chf/graph/top_dns_servers/{uuid}`
Remove top DNS servers graph query	`DELETE /api/chf/graph/top_dns_servers/{uuid}`
Get default column properties of top DNS servers graph	`GET /api/chf/graph/top_dns_servers/columns`

Top RTP Connections Graph

Endpoint	Method and path
Make top RTP connections graph SQL query	`POST /api/chf/graph/top_rtp_connections`
Get results of top RTP connections graph query	`GET /api/chf/graph/top_rtp_connections/{uuid}`
Remove top RTP connections graph query	`DELETE /api/chf/graph/top_rtp_connections/{uuid}`
Get default column properties of top RTP connections graph	`GET /api/chf/graph/top_rtp_connections/columns`

Top IP Clients

Endpoint	Method and path
Make top IP clients SQL query	`POST /api/chf/tables/top_ip_clients`
Get results of top IP clients query	`GET /api/chf/tables/top_ip_clients/{uuid}`
Remove top IP clients query	`DELETE /api/chf/tables/top_ip_clients/{uuid}`
Get default column properties of top IP clients table	`GET /api/chf/tables/top_ip_clients/columns`
Compute top IP clients match ratio	`POST /api/chf/tables/top_ip_clients/match_ratio`

Top IP Servers

Endpoint	Method and path
Make top IP servers SQL query	`POST /api/chf/tables/top_ip_servers`
Get results of top IP servers query	`GET /api/chf/tables/top_ip_servers/{uuid}`
Remove top IP servers query	`DELETE /api/chf/tables/top_ip_servers/{uuid}`
Get default column properties of top IP servers table	`GET /api/chf/tables/top_ip_servers/columns`
Compute top IP servers match ratio	`POST /api/chf/tables/top_ip_servers/match_ratio`

Top IP Connections

Endpoint	Method and path
Make top IP connections SQL query	`POST /api/chf/tables/top_ip_connections`
Get results of top IP connections query	`GET /api/chf/tables/top_ip_connections/{uuid}`
Remove top IP connections query	`DELETE /api/chf/tables/top_ip_connections/{uuid}`
Get default column properties of top IP connections table	`GET /api/chf/tables/top_ip_connections/columns`
Compute top IP connections match ratio	`POST /api/chf/tables/top_ip_connections/match_ratio`

Top Applications

Endpoint	Method and path
Make top applications SQL query	`POST /api/chf/tables/top_applications`
Get results of top applications query	`GET /api/chf/tables/top_applications/{uuid}`
Remove top applications query	`DELETE /api/chf/tables/top_applications/{uuid}`
Get default column properties of top applications table	`GET /api/chf/tables/top_applications/columns`

Top Server Countries

Endpoint	Method and path
Make top server countries SQL query	`POST /api/chf/tables/top_server_countries`
Get results of top server countries query	`GET /api/chf/tables/top_server_countries/{uuid}`
Remove top server countries query	`DELETE /api/chf/tables/top_server_countries/{uuid}`
Get default column properties of top server countries table	`GET /api/chf/tables/top_server_countries/columns`

Top Vlans

Endpoint	Method and path
Make top vlans SQL query	`POST /api/chf/tables/top_vlans`
Get results of top vlans query	`GET /api/chf/tables/top_vlans/{uuid}`
Remove top vlans query	`DELETE /api/chf/tables/top_vlans/{uuid}`
Get default column properties of top vlans table	`GET /api/chf/tables/top_vlans/columns`

Top DNS Queries

Endpoint	Method and path
Make top DNS queries SQL query	`POST /api/chf/tables/top_dns_queries`
Get results of DNS queries query	`GET /api/chf/tables/top_dns_queries/{uuid}`
Remove DNS queries query	`DELETE /api/chf/tables/top_dns_queries/{uuid}`
Get default column properties of Top DNS queries table	`GET /api/chf/tables/top_dns_queries/columns`

Top DNS Servers

Endpoint	Method and path
Make top DNS servers SQL query	`POST /api/chf/tables/top_dns_servers`
Get results of DNS servers query	`GET /api/chf/tables/top_dns_servers/{uuid}`
Remove DNS servers query	`DELETE /api/chf/tables/top_dns_servers/{uuid}`
Get default column properties of Top DNS servers table	`GET /api/chf/tables/top_dns_servers/columns`

Top HTTP Servers

Endpoint	Method and path
Make top HTTP servers SQL query	`POST /api/chf/tables/top_http_servers`
Get results of HTTP servers query	`GET /api/chf/tables/top_http_servers/{uuid}`
Remove HTTP servers query	`DELETE /api/chf/tables/top_http_servers/{uuid}`
Get default column properties of Top HTTP servers table	`GET /api/chf/tables/top_http_servers/columns`

Top HTTP

Endpoint	Method and path
Make top HTTP SQL query	`POST /api/chf/tables/top_http_paths`
Get results of HTTP query	`GET /api/chf/tables/top_http_paths/{uuid}`
Remove HTTP query	`DELETE /api/chf/tables/top_http_paths/{uuid}`
Get default column properties of Top HTTP table	`GET /api/chf/tables/top_http_paths/columns`

Top HTTP User Agents

Endpoint	Method and path
Make top HTTP user agents SQL query	`POST /api/chf/tables/top_http_user_agents`
Get results of HTTP user agents query	`GET /api/chf/tables/top_http_user_agents/{uuid}`
Remove HTTP user agents query	`DELETE /api/chf/tables/top_http_user_agents/{uuid}`
Get default column properties of Top HTTP user agents table	`GET /api/chf/tables/top_http_user_agents/columns`

Top RTP Clients

Endpoint	Method and path
Make top RTP clients SQL query	`POST /api/chf/tables/top_rtp_clients`
Get results of RTP clients query	`GET /api/chf/tables/top_rtp_clients/{uuid}`
Remove RTP clients query	`DELETE /api/chf/tables/top_rtp_clients/{uuid}`
Get default column properties of Top RTP clients table	`GET /api/chf/tables/top_rtp_clients/columns`

Top RTP Servers

Endpoint	Method and path
Make top RTP servers SQL query	`POST /api/chf/tables/top_rtp_servers`
Get results of RTP servers query	`GET /api/chf/tables/top_rtp_servers/{uuid}`
Remove RTP servers query	`DELETE /api/chf/tables/top_rtp_servers/{uuid}`
Get default column properties of Top RTP servers table	`GET /api/chf/tables/top_rtp_servers/columns`

Top RTP Connections

Endpoint	Method and path
Make top RTP connections SQL query	`POST /api/chf/tables/top_rtp_connections`
Get results of top RTP connections query	`GET /api/chf/tables/top_rtp_connections/{uuid}`
Remove top RTP connections query	`DELETE /api/chf/tables/top_rtp_connections/{uuid}`
Get default column properties of top RTP connections table	`GET /api/chf/tables/top_rtp_connections/columns`
Compute top RTP connections match ratio	`POST /api/chf/tables/top_rtp_connections/match_ratio`

Suggestions

Endpoint	Method and path
Make suggestions SQL query	`POST /api/chf/tables/suggestions`
Get results of suggestions query	`GET /api/chf/tables/suggestions/{uuid}`
Remove suggestions query	`DELETE /api/chf/tables/suggestions/{uuid}`

Raw Query

Endpoint	Method and path
Make raw SQL query	`POST /api/chf/query/raw`
Get results of raw query	`GET /api/chf/query/raw/{uuid}`
Remove raw query	`DELETE /api/chf/query/raw/{uuid}`

CMM Hostnames

Endpoint	Method and path
Get the hostname entry with given UUID	`GET /api/chf/cmm/hostnames/{uuid}`
Get all hostname entries	`GET /api/chf/cmm/hostnames`
Add new hostname entries	`POST /api/chf/cmm/hostnames`
Edit hostname entries	`PUT /api/chf/cmm/hostnames`
Remove the hostname entry with given UUID	`DELETE /api/chf/cmm/hostnames/{uuid}`
Remove all hostname entries	`DELETE /api/chf/cmm/hostnames`

CMM Host groups

Endpoint	Method and path
Get the host group entry with given UUID	`GET /api/chf/cmm/hostgroups/{uuid}`
Get all host group entries	`GET /api/chf/cmm/hostgroups`
Add new host group entries	`POST /api/chf/cmm/hostgroups`
Edit host group entries	`PUT /api/chf/cmm/hostgroups`
Remove the host group entry with given UUID	`DELETE /api/chf/cmm/hostgroups/{uuid}`
Remove all host group entries	`DELETE /api/chf/cmm/hostgroups`

Report Configs

Endpoint	Method and path
Get all report configs	`GET /api/chf/report_configs`
Get the report config with given report id	`GET /api/chf/report_configs/{config_id}`
Create a report config	`POST /api/chf/report_configs`
Edit the report config with given report id	`PUT /api/chf/report_configs/{config_id}`
Delete the report config with given report id	`DELETE /api/chf/report_configs/{config_id}`
Delete all report configs	`DELETE /api/chf/report_configs`

Report Runs

Endpoint	Method and path
Get all report runs (metadata only); the report id query parameter narrows the list to one config	`GET /api/chf/report_runs` (optional `?config_id=<config_id>`)
Get the full run with given run id (the report content)	`GET /api/chf/report_runs/{run_id}`
Execute a report config manually	`POST /api/chf/report_runs`
Delete the run with given run id	`DELETE /api/chf/report_runs/{run_id}`
Delete all runs; the report id query parameter narrows the deletion to one config	`DELETE /api/chf/report_runs` (optional `?config_id=<config_id>`)

Back to Index