Public/Get-GLAlerts.ps1
|
<#
.SYNOPSIS Get an alert by ID. .DESCRIPTION Get an alert by ID. For more information about this cmdlet - please search for /streams/alerts/{alertId} in the docs available at http(s)://your-graylog.fqdn/api/api-docs .EXAMPLE Get-GLAlerts -Alertid <String> .NOTES Auto generated #> function Get-GLAlerts { [CmdletBinding()] param( # The alert ID to retrieve. [Parameter(Mandatory = $True,ValueFromPipelineByPropertyName = $true)] [string]$Alertid, # Base url for the API, normally https://<grayloghost>:<port>/api [string]$APIUrl = $Global:GLApiUrl, # Graylog credentials as username:password or use Convert-GLTokenToCredential for token usage [pscredential]$Credential = $Global:GLCredential ) begin { if ([string]::IsNullOrEmpty($APIUrl)) { Write-Error -ErrorAction Stop -Exception "APIUrl not set" -Message "APIUrl was null or empty, refer to the documentation" } if ($Null -eq $Credential) { Write-Error -ErrorAction Stop -Exception "Credential not set" -Message "Credential not set - refer to the documentation for help" } } process { $QueryArray = @() if (![string]::IsNullOrEmpty($Alertid)) { $Alertid = [system.web.httputility]::UrlEncode($Alertid) $QueryArray += "alertId=$Alertid" } $Headers = @{ Accept = 'application/json'; 'X-Requested-By' = 'PSGraylog Module' } $APIPath = '/streams/alerts/{alertId}' $APIPath = $APIPath -replace "\{Alertid\}","$Alertid" $QueryString = $QueryArray -join '&' try { Invoke-RestMethod -Method GET -Headers $Headers -ContentType 'application/json' -Uri ($APIUrl + $APIPath + "?" + $QueryString) -Credential $Credential -ErrorAction Stop } catch { if ($Error[0].Exception.Response.StatusCode.value__ -eq 404) { Write-Error -Exception $Error[0].Exception -Message "Alert not found." -ErrorAction $ErrorActionPreference } elseif ($Error[0].Exception.Response.StatusCode.value__ -eq 400) { Write-Error -Exception $Error[0].Exception -Message "Invalid ObjectId." -ErrorAction $ErrorActionPreference } else { Write-Error -Exception $Error[0].Exception -Message $Error[0].Message -ErrorAction $ErrorActionPreference } } } end {} } |