Search network traffic (Malcolm filters)
malcolm_searchRead-only
Search indexed network traffic using field-based filters and human-readable time ranges, returning matching Malcolm documents.
Instructions
Search Malcolm's indexed network traffic using Malcolm's simple filter dict.
Use this for field-based filtering with human-readable time ranges. To
search with Arkime expression syntax instead, or when you need a session
id to feed arkime_session_pcap / arkime_add_tags afterward, use
arkime_sessions (only its rows carry that id). For raw OpenSearch DSL,
use search_dsl. Confirm field names with malcolm_field_search first —
Malcolm uses non-standard names. Returns the raw Malcolm /mapi/document
response (matching documents); when nothing matched and a filter names a
field Malcolm does not index, the correct field name is reported above
the response.
Two defaults to know before the first call: with no time_from this
searches ALL retained history, where malcolm_aggregate covers only the
last 24 hours; and filter values are matched exactly, so any wildcard or
substring has to go to search_dsl instead.
Every document comes back whole, 2 to 3.5 KB of JSON each on Malcolm's
training data, so 20 conn documents run to about 46,000 characters.
For counts or top values use malcolm_aggregate, and keep limit small
when reading documents. When the results fill limit, a "Note:" line
above the JSON says more may match; Malcolm reports no total.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max documents to return. | |
| doctype | No | Target index. Empty = the Malcolm network index (Zeek/Suricata); "host"/"beat"* = host/beats logs; "arkime"/"session"* = the Arkime sessions index. | |
| filters | No | JSON object in Malcolm filter syntax (NOT OpenSearch DSL). Values are matched EXACTLY — Malcolm compiles this to a terms query, so wildcards are NOT supported and "*example*" matches only the literal string. Use search_dsl for substring/wildcard matching. Examples: {"event.dataset":"conn"}; {"source.ip":"192.0.2.77"}; {"zeek.dns.query":"ntp.ubuntu.com"}; {"!network.transport":"icmp"} excludes; {"network.direction":["inbound","outbound"]} is OR; {"!related.password":null} means the field must exist. Empty = match all. | {} |
| time_to | No | End time, dateparser format. Empty = now. | |
| time_from | No | Start time, dateparser format ("2024-01-01", "7 days ago"). Empty = ALL history (this tool's default, unlike malcolm_aggregate which defaults to the last 24 hours). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |