API trigger.get returns more problems than shown in Dashboard (Global View)

[Ipod86]

Hi everyone,

I am struggling with the Zabbix API (v7.0/7.4). I am trying to build a bash script that fetches only the currently active problems as seen in the Zabbix Dashboard "Current problems" widget.
In my Zabbix Frontend (Global View), I only see one active warning (High memory usage). However, my API script returns nine results, including "Not running" and "Restarted" messages that are NOT visible in my current dashboard view.
I've tried a debug script to check the acknowledged and suppressed status of these triggers. Here is the output:

david@iobroker:~$ ./test_zabbix.sh --- Diagnose: Aktive Trigger-Details ---
  {
    "host": "Proxmox_Home",
    "msg": "Proxmox VE: LXC [pve/Llm] has been restarted",
    "prio": "1",
    "acknowledged": "0",
    "suppressed": null
  }
  {
    "host": "Proxmox_Home",
    "msg": "Proxmox VE: LXC [pve/cloudflare (lxc/116)]: Not running",
    "prio": "3",
    "acknowledged": "1",
    "suppressed": null
  }
  ... (several more "Not running" messages with ack 0 or 1) ...
  {
    "host": "Proxmox_Home",
    "msg": "Proxmox VE: VM [pve/PBS (qemu/114)] high memory usage",
    "prio": "2",
    "acknowledged": "0",
    "suppressed": null
  }

Observations:
Some "Not running" messages have acknowledged: "1", but they still show up in the API result.
suppressed is returning null (probably because I am using trigger.get instead of problem.get).
My Dashboard is clean, but the API seems to ignore the filters that make the Dashboard "clean".
The code I am currently using:

curl -s -X POST "$ZABBIX_URL" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $TOKEN" \
    -d '{
      "jsonrpc": "2.0",
      "method": "trigger.get",
      "params": {
          "output": ["triggerid", "description", "priority"],
          "selectHosts": ["name"],
          "selectLastEvent": ["acknowledged", "suppressed"],
          "only_true": true,
          "monitored": true,
          "expandDescription": true
      },
      "id": 1
  }'

My Question:
What do I need to change in my API request to get exactly and only the same active problems that are visible in the "Current problems" dashboard widget? Should I switch to problem.get, and if so, how do I correctly filter for "unsuppressed" and "globally visible" issues?
Thanks in advance for your help!

[guntis_liepins]

You must match filters in Dashboard.
You can have some ideas how zabbix combine data if you enable frontend debugging (Users/User Groups set Debug mode = Enable for user group)
Debug button should appear at the bottom of the page.
Click on button and debug output for page .api calls - in my environment it uses both problem.get and trigger.get. and some more.

[Ipod86]

Thanks for your reply, that solved it together with ChatGPT.

 
#!/bin/bash
set -euo pipefail

ZABBIX_URL="http://192.168.99.199/zabbix/api_jsonrpc.php"
TOKEN="e4a93e9919ea686a4525b5d57287c766cdf835035b0 d0839bed4b8fb9a714ae5"

# 1. Alle potenziellen Problem-IDs holen
raw_problems=$(curl -s -X POST "$ZABBIX_URL" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d '{
"jsonrpc": "2.0",
"method": "problem.get",
"params": {
"output": ["objectid"],
"filter": { "acknowledged": "0" },
"severities": [2, 3, 4, 5],
"suppressed": false,
"recent": false
},
"id": 1
}')

trigger_ids=$(echo "$raw_problems" | jq -c '[.result[].objectid | tonumber]')

if [ "$trigger_ids" == "[]" ]; then
echo "{"hosts": {}}"
exit 0
fi

# 2. Mit skipDependent filtern und Hostnamen holen
filtered_triggers=$(curl -s -X POST "$ZABBIX_URL" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d "{
"jsonrpc": "2.0",
"method": "trigger.get",
"params": {
"output": ["triggerid", "description", "priority", "lastchange"],
"triggerids": $trigger_ids,
"selectHosts": ["name"],
"skipDependent": true,
"monitored": true,
"only_true": true,
"expandDescription": true
},
"id": 2
}")

# 3. Finales JSON mit den zwei Ebenen: count und alerts
echo "$filtered_triggers" | jq '
{
hosts: (
[ .result[] | {
host: .hosts[0].name,
alert: {
message: .description,
priority: (
if .priority == "2" then "Warning"
elif .priority == "3" then "Average"
elif .priority == "4" then "High"
elif .priority == "5" then "Disaster"
else "Information" end
),
time: (.lastchange | tonumber | strftime("%d.%m.%Y %H:%M:%S"))
}
} ]
| group_by(.host)
| map({
(.[0].host): {
warnings: {
count: (map(.alert) | length),
alerts: (map(.alert))
}
}
})
| add // {}
)
}
'