External DocumentationTo learn more, visit the Azure documentation.
Parameters
| Parameter | Description |
|---|---|
| Filter | Reduces the set of data collected. This argument is required and it also requires at least the start date/time. The **filter∗∗argumentisveryrestrictedandallowsonlythefollowingpatterns.<br/>−∗Listeventsforaresourcegroup∗:filter=eventTimestamp ge ‘2014-07-16T04:36:37.6407898Z’ and eventTimestamp le ‘2014-07-20T04:36:37.6407898Z’ and resourceGroupName eq ‘resourceGroupName’. - List events for resource: filter=eventTimestampge′2014−07−16T04:36:37.6407898Z′andeventTimestample′2014−07−20T04:36:37.6407898Z′andresourceUrieq′resourceURI′.<br/>−∗Listeventsforasubscriptioninatimerange∗:filter=eventTimestamp ge ‘2014-07-16T04:36:37.6407898Z’ and eventTimestamp le ‘2014-07-20T04:36:37.6407898Z’. - List events for a resource provider: filter=eventTimestampge′2014−07−16T04:36:37.6407898Z′andeventTimestample′2014−07−20T04:36:37.6407898Z′andresourceProvidereq′resourceProviderName′.<br/>−∗ListeventsforacorrelationId∗:filter=eventTimestamp ge ‘2014-07-16T04:36:37.6407898Z’ and eventTimestamp le ‘2014-07-20T04:36:37.6407898Z’ and correlationId eq ‘correlationID’. NOTE: No other syntax is allowed. |
| Select | Used to fetch events with only the given properties. The $select argument is a comma separated list of property names to be returned. Possible values are: authorization, claims, correlationId, description, eventDataId, eventName, eventTimestamp, httpRequest, level, operationId, operationName, properties, resourceGroupName, resourceProviderName, resourceId, status, submissionTimestamp, subStatus, subscriptionId. |
| Subscription ID | The Azure subscription Id. |
Example Output
{
"nextLink": "Provides the link to retrieve the next set of events.",
"value": [
{
"authorization": {
"action": "the permissible actions. For instance: microsoft.support/supporttickets/write",
"role": "the role of the user. For instance: Subscription Admin",
"scope": "the scope."
},
"caller": "the email address of the user who has performed the operation, the UPN claim or SPN claim based on availability.",
"category": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"claims": {},
"correlationId": "the correlation Id, usually a GUID in the string format. The correlation Id is shared among the events that belong to the same uber operation.",
"description": "the description of the event.",
"eventDataId": "the event data Id. This is a unique identifier for an event.",
"eventName": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"eventTimestamp": "the timestamp of when the event was generated by the Azure service processing the request corresponding the event. It in ISO 8601 format.",
"httpRequest": {
"clientIpAddress": "the client Ip Address",
"clientRequestId": "the client request id.",
"method": "the Http request method.",
"uri": "the Uri."
},
"id": "the Id of this event as required by ARM for RBAC. It contains the EventDataID and a timestamp information.",
"level": "the event level",
"operationId": "It is usually a GUID shared among the events corresponding to single operation. This value should not be confused with EventName.",
"operationName": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"properties": {},
"resourceGroupName": "the resource group name of the impacted resource.",
"resourceId": "the resource uri that uniquely identifies the resource that caused this event.",
"resourceProviderName": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"resourceType": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"status": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"subStatus": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"submissionTimestamp": "the timestamp of when the event became available for querying via this API. It is in ISO 8601 format. This value should not be confused eventTimestamp. As there might be a delay between the occurrence time of the event, and the time that the event is submitted to the Azure logging infrastructure.",
"subscriptionId": "the Azure subscription Id usually a GUID.",
"tenantId": "the Azure tenant Id"
}
]
}