> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.
# List Activity Logs
Provides the list of records from the activity logs.
External Documentation
To learn more, visit the [Azure documentation](https://learn.microsoft.com/en-us/rest/api/monitor/activity-logs/list?view=rest-monitor-2015-04-01\&tabs=HTTP).
## Parameters
| Parameter | Description |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Filter | Reduces the set of data collected.
This argument is required and it also requires at least the start date/time.
The \*\*$filter** argument is very restricted and allows only the following patterns.
- *List events for a resource group*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z' and resourceGroupName eq 'resourceGroupName'.
- *List events for resource*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z' and resourceUri eq 'resourceURI'.
- *List events for a subscription in a time range*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z'.
- *List events for a resource provider*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z' and resourceProvider eq 'resourceProviderName'.
- *List events for a correlation Id*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z' and correlationId eq 'correlationID'.
**NOTE**: No other syntax is allowed. |
| Subscription ID | The Azure subscription Id. |
## Example Output
```json theme={"dark"}
{
"nextLink": "Provides the link to retrieve the next set of events.",
"value": [
{
"authorization": {
"action": "the permissible actions. For instance: microsoft.support/supporttickets/write",
"role": "the role of the user. For instance: Subscription Admin",
"scope": "the scope."
},
"caller": "the email address of the user who has performed the operation, the UPN claim or SPN claim based on availability.",
"category": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"claims": {},
"correlationId": "the correlation Id, usually a GUID in the string format. The correlation Id is shared among the events that belong to the same uber operation.",
"description": "the description of the event.",
"eventDataId": "the event data Id. This is a unique identifier for an event.",
"eventName": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"eventTimestamp": "the timestamp of when the event was generated by the Azure service processing the request corresponding the event. It in ISO 8601 format.",
"httpRequest": {
"clientIpAddress": "the client Ip Address",
"clientRequestId": "the client request id.",
"method": "the Http request method.",
"uri": "the Uri."
},
"id": "the Id of this event as required by ARM for RBAC. It contains the EventDataID and a timestamp information.",
"level": "the event level",
"operationId": "It is usually a GUID shared among the events corresponding to single operation. This value should not be confused with EventName.",
"operationName": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"properties": {},
"resourceGroupName": "the resource group name of the impacted resource.",
"resourceId": "the resource uri that uniquely identifies the resource that caused this event.",
"resourceProviderName": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"resourceType": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"status": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"subStatus": {
"localizedValue": "the locale specific value.",
"value": "the invariant value."
},
"submissionTimestamp": "the timestamp of when the event became available for querying via this API. It is in ISO 8601 format. This value should not be confused eventTimestamp. As there might be a delay between the occurrence time of the event, and the time that the event is submitted to the Azure logging infrastructure.",
"subscriptionId": "the Azure subscription Id usually a GUID.",
"tenantId": "the Azure tenant Id"
}
]
}
```
## Workflow Library Example
[List Activity Logs with Azure and Send Results Via Email](https://library.blinkops.com/workflows/list-activity-logs-with-azure-and-send-results-via-email)
Preview this Workflow on desktop