Provides the list of records from the activity logs.
Supports noop? false
Parameters
submissiontimestamp(Optional[String[1]])
— the timestamp of when the event became available for querying via this API. It is in ISO 8601 format. This value should not be confused eventTimestamp. As there might be a delay between the occurrence time of the event, and the time that the event is submitted to the Azure logging infrastructure.
caller(Optional[String[1]])
— the email address of the user who has performed the operation, the UPN claim or SPN claim based on availability.
operationid(Optional[String[1]])
— It is usually a GUID shared among the events corresponding to single operation. This value should not be confused with EventName.
status(Optional[String[1]])
— a string describing the status of the operation. Some typical values are: Started, In progress, Succeeded, Failed, Resolved.
properties(Optional[String[1]])
— the set of pairs (usually a Dictionary) that includes details about the event.
description(Optional[String[1]])
— the description of the event.
operationname(Optional[String[1]])
— the operation name.
category(Optional[String[1]])
— the event category.
resourceid(Optional[String[1]])
— the resource uri that uniquely identifies the resource that caused this event.
httprequest(Optional[String[1]])
— the HTTP request info. Usually includes the 'clientRequestId', 'clientIpAddress' (IP address of the user who initiated the event) and 'method' (HTTP method e.g. PUT).
subscription_id(Optional[String[1]])
—
subscriptionid(Optional[String[1]])
— the Azure subscription Id usually a GUID.
claims(Optional[String[1]])
— key value pairs to identify ARM permissions.
resourcegroupname(Optional[String[1]])
— the resource group name of the impacted resource.
resourceprovidername(Optional[String[1]])
— the resource provider name of the impacted resource.
substatus(Optional[String[1]])
— the event sub status. Most of the time, when included, this captures the HTTP status code of the REST call. Common values are: OK (HTTP Status Code: 200), Created (HTTP Status Code: 201), Accepted (HTTP Status Code: 202), No Content (HTTP Status Code: 204), Bad Request(HTTP Status Code: 400), Not Found (HTTP Status Code: 404), Conflict (HTTP Status Code: 409), Internal Server Error (HTTP Status Code: 500), Service Unavailable (HTTP Status Code:503), Gateway Timeout (HTTP Status Code: 504)
eventtimestamp(Optional[String[1]])
— the timestamp of when the event was generated by the Azure service processing the request corresponding the event. It in ISO 8601 format.
tenantid(Optional[String[1]])
— the Azure tenant Id
filter(Optional[String[1]])
— Reduces the set of data collected.The **$filter** argument is very restricted and allows only the following patterns.- *List events for a resource group*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z' and resourceGroupName eq 'resourceGroupName'.- *List events for resource*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z' and resourceUri eq 'resourceURI'.- *List events for a subscription in a time range*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z'.- *List events for a resource provider*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z' and resourceProvider eq 'resourceProviderName'.- *List events for a correlation Id*: $filter=eventTimestamp ge '2014-07-16T04:36:37.6407898Z' and eventTimestamp le '2014-07-20T04:36:37.6407898Z' and correlationId eq 'correlationID'.**NOTE**: No other syntax is allowed.
resourcetype(Optional[String[1]])
— the resource type
api_version(Optional[String[1]])
— Client Api Version.
eventname(Optional[String[1]])
— the event name. This value should not be confused with OperationName. For practical purposes, OperationName might be more appealing to end users.
id(Optional[String[1]])
— the Id of this event as required by ARM for RBAC. It contains the EventDataID and a timestamp information.
authorization(Optional[String[1]])
— The sender authorization information.
correlationid(Optional[String[1]])
— the correlation Id, usually a GUID in the string format. The correlation Id is shared among the events that belong to the same uber operation.
level(Optional[String[1]])
— the event level
select(Optional[String[1]])
— Used to fetch events with only the given properties.The **$select** argument is a comma separated list of property names to be returned. Possible values are: *authorization*, *claims*, *correlationId*, *description*, *eventDataId*, *eventName*, *eventTimestamp*, *httpRequest*, *level*, *operationId*, *operationName*, *properties*, *resourceGroupName*, *resourceProviderName*, *resourceId*, *status*, *submissionTimestamp*, *subStatus*, *subscriptionId*
eventdataid(Optional[String[1]])
— the event data Id. This is a unique identifier for an event.