event.get

Description

integer/array event.get(object parameters)

The method allows to retrieve events according to the given parameters.

Parameters

(object) Parameters defining the desired output.

The method supports the following parameters.

Parameter	Type	Description
eventids	string/array	Return only events with the given IDs.
groupids	string/array	Return only events created by objects that belong to the given host groups.
hostids	string/array	Return only events created by objects that belong to the given hosts.
objectids	string/array	Return only events created by the given objects.
applicationids	string/array	Return only events created by objects that belong to the given applications. Applies only if object is trigger or item.
source	integer	Return only events with the given type. Refer to the event object page for a list of supported event types. Default: 0 - trigger events.
object	integer	Return only events created by objects of the given type. Refer to the event object page for a list of supported object types. Default: 0 - trigger.
acknowledged	boolean	If set to `true` return only acknowledged events.
severities	integer/array	Return only events with given trigger severities. Applies only if object is trigger.
tags	object	Return only events with given tags. Exact match by tag and case-insensitive search by value. Format: `[{"tag": "<tag>", "value": "<value>"}, ...]`. An empty array returns all events.
eventid_from	string	Return only events with IDs greater or equal to the given ID.
eventid_till	string	Return only events with IDs less or equal to the given ID.
time_from	timestamp	Return only events that have been created after or at the given time.
time_till	timestamp	Return only events that have been created before or at the given time.
value	integer/array	Return only events with the given values.
selectHosts	query	Return hosts containing the object that created the event in the `hosts` property. Supported only for events generated by triggers, items or LLD rules.
selectRelatedObject	query	Return the object that created the event in the `relatedObject` property. The type of object returned depends on the event type.
select_alerts	query	Return alerts generated by the event in the `alerts` property. Alerts are sorted in reverse chronological order.
select_acknowledges	query	Return event's acknowledges in the `acknowledges` property. Acknowledges are sorted in reverse chronological order. The event acknowledgement object has the following properties: `acknowledgeid` - `(string)` acknowledgement's ID; `userid` - `(string)` ID of the user that acknowledged the event; `eventid` - `(string)` ID of the acknowledged event; `clock` - `(timestamp)` time when the event was acknowledged; `message` - `(string)` text of the acknowledgement message; `alias` - `(string)` alias of the user that acknowledged the event; `name` - `(string)` name of the user that acknowledged the event; `surname` - `(string)` surname of the user that acknowledged the event. Supports `count`.
selectTags	query	Return event tags in `tags` property.
sortfield	string/array	Sort the result by the given properties. Possible values are: `eventid`, `objectid` and `clock`.
countOutput	flag	These parameters being common for all `get` methods are described in detail in the reference commentary page.
editable	boolean
excludeSearch	flag
filter	object
limit	integer
output	query
preservekeys	flag
search	object
searchByAny	boolean
searchWildcardsEnabled	boolean
sortorder	string/array
startSearch	flag

Return values

(integer/array) Returns either:

an array of objects;
the count of retrieved objects, if the countOutput parameter has been used.

Examples

Retrieving trigger events

Retrieve the latest events from trigger "13926."

Request:

{  "jsonrpc": "2.0",  "method": "event.get",  "params": {  "output": "extend",  "select_acknowledges": "extend",  "selectTags": "extend",  "objectids": "13926",  "sortfield": ["clock", "eventid"],  "sortorder": "DESC"  },  "auth": "038e1d7b1735c6a5436ee9eae095879e",  "id": 1 }

Response:

{  "jsonrpc": "2.0",  "result": [  {  "acknowledges": [  {  "acknowledgeid": "1",  "userid": "1",  "eventid": "9695",  "clock": "1350640590",  "message": "Problem resolved.\n\r----[BULK ACKNOWLEDGE]----",  "alias": "Admin"  }  ],  "eventid": "9695",  "source": "0",  "object": "0",  "objectid": "13926",  "clock": "1347970410",  "value": "1",  "acknowledged": "1",  "ns": "413316245",  "r_eventid": "0",  "c_eventid": "0",  "correlationid": "0",  "userid": "0",  "tags": [  {  "tag": "service",  "value": "mysqld"  },  {  "tag": "error",  "value": ""  }  ]  },  {  "acknowledges": [],  "eventid": "9671",  "source": "0",  "object": "0",  "objectid": "13926",  "clock": "1347970347",  "value": "0",  "acknowledged": "0",  "ns": "0",  "r_eventid": "0",  "c_eventid": "0",  "correlationid": "0",  "userid": "0",  "tags": []  }  ],  "id": 1 }

Retrieving events by time period

Retrieve all events that have been created between October 9 and 10, 2012, in reverse chronological order.