PavloY.54590 (Customer) asked a question.
System logs api published filter not working correctly
Hello. I am trying to use system log api with published filter.
Not working both in api directly or in admin panel
`{{baseUrl}}/api/v1/logs/?limit=100&filter=published gt "2024-01-10T19:11:40.930Z"`
But it's not working, the response is empty with any date i entered.
Same request using since is working properly and i have bunch of events
`{{baseUrl}}/api/v1/logs/?limit=100&since=2024-01-10T19:11:40.930Z`
could you give a full json of system log record which contain published for example?
here's first one from request with since
```
{
"actor": {
"id": "***",
"type": "PublicClientApp",
"alternateId": "",
"displayName": ""***",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.31.0",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": ""***",
"ipAddress": ""***",
"geographicalContext": {
"city": ""***",
"state": ""***",
"country": ""***",
"postalCode": ""***",
"geolocation": {
"lat": 00,
"lon": -00
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"externalSessionId": "unknown"
},
"displayMessage": "OIDC access token is granted",
"eventType": "app.oauth2.token.grant.access_token",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2024-01-10T19:16:08.881Z",
"securityContext": {
"asNumber": null,
"asOrg": null,
"isp": null,
"domain": null,
"isProxy": null
},
"severity": "INFO",
"debugContext": {
"debugData": {
"clientAuthType": "client_secret_post",
"grantedScopes": "okta.logs.read, offline_access, okta.users.read",
"requestId": ""***",
"responseTime": "288",
"dtHash": ""***",
"clientSecret": ""***",
"requestUri": "/oauth2/v1/token",
"requestedScopes": "",
"threatSuspected": "false",
"grantType": "refresh_token",
"url": "/oauth2/v1/token?"
}
},
"legacyEventType": "app.oauth2.token.grant.access_token_success",
"transaction": {
"type": "WEB",
"id": ""***",
"detail": {}
},
"uuid": "b5977a5c-afec-11ee-99c2-659e9ea63176",
"version": "0",
"request": {
"ipChain": [
{
"ip": ""***",
"geographicalContext": {
"city": ""***",
"state": ""***",
"country": ""***",
"postalCode": ""***",
"geolocation": {
"lat": 0,
"lon": -0
}
},
"version": "V4",
"source": null
}
]
},
"target": [
{
"id": ""***",
"type": "User",
"alternateId": null,
"displayName": null,
"detailEntry": null
},
{
"id": ""***",
"type": "access_token",
"alternateId": null,
"displayName": "Access Token",
"detailEntry": {
"expires": "2024-01-10T20:16:08.000Z",
"subject": ""***",
"hash": ""***"
}
}
]
},
```
Hi @PavloY.54590 (Customer) , Thank you for reaching out to the Okta Community!
If I’m not mistaking you need to use the “since” parameter:
https://developer.okta.com/docs/reference/api/system-log/#datetime-filter
Please try something like
{{url}}/api/v1/logs?since=2024-01-10T19:11:40.930Z&limit=100
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--------------------------------
Ask the Experts: Now Thru 1/31 Okta FastPass Engineering and Product Teams Answer Your Questions
oh, so there is no way of using it with filter published ?
i need to get gt '>' events (greater then)
because since returns ge (greater or equal)
Maybe try the "after" parameter:
https://developer.okta.com/docs/reference/api/system-log/#datetime-filter
Regards.
--------------------------------
Ask the Experts: Now Thru 1/31 Okta FastPass Engineering and Product Teams Answer Your Questions
I can’t since it is system generated and does not accept date.
The
after
parameter is system generated for use in "next" links. Don't attempt to craft requests that use this value. Rely on the system-generated links instead.
Fair, I missed that. Sorry.
I don't see any other option for filtering.
Regards.
--------------------------------
Ask the Experts: Now Thru 1/31 Okta FastPass Engineering and Product Teams Answer Your Questions