integer/array event.get(object parameters)
The method allows to retrieve events according to the given parameters.
(object)
Parameters defining the desired output.
The method supports the following parameters.
Parameter | Type | Description |
---|---|---|
eventids | string/array | Return only events with the given IDs. |
groupids | string/array | Return only events created by objects that belong to the given host groups. |
hostids | string/array | Return only events created by objects that belong to the given hosts. |
objectids | string/array | Return only events created by the given objects. |
applicationids | string/array | Return only events created by objects that belong to the given applications. Applies only if object is trigger or item. |
source | integer | Return only events with the given type. Refer to the event object page for a list of supported event types. Default: 0 - trigger events. |
object | integer | Return only events created by objects of the given type. Refer to the event object page for a list of supported object types. Default: 0 - trigger. |
acknowledged | boolean | If set to true return only acknowledged events. |
suppressed | boolean | true - return only suppressed events; false - return events in the normal state. |
severities | integer/array | Return only events with given event severities. Applies only if object is trigger. |
evaltype | integer | Rules for tag searching. Possible values: 0 - (default) And/Or; 2 - Or. |
tags | array of objects | Return only events with given tags. Exact match by tag and case-insensitive search by value and operator. Format: [{"tag": "<tag>", "value": "<value>", "operator": "<operator>"}, ...] .An empty array returns all events. Possible operator types: 0 - (default) Like; 1 - Equal; 2 - Not like; 3 - Not equal 4 - Exists; 5 - Not exists. |
eventid_from | string | Return only events with IDs greater or equal to the given ID. |
eventid_till | string | Return only events with IDs less or equal to the given ID. |
time_from | timestamp | Return only events that have been created after or at the given time. |
time_till | timestamp | Return only events that have been created before or at the given time. |
problem_time_from | timestamp | Returns only events that were in the problem state starting with problem_time_from . Applies only if the source is trigger event and object is trigger. Mandatory if problem_time_till is specified. |
problem_time_till | timestamp | Returns only events that were in the problem state until problem_time_till . Applies only if the source is trigger event and object is trigger. Mandatory if problem_time_from is specified. |
value | integer/array | Return only events with the given values. |
selectHosts | query | Return a hosts property with hosts containing the object that created the event. Supported only for events generated by triggers, items or LLD rules. |
selectRelatedObject | query | Return a relatedObject property with the object that created the event. The type of object returned depends on the event type. |
select_alerts | query | Return an alerts property with alerts generated by the event. Alerts are sorted in reverse chronological order. |
select_acknowledges | query | Return an acknowledges property with event updates. Event updates are sorted in reverse chronological order. The event update object has the following properties: acknowledgeid - (string) acknowledgment's ID; userid - (string) ID of the user that updated the event; eventid - (string) ID of the updated event; clock - (timestamp) time when the event was updated; message - (string) text of the message; action - (integer) update action that was performed see event.acknowledge; old_severity - (integer) event severity before this update action; new_severity - (integer) event severity after this update action; alias - (string) alias of the user that updated the event; name - (string) name of the user that updated the event; surname - (string) surname of the user that updated the event. Supports count . |
selectTags | query | Return a tags property with event tags. |
selectSuppressionData | query | Return a suppression_data property with the list of maintenances: maintenanceid - (string) ID of the maintenance; suppress_until - (integer) time until the event is suppressed. |
sortfield | string/array | Sort the result by the given properties. Possible values are: eventid , objectid and clock . |
countOutput | boolean | These parameters being common for all get methods are described in detail in the reference commentary page. |
editable | boolean | |
excludeSearch | boolean | |
filter | object | |
limit | integer | |
output | query | |
preservekeys | boolean | |
search | object | |
searchByAny | boolean | |
searchWildcardsEnabled | boolean | |
sortorder | string/array | |
startSearch | boolean |
(integer/array)
Returns either:
countOutput
parameter has been used.Retrieve the latest events from trigger “13926.”
Request:
{ "jsonrpc": "2.0", "method": "event.get", "params": { "output": "extend", "select_acknowledges": "extend", "selectTags": "extend", "selectSuppressionData": "extend", "objectids": "13926", "sortfield": ["clock", "eventid"], "sortorder": "DESC" }, "auth": "038e1d7b1735c6a5436ee9eae095879e", "id": 1 }
Response:
{ "jsonrpc": "2.0", "result": [ { "eventid": "9695", "source": "0", "object": "0", "objectid": "13926", "clock": "1347970410", "value": "1", "acknowledged": "1", "ns": "413316245", "name": "MySQL is down", "severity": "5", "r_eventid": "0", "c_eventid": "0", "correlationid": "0", "userid": "0", "opdata": "", "acknowledges": [ { "acknowledgeid": "1", "userid": "1", "eventid": "9695", "clock": "1350640590", "message": "Problem resolved.\n\r----[BULK ACKNOWLEDGE]----", "action": "6", "old_severity": "0", "new_severity": "0", "alias": "Admin", "name": "Zabbix", "surname": "Administrator" } ], "suppression_data": [ { "maintenanceid": "15", "suppress_until": "1472511600" } ], "suppressed": "1", "tags": [ { "tag": "service", "value": "mysqld" }, { "tag": "error", "value": "" } ] }, { "eventid": "9671", "source": "0", "object": "0", "objectid": "13926", "clock": "1347970347", "value": "0", "acknowledged": "0", "ns": "0", "name": "Unavailable by ICMP ping", "severity": "4", "r_eventid": "0", "c_eventid": "0", "correlationid": "0", "userid": "0", "opdata": "", "acknowledges": [], "suppression_data": [], "suppressed": "0", "tags": [] } ], "id": 1 }
Retrieve all events that have been created between October 9 and 10, 2012, in reverse chronological order.
Request:
{ "jsonrpc": "2.0", "method": "event.get", "params": { "output": "extend", "time_from": "1349797228", "time_till": "1350661228", "sortfield": ["clock", "eventid"], "sortorder": "desc" }, "auth": "038e1d7b1735c6a5436ee9eae095879e", "id": 1 }
Response:
{ "jsonrpc": "2.0", "result": [ { "eventid": "20616", "source": "0", "object": "0", "objectid": "14282", "clock": "1350477814", "value": "1", "acknowledged": "0", "ns": "0", "name": "Less than 25% free in the history cache", "severity": "3", "r_eventid": "0", "c_eventid": "0", "correlationid": "0", "userid": "0", "opdata": "", "suppressed": "0" }, { "eventid": "20617", "source": "0", "object": "0", "objectid": "14283", "clock": "1350477814", "value": "0", "acknowledged": "0", "ns": "0", "name": "Zabbix trapper processes more than 75% busy", "severity": "3", "r_eventid": "0", "c_eventid": "0", "correlationid": "0", "userid": "0", "opdata": "", "suppressed": "0" }, { "eventid": "20618", "source": "0", "object": "0", "objectid": "14284", "clock": "1350477815", "value": "1", "acknowledged": "0", "ns": "0", "name": "High ICMP ping loss", "severity": "3", "r_eventid": "0", "c_eventid": "0", "correlationid": "0", "userid": "0", "opdata": "", "suppressed": "0" } ], "id": 1 }
CEvent::get() in ui/include/classes/api/services/CEvent.php.