You are viewing documentation for the development version, it may be incomplete.
Join our translation project and help translate Zabbix documentation into your native language.

event.get

Description

integer/array event.get(object parameters)

The method allows to retrieve events according to the given parameters.

This method may return events of a deleted entity if these events have not been removed by the housekeeper yet.

This method is available to users of any type. Permissions to call the method can be revoked in user role settings. See User roles for more information.

Parameters

(object) Parameters defining the desired output.

The method supports the following parameters.

Parameter Type Description
eventids ID/array Return only events with the given IDs.
groupids ID/array Return only events created by objects that belong to the given host groups.
hostids ID/array Return only events created by objects that belong to the given hosts.
objectids ID/array Return only events created by the given objects.
source integer Return only events with the given type.

Refer to the event object page for a list of supported event types.

Default: 0 - trigger events.
object integer Return only events created by objects of the given type.

Refer to the event object page for a list of supported object types.

Default: 0 - trigger.
acknowledged boolean If set to true return only acknowledged events.
action integer Return only events for which the given event update actions have been performed. For multiple actions, use a combination of any acceptable bitmap values as bitmask.
action_userids ID/array Return only events with the given IDs of users who performed the event update actions.
suppressed boolean true - return only suppressed events;
false - return events in the normal state.
symptom boolean true - return only symptom events;
false - return only cause events.
severities integer/array Return only events with the given event severities. Applies only if object is trigger.
trigger_severities integer/array Return only events with the given trigger severities. Applies only if object is trigger.
evaltype integer Rules for tag searching.

Possible values:
0 - (default) And/Or;
2 - Or.
tags array Return only events with the given tags. Exact match by tag and case-insensitive search by value and operator.
Format: [{"tag": "<tag>", "value": "<value>", "operator": "<operator>"}, ...].
An empty array returns all events.

Possible operator types:
0 - (default) Like;
1 - Equal;
2 - Not like;
3 - Not equal
4 - Exists;
5 - Not exists.
eventid_from string Return only events with IDs greater or equal to the given ID.
eventid_till string Return only events with IDs less or equal to the given ID.
time_from timestamp Return only events that have been created after or at the given time.
time_till timestamp Return only events that have been created before or at the given time.
problem_time_from timestamp Returns only events that were in the problem state starting with problem_time_from. Applies only if the source is trigger event and object is trigger. Mandatory if problem_time_till is specified.
problem_time_till timestamp Returns only events that were in the problem state until problem_time_till. Applies only if the source is trigger event and object is trigger. Mandatory if problem_time_from is specified.
value integer/array Return only events with the given values.
selectAcknowledges query Return an acknowledges property with event updates. Event updates are sorted in reverse chronological order.

The event update object has the following properties:
acknowledgeid - (ID) acknowledgment's ID;
userid - (ID) ID of the user that updated the event;
clock - (timestamp) time when the event was updated;
message - (string) text of the message;
action - (integer) update action that was performed, see event.acknowledge;
old_severity - (integer) event severity before this update action;
new_severity - (integer) event severity after this update action;
suppress_until - (timestamp) time till event will be suppressed;
taskid - (ID) ID of task if current event is undergoing a rank change;
username - (string) username of the user that updated the event;
name - (string) name of the user that updated the event;
surname - (string) surname of the user that updated the event.

Supports count.
selectAlerts query Return an alerts property with alerts generated by the event. Alerts are sorted in reverse chronological order.
selectHosts query Return a hosts property with hosts containing the object that created the event. Supported only for events generated by triggers, items or LLD rules.
selectRelatedObject query Return a relatedObject property with the object that created the event. The type of object returned depends on the event type.
selectSuppressionData query Return a suppression_data property with the list of active maintenances and manual suppressions:
maintenanceid - (ID) ID of the maintenance;
userid - (ID) ID of user who suppressed the event;
suppress_until - (integer) time until the event is suppressed.
selectTags query Return a tags property with event tags.
filter object Return only those results that exactly match the given filter.

Accepts an object, where the keys are property names, and the values are either a single value or an array of values to match against.

Does not support properties of text data type.
sortfield string/array Sort the result by the given properties.

Possible values: eventid, objectid, clock.

Possible values when used together with groupBy: objectid.

Possible values when used together with countOutput and groupBy: objectid, rowscount.
groupBy string/array Group the results by the given properties. The specified properties will be returned in the results.

Possible values: objectid.
countOutput boolean These parameters being common for all get methods are described in detail in the reference commentary page.
editable boolean
excludeSearch boolean
limit integer
output query
preservekeys boolean
search object
searchByAny boolean
searchWildcardsEnabled boolean
sortorder string/array
startSearch boolean
select_acknowledges
(deprecated)
query This parameter is deprecated, please use selectAcknowledges instead.
Return an acknowledges property with event updates.
Event updates are sorted in reverse chronological order.

The event update object has the following properties:
acknowledgeid - (ID) acknowledgment's ID;
userid - (ID) ID of the user that updated the event;
clock - (timestamp) time when the event was updated;
message - (string) text of the message;
action - (integer) update action that was performed, see event.acknowledge;
old_severity - (integer) event severity before this update action;
new_severity - (integer) event severity after this update action;
suppress_until - (timestamp) time till event will be suppressed;
taskid - (ID) ID of task if current event is undergoing a rank change;
username - (string) username of the user that updated the event;
name - (string) name of the user that updated the event;
surname - (string) surname of the user that updated the event.

Supports count.
select_alerts
(deprecated)
query This parameter is deprecated, please use selectAlerts instead.
Return an alerts property with alerts generated by the event.
Alerts are sorted in reverse chronological order.

Return values

(integer/array) Returns either:

  • an array of objects;
  • the count of retrieved objects, if the countOutput parameter has been used, but the groupBy parameter has not been used;
  • an array of objects with aggregation results, if the groupBy parameter has been used.

Examples

Retrieving trigger events

Retrieve the latest events from trigger "13926".

Request:

{
           "jsonrpc": "2.0",
           "method": "event.get",
           "params": {
               "output": "extend",
               "selectAcknowledges": "extend",
               "selectSuppressionData": "extend",
               "selectTags": "extend",
               "objectids": "13926",
               "sortfield": ["clock", "eventid"],
               "sortorder": "DESC"
           },
           "id": 1
       }

Response:

{
           "jsonrpc": "2.0",
           "result": [
               {
                   "eventid": "9695",
                   "source": "0",
                   "object": "0",
                   "objectid": "13926",
                   "clock": "1347970410",
                   "value": "1",
                   "acknowledged": "1",
                   "ns": "413316245",
                   "name": "MySQL is down",
                   "severity": "5",
                   "r_eventid": "0",
                   "c_eventid": "0",
                   "correlationid": "0",
                   "userid": "0",
                   "cause_eventid": "0",
                   "acknowledges": [
                       {
                           "acknowledgeid": "1",
                           "userid": "1",
                           "clock": "1350640590",
                           "message": "Problem resolved.\n\r----[BULK ACKNOWLEDGE]----",
                           "action": "6",
                           "old_severity": "0",
                           "new_severity": "0",
                           "suppress_until": "1472511600",
                           "taskid": "0",
                           "username": "Admin",
                           "name": "Zabbix",
                           "surname": "Administrator"
                       }
                   ],
                   "opdata": "",
                   "suppression_data": [
                       {
                           "maintenanceid": "15",
                           "suppress_until": "1472511600",
                           "userid": "0"
                       }
                   ],
                   "suppressed": "1",
                   "tags": [
                       {
                           "tag": "service",
                           "value": "mysqld"
                       },
                       {
                           "tag": "error",
                           "value": ""
                       }
                   ],
                   "urls": []
               },
               {
                   "eventid": "9671",
                   "source": "0",
                   "object": "0",
                   "objectid": "13926",
                   "clock": "1347970347",
                   "value": "0",
                   "acknowledged": "0",
                   "ns": "0",
                   "name": "Unavailable by ICMP ping",
                   "severity": "4",
                   "r_eventid": "0",
                   "c_eventid": "0",
                   "correlationid": "0",
                   "userid": "0",
                   "cause_eventid": "0",
                   "acknowledges": [],
                   "opdata": "",
                   "suppression_data": [],
                   "suppressed": "0",
                   "tags": [],
                   "urls": []
               }
           ],
           "id": 1
       }

Retrieving events by time period

Retrieve all events that have been created between October 9 and 10, 2012, in reverse chronological order.

Request:

{
           "jsonrpc": "2.0",
           "method": "event.get",
           "params": {
               "output": "extend",
               "time_from": "1349797228",
               "time_till": "1350661228",
               "sortfield": ["clock", "eventid"],
               "sortorder": "desc"
           },
           "id": 1
       }

Response:

{
           "jsonrpc": "2.0",
           "result": [
               {
                   "eventid": "20616",
                   "source": "0",
                   "object": "0",
                   "objectid": "14282",
                   "clock": "1350477814",
                   "value": "1",
                   "acknowledged": "0",
                   "ns": "0",
                   "name": "Less than 25% free in the history cache",
                   "severity": "3",
                   "r_eventid": "0",
                   "c_eventid": "0",
                   "correlationid": "0",
                   "userid": "0",
                   "cause_eventid": "0",
                   "opdata": "",
                   "suppressed": "0",
                   "urls": []
               },
               {
                   "eventid": "20617",
                   "source": "0",
                   "object": "0",
                   "objectid": "14283",
                   "clock": "1350477814",
                   "value": "0",
                   "acknowledged": "0",
                   "ns": "0",
                   "name": "Zabbix trapper processes more than 75% busy",
                   "severity": "3",
                   "r_eventid": "0",
                   "c_eventid": "0",
                   "correlationid": "0",
                   "userid": "0",
                   "cause_eventid": "0",
                   "opdata": "",
                   "suppressed": "0",
                   "urls": []
               },
               {
                   "eventid": "20618",
                   "source": "0",
                   "object": "0",
                   "objectid": "14284",
                   "clock": "1350477815",
                   "value": "1",
                   "acknowledged": "0",
                   "ns": "0",
                   "name": "High ICMP ping loss",
                   "severity": "3",
                   "r_eventid": "0",
                   "c_eventid": "0",
                   "correlationid": "0",
                   "userid": "0",
                   "cause_eventid": "0",
                   "opdata": "",
                   "suppressed": "0",
                   "urls": []
               }
           ],
           "id": 1
       }

Retrieving events acknowledged by specified user

Retrieving events acknowledged by user with ID=10

Request:

{
           "jsonrpc": "2.0",
           "method": "event.get",
           "params": {
               "output": "extend",
               "action": 2,
               "action_userids": [10],
               "selectAcknowledges": ["userid", "action"],
               "sortfield": ["eventid"],
               "sortorder": "DESC"
           },
           "id": 1
       }

Response:

{
           "jsonrpc": "2.0",
           "result": [
               {
                   "eventid": "1248566",
                   "source": "0",
                   "object": "0",
                   "objectid": "15142",
                   "clock": "1472457242",
                   "ns": "209442442",
                   "r_eventid": "1245468",
                   "r_clock": "1472457285",
                   "r_ns": "125644870",
                   "correlationid": "0",
                   "userid": "10",
                   "name": "Zabbix agent on localhost is unreachable for 5 minutes",
                   "acknowledged": "1",
                   "severity": "3",
                   "cause_eventid": "0",
                   "acknowledges": [
                       {
                           "userid": "10",
                           "action": "2"
                       }
                   ],
                   "opdata": "",
                   "suppressed": "0",
                   "urls": []
               }
           ],
           "id": 1
       }

Retrieving top triggers with problem event count

Retrieve the top 5 triggers that have severities "Warning", "Average", "High", or "Disaster", together with the number of problem events within a specified time period.

Request:

{
           "jsonrpc": "2.0",
           "method": "event.get",
           "params": {
               "countOutput": true,
               "groupBy": "objectid",
               "source": 0,
               "object": 0,
               "value": 1,
               "time_from": 1672531200,
               "time_till": 1677628800,
               "trigger_severities": [2, 3, 4, 5],
               "sortfield": ["rowscount"],
               "sortorder": "DESC",
               "limit": 5
           },
           "id": 1
       }

Response:

{
           "jsonrpc": "2.0",
           "result": [
               {
                   "objectid": "232124",
                   "rowscount": "27"
               },
               {
                   "objectid": "29055",
                   "rowscount": "23"
               },
               {
                   "objectid": "253731",
                   "rowscount": "18"
               },
               {
                   "objectid": "254062",
                   "rowscount": "11"
               },
               {
                   "objectid": "23216",
                   "rowscount": "7"
               }
           ],
           "id": 1
       }

See also

Source

CEvent::get() in ui/include/classes/api/services/CEvent.php.