All Products
Search

This Product

    ActionTrail:How do I configure the LookupAttribute parameter when I call the LookupEvents operation to query events?

    Document Center

    ActionTrail:How do I configure the LookupAttribute parameter when I call the LookupEvents operation to query events?

    Last Updated:May 08, 2025

    This topic describes how to configure the LookupAttribute parameter when you call the LookupEvents operation to query events.

    Note

    When you configure the LookupAttribute parameter of the LookupEvents operation that queries historical events, you can configure only one or two attribute items as query conditions. If you configure two attribute items, limits apply. For more information, see the "Limits" section below.

    Each attribute item consists of a key-value pair, which describes the attributes of various events, such as a cloud service name, event name, or caller name. For example, if Key is set to ServiceName, Value can be set to Ecs. If Key is set to EventName, Value can be set to ConsoleSignin.

    Key

    Value (Description)

    Value (Example)

    ServiceName

    Cloud service name

    Ecs

    EventName

    Event name

    ConsoleSignin

    User

    Caller name

    Alice

    EventId

    Event ID

    B702AFA3-FD4B-40E3-88E4-C0752FAA****

    ResourceType

    Resource type

    ACS::ECS::Instance

    ResourceName

    Resource name

    i-bp14664y88udkt45****

    EventRW

    Read/write type of the request event

    Read or Write

    EventAccessKeyId

    AccessKey ID of the event

    LTAI****************

    SensitiveAction

    Sensitive event or not

    true

    SourceIpAddress

    Source IP address of the request

    192.168.*.**

    EventType

    Event type

    ConsoleOperation

    RoleName

    Role name

    AliyunServiceRoleForActionTrail

    Limits

    When you configure query conditions, you can configure one or two attribute items. The system supports only exact match based on your key-value pairs, and the matching is case-sensitive.

    • If you configure two attribute items, the system returns results that meet both query conditions.

    • If you specify the same key for two query conditions, the system returns only the results that match the second condition.

    • If you configure more than two query conditions, the system queries data only based on the first two conditions and returns results that match the first two conditions.

    If you configure two attribute items, you can use the following key combinations:

    • ServiceName can be combined with one of EventName, User, PrincipalId, RoleName, ResourceName, EventRW, SensitiveAction, and EventType.

    • ResourceName can be combined with one of ResourceType, EventName, User, RoleName, and ServiceName.

    • EventType can be combined with EventName.