All Products
Search

This Product

    ActionTrail:Custom event queries

    Document Center

    ActionTrail:Custom event queries

    Last Updated:Jun 04, 2026

    To query events older than 90 days across multiple regions, use the custom query feature in the ActionTrail console with filter conditions or SQL statements.

    Prerequisites

    A trail is created and delivers events to Simple Log Service (SLS). Create a single-account trail or Create a multi-account trail.

    Use cases

    Custom queries support two modes: simple query for visual search, and SQL query for flexible search using Structured Query Language (SQL).

    Mode

    Query method

    Description

    Example

    Simple query

    Single-condition query

    Query events by filter conditions: service name, region, event name, account type, read/write type, resource name, resource type, or operator.

    To query all events for Key Management Service (KMS) within a specified time range, set Service Name to Key Management Service (KMS).

    Multi-condition query

    Query events across multiple services or regions.

    To query KMS events in the China (Hangzhou) and China (Shanghai) regions, set Service Name to Key Management Service (KMS) and Alibaba Cloud Region to China (Hangzhou) and China (Shanghai).

    SQL query

    Keyword query

    Enter search terms to match events.

    To query all write events, enter * AND event.eventRW: Write in the search box.

    Condition-based query

    Filter by operator (Who), operation (What), resource (Which), location (Where), or other attributes.

    To query all events for KMS within a specified time range, enter * AND event.serviceName: KMS in the search box.

    Multi-condition query

    Combine multiple conditions across operator (Who), operation (What), resource (Which), location (Where), and other attributes.

    To query events generated by the user Alex in ActionTrail, enter * AND event.serviceName: ActionTrail AND event.userIdentity.userName: Alex in the search box.

    Exclusion query

    Use the NOT operator to exclude specific conditions from the query.

    To query events generated by users other than Alex in ActionTrail, enter * AND event.serviceName: ActionTrail NOT event.userIdentity.userName: Alex in the search box.

    Procedure

    1. Log on to the ActionTrail console.

    2. In the left-side navigation pane, choose Events > Advanced Event Query.

    3. In the Query Range section, select a trail from the Trail drop-down list.

    4. On the Default tab of the Custom Template page, set the query conditions.

      • Simple query

        In Simple Mode, set the query conditions as prompted.

      • SQL query

        Turn off the Simple Mode switch and enter your SQL query.

        Note

        • SQL syntax and query examples: SQL syntax for Advanced Event Query.

        • To start from a simple query, set conditions in Simple Mode mode, then turn off the Simple Mode switch. Conditions set in Simple Mode mode are automatically converted into a customizable SQL statement.

    5. Specify a time range and click Run.

      Note

      • By default, ActionTrail queries events from the past seven days.

      • Click Event Alerting on the right to configure an alert for the current query. Create a custom alert rule.

      • Modify the default SQL statement in the system template, then click Save to save it as a custom template.

    6. View the query results.

      • Raw log

        On the Raw Logs tab, find the target event and click View Details in the Actions column to view basic information and JSON details.

      • Histogram

        The Query Histogram tab displays a histogram of the events.

    Related topics