ActionTrail operation logs contain fields that record API calls and operations performed on your Alibaba Cloud resources.
| Log field | Description |
| __topic__ | The topic of the log. The value is fixed to actiontrail_event. |
| owner_id | The Alibaba Cloud account ID. |
| event | The event details in JSON format. The content varies by event. |
| event.eventId | The unique ID of the event. |
| event.eventName | The name of the event. |
| event.eventSource | The source of the event. |
| event.eventType | The type of the event. |
| event.eventVersion | The data format version of ActionTrail. The value is fixed to 1. |
| event.acsRegion | The region where the event occurred. |
| event.requestId | The request ID of the operation on the cloud service. |
| event.apiVersion | The version of the API. |
| event.errorMessage | The error message returned if the event failed. |
| event.serviceName | The name of the Alibaba Cloud service associated with the event. |
| event.sourceIpAddress | The source IP address from which the event was initiated. |
| event.userAgent | The client that initiated the event. |
| event.requestParameters.HostId | The host ID in the request parameters. |
| event.requestParameters.Name | The name in the request parameters. |
| event.requestParameters.Region | The region in the request parameters. |
| event.userIdentity.accessKeyId | The AccessKey ID used to authenticate the request. |
| event.userIdentity.accountId | The ID of the requesting account. |
| event.userIdentity.principalId | The principal ID of the requesting account. |
| event.userIdentity.type | The type of the requesting account. |
| event.userIdentity.userName | The username of the requesting account. |
| event.errorCode | The error code if the event failed. |
| addionalEventData.isMFAChecked | Whether multi-factor authentication (MFA) is enabled for the logon account. |
| addionalEventData.loginAccount | The logon account. |