Event Log

The event log of a tenant is the set of runtime entities of the type Event (and its derived type StatefulEvent) of the construction kit model System.Notification. Services write to it when something noteworthy happens, for example an archive changes its status, a construction kit model is imported or a call is refused because of a missing permission.

Fields of an event

Field	Type	Meaning
message	String	Human-readable text of the event
level	Enum	Information, Warning, Error or Critical
source	Enum	The service that wrote the event
category	String, optional	Stable dotted identifier of the kind of event, for example Archive.Transition or CkModelImport.ExtensibleEnumOverride
details	List of key/value pairs, optional	Structured details of the event, for example the id of the archive and its old and new status

category and details are available from System.Notification 2.7.0. Events written before, or by a service that does not know them yet, have neither; they are read as before.

Values in details are text. Numbers and dates are written with the invariant culture (dates as ISO 8601), lists as comma-separated text, and entries without a value are left out. Details name identifiers, counts and timestamps. They never contain credentials, tokens or the values of method parameters.

Filter the event log by category

Use the field filter on category to read one kind of event, and select details to get the structured values instead of parsing the message:

{
  runtime {
    systemNotificationEvent(
      fieldFilter: [{ attributePath: "category", operator: EQUALS, comparisonValue: "Archive.Transition" }]
    ) {
      totalCount
      items {
        rtId
        message
        level
        category
        details {
          key
          value
        }
      }
    }
  }
}

Use operator: LIKE with comparisonValue: "Archive.*" to read a whole group of categories.