---
title: "Export the full filtered Event Logs set for a Shield Zone as CSV"
method: POST
path: "/shield/event-logs/{shieldZoneId}/export"
tags: ["Event Logs"]
---

# Export the full filtered Event Logs set for a Shield Zone as CSV

`POST /shield/event-logs/{shieldZoneId}/export`

## Path parameters

- `shieldZoneId` integer, required — The ID of the Shield Zone.

## Request body

- EventLogsExportRequest — Request body for exporting a Shield Zone's full filtered Event Logs set as CSV.
  - `from` integer — Window start as Unix time in milliseconds (UTC). Required.
  - `to` integer — Window end as Unix time in milliseconds (UTC). Required; must be after BunnyNet.Shield.Api.Entities.Waf.WafLogging.EventLogsExportRequest.from and within the last 72 hours.
  - `query` string, nullable — Optional free-text search across IP, ruleId, URL, User-Agent and rule name.
  - `filters` EventLogsFilter[], nullable — Optional filters, combined with AND. Repeated values within one filter combine with OR.
    - `field` string, nullable — Dimension to filter on: feature, ruleId, ip, ja4, ua, url, asn, country or action.
    - `op` string, nullable — Operator: eq, in, contains, cidr (ip only, IPv4/IPv6) or wildcard ('*' matches any run).
    - `value` string[], nullable — Value(s) for the filter; multiple values are OR-combined.

## Response `200`

OK

- string, binary

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `500` — Internal Server Error

---

[API](https://skmtc.net/bunny/apis/bunny-net-cdn-logging.md) · [All operations](https://skmtc.net/bunny/apis/bunny-net-cdn-logging/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bunny/bunny-net-cdn-logging/revisions/9e622620664b/schema)