---
title: "Search events"
method: POST
path: "/api/v2/events/search"
tags: ["Events"]
---

# Search events

`POST /api/v2/events/search`

List endpoint returns events that match an events search query.
[Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination).

Use this endpoint to build complex events filtering and search.

## Request body

- EventsListRequest — The object sent with the request to retrieve a list of events from your organization.
  - `filter` EventsQueryFilter — The search and filter query settings.
    - `from` string — The minimum time for the requested events. Supports date math and regular timestamps in milliseconds.
    - `query` string — The search query following the event search syntax.
    - `to` string — The maximum time for the requested events. Supports date math and regular timestamps in milliseconds.
  - `options` EventsQueryOptions — The global query options that are used. Either provide a timezone or a time offset but not both, otherwise the query fails.
    - `timeOffset` integer — The time offset to apply to the query in seconds.
    - `timezone` string — The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New_York).
  - `page` EventsRequestPage — Pagination settings.
    - `cursor` string — The returned paging point to use to get the next results.
    - `limit` integer — The maximum number of logs in the response.
  - `sort` 'timestamp' | '-timestamp' — The sort parameters when querying events.

## Response `200`

OK

- EventsListResponse — The response object with all events matching the request and pagination information.
  - `data` EventResponse[] — An array of events matching the request.
    - `attributes` EventResponseAttributes — The object description of an event response attribute.
      - `attributes` EventAttributes — Object description of attributes from your event.
        - `aggregation_key` string — Aggregation key of the event.
        - `date_happened` integer — POSIX timestamp of the event. Must be sent as an integer (no quotation marks). Limited to events no older than 18 hours.
        - `device_name` string — A device name.
        - `duration` integer — The duration between the triggering of the event and its recovery in nanoseconds.
        - `event_object` string — The event title.
        - `evt` Event — The metadata associated with a request.
          - `id` string — Event ID.
          - `name` string — The event name.
          - `source_id` integer — Event source ID.
          - `type` string — Event type.
        - `hostname` string — Host name to associate with the event. Any tags associated with the host are also applied to this event.
        - `monitor` MonitorType, nullable — Attributes from the monitor that triggered the event.
          - `created_at` integer — The POSIX timestamp of the monitor's creation in nanoseconds.
          - `group_status` integer — Monitor group status used when there is no `result_groups`.
          - `groups` string[] — Groups to which the monitor belongs.
          - `id` integer — The monitor ID.
          - `message` string — The monitor message.
          - `modified` integer — The monitor's last-modified timestamp.
          - `name` string — The monitor name.
          - `query` string — The query that triggers the alert.
          - `tags` string[] — A list of tags attached to the monitor.
          - `templated_name` string — The templated name of the monitor before resolving any template variables.
          - `type` string — The monitor type.
        - `monitor_groups` string[], nullable — List of groups referred to in the event.
        - `monitor_id` integer, nullable — ID of the monitor that triggered the event. When an event isn't related to a monitor, this field is empty.
        - `priority` 'normal' | 'low', nullable — The priority of the event's monitor. For example, `normal` or `low`.
        - `related_event_id` integer — Related event ID.
        - `service` string — Service that triggered the event.
        - `source_type_name` string — The type of event being posted. For example, `nagios`, `hudson`, `jenkins`, `my_apps`, `chef`, `puppet`, `git` or `bitbucket`. The list of standard source attribute values is [available here](https://docs.datadoghq.com/integrations/faq/list-of-api-source-attribute-value).
        - `sourcecategory` string — Identifier for the source of the event, such as a monitor alert, an externally-submitted event, or an integration.
        - `status` 'failure' | 'error' | 'warning' | 'info' | 'success' | 'user_update' | 'recommendation' | 'snapshot' — If an alert event is enabled, its status is one of the following: `failure`, `error`, `warning`, `info`, `success`, `user_update`, `recommendation`, or `snapshot`.
        - `tags` string[] — A list of tags to apply to the event.
        - `timestamp` integer — POSIX timestamp of your event in milliseconds.
        - `title` string — The event title.
      - `message` string — The message of the event.
      - `tags` string[] — An array of tags associated with the event.
      - `timestamp` string, date-time — The timestamp of the event.
    - `id` string — the unique ID of the event.
    - `type` 'event' — Type of the event.
  - `links` EventsListResponseLinks — Links attributes.
    - `next` string — Link for the next set of results. Note that the request can also be made using the POST endpoint.
  - `meta` EventsResponseMetadata — The metadata associated with a request.
    - `elapsed` integer — The time elapsed in milliseconds.
    - `page` EventsResponseMetadataPage — Pagination attributes.
      - `after` string — The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`.
    - `request_id` string — The identifier of the request.
    - `status` string — The request status.
    - `warnings` EventsWarning[] — A list of warnings (non-fatal errors) encountered. Partial results might be returned if warnings are present in the response.
      - `code` string — A unique code for this type of warning.
      - `detail` string — A detailed explanation of this specific warning.
      - `title` string — A short human-readable summary of the warning.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)