---
title: "Get log events"
method: GET
path: "/events/log"
tags: ["events"]
---

# Get log events

`GET /events/log`

Returns an array with one or more log events applying the specified filters. This API is only available if you configure an "eventsearcher" plugin

## Query parameters

- `start_timestamp` integer
- `end_timestamp` integer
- `events` LogEventType[]
- `username` string
- `ip` string
- `protocols` EventProtocols[]
- `instance_ids` string[]
- `from_id` string
- `role` string
- `csv_export` boolean
- `limit` integer
- `order` 'ASC' | 'DESC'

## Response `200`

successful operation

- LogEvent[]
  - `id` string
  - `timestamp` integer — unix timestamp in nanoseconds
  - `event` 1 | 2 | 3 | 4 | 5 — Event status: * `1` - Login failed * `2` - Login failed non-existent user * `3` - No login tried * `4` - Algorithm negotiation failed * `5` - Login succeeded
  - `protocol` 'SSH' | 'SFTP' | 'SCP' | 'FTP' | 'DAV' | 'HTTP' | 'HTTPShare' | 'DataRetention' | 'EventAction' | 'OIDC' — Protocols: * `SSH` - SSH commands * `SFTP` - SFTP protocol * `SCP` - SCP protocol * `FTP` - plain FTP and FTPES/FTPS * `DAV` - WebDAV * `HTTP` - WebClient/REST API * `HTTPShare` - the event is generated in a public share * `DataRetention` - the event is generated by a data retention check * `EventAction` - the event is generated by an EventManager action * `OIDC` - OpenID Connect
  - `username` string
  - `ip` string
  - `message` string
  - `role` string
  - `instance_id` string

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error
- `default` — Unexpected Error

---

[API](https://skmtc.net/kanton-bern/apis/sftpgo.md) · [All operations](https://skmtc.net/kanton-bern/apis/sftpgo/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kanton-bern/sftpgo/versions/d8d616a479b0/schema)