Filtering activities
Learn about filtering the Activity Log gets.
To filter Activity Log operations, use this format in the query:
The wildcard (*) means you can combine multiple conditions with the logical operators AND & OR.
Here are the condition types available for filtering:
Condition Type | Syntax | Description of Condition Types |
---|---|---|
equals | equals(property, value) | Defines the exact match condition. |
equalsCaseSensitive | equalsCaseSensitive(property, value) | Defines the exact match condition considering case. |
containsWordStartingWith | containsWordStartingWith(property, tokenized value) | Defines the prefix condition. It returns activities that have condition property starting with condition value. |
startsWith | startsWith(property, restricted value) | Defines the prefixed condition type. It returns entities that have the condition property starting with condition value. |
missing | missing(property) | Returns activities with fields that have no values for a property, or the property value is empty. |
exists | exists(property) | Returns activities having some not empty value for the property. |
range | range(property, from, to) | Returns activities having the property within the specified range. |
gt | gt(property, value) | Returns activities having property greater than the specified value. |
lt | lt(property, value) | Returns activities having property less than the specified value. |
gte | gte(property, value) | Returns activities having property greater than or equals the specified value. |
lte | lte(property, value) | Returns activities having property less than or equals the specified value. |
not | not | This operator negates a condition and can be used with other operators. |
Use a dot-delimited path to specify each property in a filter. You can only filter by these top-level activity properties:
uri
user
timestamp
items.data.type
items.objectType
items.objectUri
- These are available if and only if
indexActivityDelta=true
in the Tenant Storage Configuration:items.delta.attributeType
items.delta.newValue
items.delta.oldValue
items.delta.sources
name1+name2
, use usefilter=equals(user,'name1%2Bname2')
.Activities query filter examples
- Filter by object type
-
filter=equals(items.objectType,'configuration/entityTypes/Organization') - Filter by user
-
filter=equals(user,'user1') - Find activities with items without object type
-
filter=missing(objectType) - Find activities that happened after 01-Apr-2025
-
filter=gt(timestamp, 1743465600000) - Find activities that happened between 01-Mar-2025 and 01-Apr-2025
-
filter=range(timestamp,1740790800000,1743465600000)