Skip to main content
Both endpoints return the same entries and events on v1. What changes is pagination and, for the activity log, who can read it and a new product_area filter. The changes every endpoint shares are in What changes in v1.

​
Activity logs

Entries have the same fields on both versions, but v1 timestamps end in Z. since and until work the same way. The time window describes them.

​
Paging

Replace the offset arithmetic with the page token, as Pagination describes. Pages never repeat an entry.
The call returns entries under activity_logs, with a response like this:

​
Who can read the log

On v1, a user with the Auditor or AppStore Read Only Admin role must send product_area with each request, and can read only their own product area, as Who can read the log describes. Without product_area, v1 returns 403 to them.

​
Log shippers

v1 has no offset to increment, so reconfigure pagination on any log shipper that polls /activity_logs. That includes Elastic Filebeat’s httpjson input and a Cribl REST Collector. Read entries from activity_logs, not items. Then follow the steps in Reading the log from a log shipper. That section also has notes for Filebeat and Cribl.

​
Identity events

Events have the same fields on both versions. The filters identity_ids, changed_fields, start_time, and end_time are unchanged, and so is who can read events. Replace the cursor with the page token, as Pagination describes. Reading to the end explains how to tell that you’ve read every page.