How do I configure the LookupAttribute parameter when I call the LookupEvents operation to query events?-ActionTrail(ActionTrail)-阿里云帮助中心

Configure the LookupAttribute parameter of the LookupEvents operation to filter events by attributes such as service name, event name, or resource type.

Note

The LookupAttribute parameter supports one or two attribute items as query conditions. If you configure two attribute items, limits apply. For more information, see the "Limits" section below.

Each attribute item consists of a key-value pair that describes event attributes such as the cloud service name, event name, or caller name. For example, if Key is set to ServiceName, Value can be set to Ecs. If Key is set to EventName, Value can be set to ConsoleSignin.

Key	Value (Description)	Value (Example)
ServiceName	Cloud service name	Ecs
EventName	Event name	ConsoleSignin
User	Caller name	Alice
EventId	Event ID	B702AFA3-FD4B-40E3-88E4-C0752FAA****
ResourceType	Resource type	ACS::ECS::Instance
ResourceName	Resource name	i-bp14664y88udkt45****
EventRW	Read/write type of the request event	Read or Write
EventAccessKeyId	AccessKey ID of the event	LTAI****************
SensitiveAction	Whether the event is sensitive	true
SourceIpAddress	Source IP address of the request	192.168..*
EventType	Event type	ConsoleOperation
RoleName	Role name	AliyunServiceRoleForActionTrail

Limits

You can configure one or two attribute items as query conditions. The system performs exact, case-sensitive matching on your key-value pairs.

If you configure two attribute items, the system returns results that meet both query conditions.
If you specify the same key for two query conditions, the system returns only the results that match the second condition.
If you configure more than two query conditions, the system queries data only based on the first two conditions and returns results that match the first two conditions.

If you configure two attribute items, you can use the following key combinations:

ServiceName can be combined with one of EventName, User, PrincipalId, RoleName, ResourceName, EventRW, SensitiveAction, and EventType.
ResourceName can be combined with one of ResourceType, EventName, User, RoleName, and ServiceName.
EventType can be combined with EventName.