CODEWITHSUNDEEP
filtergoogle-workspacegoogle-admin-sdk
Parth Jani
Parth Jani

Reputation: 13

Filters Not Functioning for Admin Application Logs in Google Admin SDK

I am using the Google Admin SDK (Reports API) in a C# .NET console application to retrieve logs for the Admin application. While the API supports filters to refine the results, none of the filters work when applied to the Admin application logs. For example, when applying filters such as actor, event_name, begin_date, and end_date the API consistently returns a 400 error with the message: "Invalid request: Parameter event_name not found in manifest."

Here is the sample code which I'm using:

var service = new ReportsService(new BaseClientService.Initializer
{
    HttpClientInitializer = credential,
    ApplicationName = "Audit Log Viewer"
});

var request = service.Activities.List("all", ApplicationNameEnum.Admin);
request.Filters = "event_name==User Suspension";
request.MaxResults = 100;

var response = await request.ExecuteAsync();

I have tried some of the filters like actor, begin_date, end_date, event_name, but none of them is working, I get the same error every time.

Could you please investigate this issue and clarify:

  1. Whether event_name and similar filters are supported for Admin application logs.
  2. If not supported, is there an alternative method to achieve filtering for Admin logs?
  3. Or is there any document which mention the supported filters for Admin application logs?

If this is a known issue, I would appreciate updates or workarounds.

Upvotes: 1

Views: 89

Answers (2)

Saddles
Saddles

Reputation: 1724

As per Method: activities.list:

These event parameters are associated with a specific eventName. An empty report is returned if the request's parameter doesn't belong to the eventName. For more information about the available eventName fields for each application and their associated parameters, go to the ApplicationName table, then click through to the Activity Events page in the Appendix for the application you want.

This means that the filters parameter only supports the eventNames that are in ApplicationName; if you do not intend to work solely with the EventName parameter and you would like to utilize several other keys that are not directly available as request parameters, it would be unavailable, and I recommend that you submit a feature request, as that's the best way to tell Google about these kinds of things.

TL;DR

The reason why the API consistently returns a 400 error with the message: "Invalid request: Parameter event_name not found in manifest." is because the "event_name==User Suspension" is not a valid eventName of the Reports API: Admin Activity Report Event Names.

To do a filter based on User Suspension, the correct eventName is SUSPEND_USER. This is confirmed in @qtxo's answer, and its syntax for filters in Method: activities.list would be something like [email protected].

Upvotes: 1

qtxo
qtxo

Reputation: 1573

You don't need a filter for the event name, just use request.EventName = "SUSPEND_USER"

Ref: https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-event-names

Upvotes: 2

Related Questions