ALQL fields

Audit Log Query Language (ALQL) lets you search for a value in a specific field. Each field in the audit log has a corresponding ALQL name.

In a clause, a field is followed by an operator and one or more values. The operator compares the value of the field with one or more values on the right, such that only true results are retrieved by the clause. It's not possible to compare two fields in ALQL.

Created field type

A filter with date and time to refine the search.

This is a mandatory field.

By default, ALQL uses a seven-day date range in the format of a full timestamp. You may change the format to YYYY-MM-DD, which the ALQL assumes to be 00:00:00 UTC. You can also optionally add a Z to explicitly enforce the UTC timezone. For example, YYYY-MM-DDZ or YYYY-MM-DDTHH:mm:ss.msZ.

You have a choice of other date and time formats to use with the created field type. The following table describes them.

形式	説明	例
Date only	This is how a simple date looks.	`YYYY-MM-DD` `2025-12-07` December 7, 2025, UTC
Date with hour only	ALQL fills in the minutes and seconds with zeros if you don’t add them.	`YYYY-MM-DDTHH` `2025-12-07T15` December 7, 2025, 3pm, UTC
Date with hour and minute	ALQL fills in the seconds with zeros if you don’t add them.	`YYYY-MM-DDTHH:mm` `2025-12-07T15Z:30` December 7, 2025, 3.30pm, UTC
Date with hour, minute and seconds	This includes both the date and the time down to the second.	`YYYY-MM-DDTHH:mm:ss` `2025-12-07T15:30:45` December 7, 2025, 3.30pm, and 45 seconds, UTC
Date with hour, minute, seconds and milliseconds	This format includes the date and time down to milliseconds.	`YYYY-MM-DDTHH:mm:ss.ms` `2025-12-07T15:30:45.123` December 7, 2025, 3.30pm, 45 seconds, and 123 milliseconds, UTC
Date with offset	This format includes the timezone offset from UTC, formatted as a number.	`YYYY-MM-DDTHH:mm:ss+offset` `2025-12-07T14:30:45+10:00` December 7, 2025, 3.30pm, 45 seconds, 10 hours ahead of UTC

構文	`created`
フィールドタイプ	CREATED
オートコンプリート	はい
サポートされる演算子	`=`, `>`, `<`, `>=`, `<=`, `!=`
サポートされない演算子	`IN`
例	Find activities within a range: `created >= "2025-12-07" AND created < "2025-12-07"` or `created >= "2025-12-07T23:11:55.000Z"` See the earlier table for more examples.

Activity field type

Filter with activity to refine the search. Explore all the activities that can occur in your organization

構文	`activity`
フィールドタイプ	ACTIVITY
オートコンプリート	はい
サポートされる演算子	`=`, `IN`, `~` , `!=`, `NOT IN`, `!~`
サポートされない演算子	`>, <, >=, <=`
例	User has been suspended: `activity IN ("user_revoked_product_access", "scim_group_remove_member")` API token logs: `activity = ts_api_token_creation` Confluence page exported: `activity = confluence_export_blogpost_finished`

Actor field type

Filter with actor to refine the search.

構文	`actor`
フィールドタイプ	ACTOR
オートコンプリート	はい
サポートされる演算子	`=`, `!=`, `IN`, `NOT IN`
サポートされない演算子	`>, <, >=, <=`
例	Find actor: `actor = "Fran Perez"`

IP Address field type

Filter with IP address to refine the search.

構文	`ip address`
フィールドタイプ	IP ADDRESS
オートコンプリート	いいえ
サポートされる演算子	`=` , `!=`, `IN`, `NOT IN`, `~`, `!~` , `IS`, `IS NOT`
サポートされない演算子	`>, <, >=, <=`
例	Find actor: `"IP Address" = "192.168.1.1"`

City, region and country field types

Filter with location to refine the search.

構文	`city region country`
フィールドタイプ	CITY, REGION and COUNTRY
オートコンプリート	はい
サポートされる演算子	`=` , `!=`, `IN`, `NOT IN`, `~`, `!~` , `IS`, `IS NOT`
サポートされない演算子	`>, <, >=, <=`
例	Find location with city, region and country name: `city = "Sydney" AND region = NSW AND country = "Australia"`

App field type

Filter with Atlassian app name to refine the search.

構文	`app`
フィールドタイプ	APP
オートコンプリート	はい
サポートされる演算子	`=`, `!=`, `IN`, `NOT IN` , `IS`, `IS NOT`
サポートされない演算子	`>, <, >=, <=`
例	Find app: `app = Bitbucket`

Site field type

Filter with the site ID, also known as the cloud ID, to refine the search.

To find your cloud ID:

Navigate to admin.atlassian.com. If you're a member of more than one, select the relevant organization.
In the side navigation, select Apps, then Sites.
Select the relevant site from the list.
The cloud ID is listed after /s/ in your address bar.

構文	`site`
フィールドタイプ	SITE
オートコンプリート	はい
サポートされる演算子	`=`, `!=`, `IN`, `NOT IN`
サポートされない演算子	`>, <, >=, <=`
例	Find site ID: `site = example-site-id`

Correlation ID field type

Filter with the correlation ID to refine the search. The correlation ID is an ID shared between events in audit logs. The most common shared events relate to Customer-Managed Keys (CMK). Using this field is equivalent to using the Related activities dropdown in the basic audit log search.

構文	`correlation id`
フィールドタイプ	CORRELATION ID
オートコンプリート	いいえ
サポートされる演算子	`=`, `!=`, `IN`, `NOT IN`
サポートされない演算子	`>, <, >=, <=`
例	Find correlation ID: `'correlation id' = example-correlation-id`

この内容はお役に立ちましたか?

正確ではなかった明確ではなかった関係なかった

さらにヘルプが必要ですか?

アトラシアンコミュニティをご利用ください。

コミュニティに質問