startTime
string | StartTime is the beginning of your search window (inclusive).
Format Options:
- Relative: “now-30d”, “now-2h”, “now-30m” (units: s, m, h, d, w)
Use for dashboards and recurring queries - they adjust automatically.
- Absolute: “2024-01-01T00:00:00Z” (RFC3339 with timezone)
Use for historical analysis of specific time periods.
Examples:
“now-30d” → 30 days ago
“2024-06-15T14:30:00-05:00” → specific time with timezone offset | | |
filter
string | Filter narrows results using CEL (Common Expression Language). Leave empty to get all events.
Available Fields:
verb - API action: get, list, create, update, patch, delete, watch
auditID - unique event identifier
requestReceivedTimestamp - when the API server received the request (RFC3339 timestamp)
user.username - who made the request (user or service account)
user.uid - unique user identifier (stable across username changes)
responseStatus.code - HTTP response code (200, 201, 404, 500, etc.)
objectRef.namespace - target resource namespace
objectRef.resource - resource type (pods, deployments, secrets, configmaps, etc.)
objectRef.name - specific resource name
Operators: ==, !=, <, >, <=, >=, &&, ||, !, in
String Functions: startsWith(), endsWith(), contains()
Common Patterns:
“verb == ‘delete’” - All deletions
“objectRef.namespace == ‘production’” - Activity in production namespace
“verb in [‘create’, ‘update’, ‘delete’, ‘patch’]” - All write operations
”!(verb in [‘get’, ‘list’, ‘watch’])” - Exclude read-only operations
“responseStatus.code >= 400” - Failed requests
“user.username.startsWith(‘system:serviceaccount:’)” - Service account activity
“!user.username.startsWith(‘system:’)” - Exclude system users
“user.uid == ‘550e8400-e29b-41d4-a716-446655440000’” - Specific user by UID
“objectRef.resource == ‘secrets’” - Secret access
“verb == ‘delete’ && objectRef.namespace == ‘production’” - Production deletions
Note: Use single quotes for strings. Field names are case-sensitive.
CEL reference: https://cel.dev | | |
