Skip to main content
POST
/
shield
/
event-logs
/
{shieldZoneId}
/
search
Search, filter and group Event Logs for a Shield Zone
curl --request POST \
  --url https://api.bunny.net/shield/event-logs/{shieldZoneId}/search \
  --header 'Content-Type: application/json' \
  --data '
{
  "from": 123,
  "to": 123,
  "query": "<string>",
  "filters": [
    {
      "field": "<string>",
      "op": "<string>",
      "value": [
        "<string>"
      ]
    }
  ],
  "groupBy": [
    "<string>"
  ],
  "page": 123,
  "pageSize": 123
}
'
{
  "rows": [
    {
      "logId": "<string>",
      "timestamp": 123,
      "log": "<unknown>",
      "fields": {}
    }
  ],
  "groups": [
    {
      "key": {},
      "count": 123,
      "firstSeen": 123,
      "lastSeen": 123,
      "context": {}
    }
  ],
  "total": 123,
  "totalPages": 123,
  "page": 123,
  "errorResponse": {
    "success": true,
    "message": "<string>",
    "errorKey": "<string>"
  }
}

Path Parameters

shieldZoneId
integer<int32>
required

The ID of the Shield Zone.

Body

Request body for searching a Shield Zone's Event Logs within a time window.

from
integer<int64>

Window start as Unix time in milliseconds (UTC). Required.

to
integer<int64>

Window end as Unix time in milliseconds (UTC). Required; must be after BunnyNet.Shield.Api.Entities.Waf.WafLogging.EventLogsSearchRequest.from and within the last 72 hours.

query
string | null

Optional free-text search across IP, ruleId, URL, User-Agent and rule name.

filters
object[] | null

Optional filters, combined with AND. Repeated values within one filter combine with OR.

groupBy
string[] | null

Optional ordered dimensions to group by, e.g. ["ip","ja4"]. Omit for flat rows. Allowed: feature, ruleId, ip, ja4, ua, url, asn, country, action.

page
integer<int32>

Zero-based page index.

pageSize
integer<int32>

Page size; clamped to 1–500 (defaults to 50 when unset).

Response

OK

Result of an Event Logs search. Exactly one of BunnyNet.Shield.Api.Entities.Waf.WafLogging.EventLogsSearchResponse.rows or BunnyNet.Shield.Api.Entities.Waf.WafLogging.EventLogsSearchResponse.groups is populated.

rows
object[] | null

Flat event rows (populated when the request had no groupBy).

groups
object[] | null

Aggregated groups (populated when the request had a groupBy).

total
integer<int64>

Total flat rows, or total distinct groups when grouped.

totalPages
integer<int32>

Total number of pages for the current page size.

page
integer<int32>

Zero-based index of the returned page.

errorResponse
object

Generic response object containing status information for API operations.

Last modified on July 4, 2026