apmlog_get
Read-only
Retrieve OpenTelemetry APM log records from Zabbix 8.0+ within a required time range, filtering by trace, span, service, severity, or attributes, with paging.
Instructions
Retrieve OpenTelemetry (OTel) APM log records (Zabbix 8.0+): logs with severity_text, severity_number, body, service_name, and the trace / span they were produced in. time_from and time_till are required. Filter by traceids, spanids, trace flags (with_flags_on / with_flags_off, sum of flag values) or resource / scope / log attribute conditions. Page with limit and offset.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of records to return. | |
| filter | No | Return only results whose properties exactly match the given values (a single value or a list of values per key). Example: {"status": 0} or {"status": [0, 1]}. Keys: body, event_name, log_attributes, resource_attributes, resource_schema_url, scope_attributes, scope_name, scope_schema_url, scope_version, service_name, severity_number, severity_text, spanid, timestamp, trace_flags, traceid. Text properties cannot be filtered; use 'search' for them. | |
| offset | No | Number of records to skip before returning the result (paging). | |
| output | No | Properties of the apmlog object to return. Pass 'extend' for all, 'count' for the number of matches only, or a comma-separated list of property names. Default when omitted: timestamp, traceid, spanid, service_name, severity_text, body. Properties: body, event_name, log_attributes, resource_attributes, resource_schema_url, scope_attributes, scope_name, scope_schema_url, scope_version, service_name, severity_number, severity_text, spanid, timestamp, trace_flags, traceid. | |
| search | No | Return results whose string properties contain the given pattern (case-insensitive; '*' is a wildcard when searchWildcardsEnabled is true). Example: {"name": "web"}. Keys: body, event_name, resource_schema_url, scope_name, scope_schema_url, scope_version, service_name, severity_text, spanid, traceid. | |
| server | No | Target Zabbix server. Available: default. Defaults to 'default' if omitted. | |
| spanids | No | Return only log records produced during the given spans. | |
| raw_json | No | Strips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true. | |
| traceids | No | Return only log records produced during the given traces. | |
| sortfield | No | Sort by one or more of: timestamp, traceid, spanid, trace_flags, severity_text, severity_number, service_name, resource_schema_url, scope_schema_url, scope_name, scope_version, event_name (comma-separated for several; pair with 'sortorder'). No other property is sortable. | |
| sortorder | No | Sort order: 'ASC' or 'DESC'. | |
| time_from | Yes | Return only log records of events that occurred at or after this time (required). Unix timestamp, ISO 8601 date-time or a relative time such as now-1h or now-1d/d. | |
| time_till | Yes | Return only log records of events that occurred before this time (required). Unix timestamp, ISO 8601 date-time or a relative time such as now or now/d. | |
| extra_params | No | Other native apmlog.get parameters, merged into the request as-is. apmlog.get has no parameters beyond the typed ones. Any other key is refused here, because Zabbix would silently ignore it. For a parameter you are sure exists on your release but is not listed, use zabbix_raw_api_call. | |
| with_flags_on | No | Return only records that have all of these trace flags set (sum of flag values). | |
| log_attributes | No | Log attributes: Attribute conditions as a list of {"key": ..., "value": ..., "operator": ...} objects; operators: 0 Contains, 1 Equals, 2 Not like, 3 Not equal, 4 Exists, 5 Does not exist. An empty list returns everything. | |
| with_flags_off | No | Return only records that have none of these trace flags set (sum of flag values). | |
| scope_attributes | No | Scope attributes: Attribute conditions as a list of {"key": ..., "value": ..., "operator": ...} objects; operators: 0 Contains, 1 Equals, 2 Not like, 3 Not equal, 4 Exists, 5 Does not exist. An empty list returns everything. | |
| resource_attributes | No | Resource attributes: Attribute conditions as a list of {"key": ..., "value": ..., "operator": ...} objects; operators: 0 Contains, 1 Equals, 2 Not like, 3 Not equal, 4 Exists, 5 Does not exist. An empty list returns everything. | |
| log_attributes_evaltype | No | How the conditions in log_attributes combine: 0 = And/Or (default), 2 = Or. | |
| scope_attributes_evaltype | No | How the conditions in scope_attributes combine: 0 = And/Or (default), 2 = Or. | |
| resource_attributes_evaltype | No | How the conditions in resource_attributes combine: 0 = And/Or (default), 2 = Or. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |