event_get
Read-only
Retrieve Zabbix event history, including resolved events, to audit state changes and correlate PROBLEM and OK events. Filter by source, object, time range, or severity to narrow results.
Instructions
Retrieve events generated by triggers, discovery rules, or autoregistration. Events form the full audit trail of state changes. For active/current problems only, prefer problem.get instead. Use event.get when you need the complete event history including resolved events, or when you need to correlate PROBLEM and OK events. Filter by 'source' (0=trigger, 1=discovery, 2=autoregistration, 3=internal) and 'object' to narrow results. Use 'time_from'/'time_till' for time-bounded queries and 'severity_min' to filter by importance. The newest events come first unless a sort is given, so 'limit' keeps the latest ones.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. | |
| value | No | Event value filter: 0=OK (resolved), 1=PROBLEM (active). | |
| filter | No | Return only results whose properties exactly match the given values (a single value or a list of values per key). Example: {"status": 0} or {"status": [0, 1]}. Keys: acknowledged, cause_eventid (6.4+), cep_ruleid (8.0+), clock, eventid, flags (8.0+), name, ns, object, objectid, severity, source, value. Text properties cannot be filtered; use 'search' for them. | |
| object | No | Event object type: 0=trigger, 1=discovered host, 2=discovered service, 3=autoregistration event, 4=item, 5=LLD rule. | |
| output | No | Properties of the event object to return. Pass 'extend' for all, 'count' for the number of matches only, or a list of property names. Default when omitted: eventid, name, severity, clock, value, r_eventid. Properties: acknowledged, c_eventid, cause_eventid (6.4+), cep_ruleid (8.0+), clock, correlationid, eventid, flags (8.0+), name, ns, object, objectid, opdata, r_eventid, severity, source, suppressed, urls, userid, value. | |
| search | No | Return results whose string properties contain the given pattern (case-insensitive; '*' is a wildcard when searchWildcardsEnabled is true). Example: {"name": "web"}. Keys: name. | |
| server | No | Target Zabbix server. Available: default. Defaults to 'default' if omitted. | |
| source | No | Event source: 0=trigger (default), 1=discovery, 2=autoregistration, 3=internal. | |
| hostids | No | Return only events for the given hosts. | |
| eventids | No | Return only events with the given IDs. | |
| groupids | No | Return only events for hosts belonging to the given host groups. | |
| raw_json | No | Strips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true. | |
| objectids | No | Return only events for the given trigger/item/LLD rule IDs (depends on the 'object' parameter). | |
| sortfield | No | Sort by one or more of: eventid, objectid, clock (a list for several; pair with 'sortorder'). No other property is sortable. When omitted, the result is sorted by eventid with the newest first. | |
| sortorder | No | Sort order: 'ASC' (ascending) or 'DESC' (descending). 'DESC' while 'sortfield' is omitted (newest first); 'ASC' alone returns the oldest first. | |
| time_from | No | Return only events generated after this time (Unix timestamp, ISO 8601 date-time such as 2026-04-01T08:00:00Z, or a relative time such as now-1h, now/d or now-7d/d; a value without a zone is read in the zone resolved for the call) (inclusive). | |
| time_till | No | Return only events generated before this time (Unix timestamp, ISO 8601 date-time such as 2026-04-01T08:00:00Z, or a relative time such as now-1h, now/d or now-7d/d; a value without a zone is read in the zone resolved for the call) (inclusive). | |
| countOutput | No | Return the count of matching results instead of the actual data. | |
| searchByAny | No | If true, return results matching ANY search field (OR). Default is ALL fields (AND). | |
| acknowledged | No | If true, return only acknowledged events. If false, only unacknowledged events. | |
| extra_params | No | Other native event.get parameters, merged into the request as-is. Parameters: action (7.0+), action_userids (7.0+), evaltype, eventid_from, eventid_till, groupBy (7.0+), groupCount (removed in 7.0), problem_time_from, problem_time_till, severities, suppressed, symptom (6.4+), tags, trigger_severities (7.0+). Switches (true turns one on, false is the same as leaving it out): groupCount. groupCount (removed in 7.0) goes with output='count': the count is then split by the ID filters the method groups by (hostids, groupids ...), one row per ID with 'rowscount'; a single row without such a filter. Sub-object selects (value 'extend', 'count' or a list of property names): selectAcknowledges (7.0+), selectAlerts (7.0+), selectHosts, selectRelatedObject, selectSuppressionData, selectTags, select_acknowledges (removed in 7.2), select_alerts (removed in 7.2). Any other key is refused here, because Zabbix would silently ignore it. For a parameter you are sure exists on your release but is not listed, use zabbix_raw_api_call. | |
| severity_min | No | Return only events with severity greater than or equal to this value: 0=not classified, 1=information, 2=warning, 3=average, 4=high, 5=disaster. | |
| searchWildcardsEnabled | No | If true, enable * and ? wildcards in search patterns. |