log_query
Query logs from FortiOS with flexible filtering. Returns entries including timestamps, sources, destinations, actions, and UTM verdicts.
Instructions
Query logs from FortiOS with flexible filtering.
Returns log entries from the specified backend and type. Results include timestamps, sources, destinations, actions, and UTM verdicts.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | Log storage backend: disk, memory, fortianalyzer, forticloud. Use 'disk' (default) for local logs. | disk |
| log_type | No | Log type: traffic, event, utm, virus, webfilter, attack, spam, anomaly, voip, dlp, app-ctrl, emailfilter, dns, ssh, ssl, file-filter. For traffic subtypes use: traffic/forward, traffic/local, traffic/sniffer. | traffic |
| filter_expr | No | Filter expression. FortiOS filter syntax. Examples: 'srcip==10.0.0.1', 'action==blocked', 'user==john'. Combine with 'and': 'srcip==10.0.0.1 and dstport==443'. | |
| rows | No | Maximum number of log entries to return (1-10000). | |
| start | No | Offset for pagination. | |
| extra_params | No | Additional query parameters as a dict. | |
| vdom | No | Target VDOM name. Defaults to the server default VDOM. Use '*' for all VDOMs (super-admin required). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||