REST API Developer Guide

Introducing Lightning Platform REST API
Quick Start
Examples
Getting Information About My Organization
Working with Object Metadata
Working with Records
Delete Lightning Experience Event Series
Working with Searches and Queries
Insert or Update Blob Data
Working with Recently Viewed Information
Managing User Passwords
Working with Approval Processes and Process Rules
Using Event Monitoring
Describe Event Monitoring Using REST
Query Event Monitoring Data with REST
Get Event Monitoring Content from a Record
Download Large Event Log Files Using cURL with REST
Delete Event Monitoring Data
Query or View Hourly Event Log Files
Using Composite Resources
Reference
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Using Event Monitoring

These examples use REST API event monitoring data that contains information useful for assessing org usage trends and user behavior. Event monitoring is accessed through the Lightning Platform SOAP API and REST API by way of the EventLogFile object. Therefore, you can integrate log data with your own back-end storage and data marts to correlate data from multiple orgs and across disparate systems.

For the supported event types that you can use with event monitoring, see Object Reference for Salesforce and Lightning Platform: EventLogFile Object.

Note

When using event monitoring, keep the following in mind.
  • In the unlikely case in which no log files are generated for 24 hours, contact Salesforce Customer Support.
  • Log data is read only. You can’t insert, update, or delete log data.
  • Use the EventType field to determine which files were generated for your org.
  • An event generates log data in real time. However, daily log files are generated during nonpeak hours the day after an event takes place. Therefore, daily log file data is unavailable for at least one day after an event. For hourly log files, depending on event delivery and final processing time, an event is expected to take three to six hours from the time of the event to be available in the log file. However, it can take longer.
  • Log files are generated only when at least one event of a type (represented by the EventType field) occurs for the day or hour. If no events took place, the file isn’t generated.
  • Log files are available based on CreatedDate for the last 30 days when orgs purchase Event Monitoring or one day for Developer Edition orgs.
  • All event monitoring logs are exposed to the API through the EventLogFile object. However, there is no access through the user interface, except through the Event Monitoring Analytics app.
  • Log files don’t count towards your org’s data or file storage allocations.
  • Event Monitoring log files aren’t a system of record for user activity. They are a source of truth, but aren’t durable. During Salesforce site switches, instance refreshes, or unplanned system outages, data loss can occur. For example, if Salesforce moves your production org instance, your event log files might have a gap in data. Salesforce makes commercially reasonable efforts to preserve event log file data integrity and avoid data loss. When Salesforce performs a site switch or instance refresh, it uses an automated process to replicate event logs.
  • Hourly event log files are provided for you to review events in your orgs on an accelerated basis. However, it’s possible that you don’t get all event log data in hourly event log files, especially during site switches, instance refreshes, or unplanned system outages. For complete data, use the daily log files.
  • If event transmission failures take too long to recover from, log files are retransmitted to ensure that they are delivered at least once. As a result, latent log files can sometimes contain duplicate event data. When your application consumes latent log files, make sure that your application handles duplicate event delivery.
  • We recommend that you always query the EventLogFile object for new log files to ensure that you also include latent ones. Use the EventLogFile CreatedDate field to identify newly created log files. Hourly and daily incremental logs are delivered differently. See Differences Between Hourly and 24-Hour Event Logs for details.

All queries and examples in this section require the View Event Log Files and API Enabled user permissions. Users with the View All Data permission can also view event monitoring data.