Alfresco Content Services Api Rest Audit filter

[gregorio2501]

I'm using API rest for Audit.

I don't get the correct filter for filtering by type and action.

Using the endpoint: 

/alfresco/api/-default-/public/alfresco/versions/1/audit-applications/alfresco-access/audit-entries

I'm testing with the examples in the api-explorer page:

• where=(valuesKey='/alfresco-access/transaction/action' and valuesValue='DELETE')

• where=(createdByUser='jbloggs')

Each one works individually but do not combinated,

For example:

(valuesKey='/alfresco-access/transaction/action' and valuesValue='CREATE')

Give me the correct list for "CREATE" actions.

(valuesKey='/alfresco-access/transaction/type' and valuesValue='cm:folder' )

Give the correct list in "cm:folder" actions

But:

(valuesKey='/alfresco-access/transaction/type' and valuesValue='cm:folder' ) (valuesKey='/alfresco-access/transaction/action' and valuesValue='CREATE')

Give only "cm:folder" actions

(valuesKey='/alfresco-access/transaction/type' and valuesValue='cm:folder'  and valuesKey='/alfresco-access/transaction/action' and valuesValue='CREATE')

Same problem

(valuesKey='/alfresco-access/transaction/type' and valuesValue='cm:folder')  and (valuesKey='/alfresco-access/transaction/action' and valuesValue='CREATE')

Same problem

What is the correct filter for type and action?

Thanks in advance 

[afaust · Accepted solution]

The Audit API simply does not support supplying more than one filter using valuesKey/valuesValue. The API documentation states that

The list can be filtered by one or more of:
- createdByUser person id
- createdAt inclusive time period
- id inclusive range of ids
- valuesKey audit entry values contains the exact matching key
- valuesValue audit entry values contains the exact matching value

Linguistically, this can be understood in different ways. Unfortunately for your use case, the interpretation is not that you can use either of these fields multiple times, rather that you can use one of those fields or multiple of them, but each field only once.

Looking at the implementation, the documentation also seems to contain a lie/omission: It is not possible to use valuesKey or valuesValue without the other

[gregorio2501]

@afaust Thanks for reply.

Maybe can I do the query direct in the database? Can you explain me? 

Best regards.

[afaust]

I really can't explain much more than what you can read in the sources for direct SQL queries. Due to the significant normalisation of keys/values, queries can become quite complex pretty fast - which is one reason why Alfresco themselves did not bother to support more than one key-value pairing as selection criteria.

[gregorio2501]

@afaust thanks for your reply. 

[EddieMay]

Hi. @gregorio2501 

Thanks for accepting the answer as a solution.

Cheers,