Logs

Any time you send a request to an Evervault resource, a log of the request and response will be created inside of your app. You can use the Logs view in the Evervault Dashboard to view and filter these log events.

EQL


Logs can be queried using the Evervault Query Language (EQL), which allows you to filter logs based on their attributes.

Operators


The following operators are supported in EQL queries, but not every operator is available for every field. See the searchable fields section below for details.

OperatorMeaningExample
=Exact matchrequest.method="POST"
!=Not equalfunction.status!="success"
>Greater thanresponse.status>399
<Less thanresponse.status<500
>=Greater than or equal toresponse.status>=400
<=Less than or equal toresponse.status<=299
:Containsurl.path:"/checkout"

Compound queries


You can combine filters with AND when all conditions must match, OR when any condition can match, and parentheses to group conditions.

Searchable fields


FieldOperators
log.id
The unique identifier of the log.
=, !=
resource.id
The ID of the Evervault resource.
=, !=
external_customer_reference
The external customer reference sent with the request.
=, !=
category
The event category.
=, !=
request.method
The request method used in the HTTP request.
=, !=
response.content_type
The content type of the response.
=, !=
request.headers
The headers sent in the HTTP request.
=, :, !=
request.body
The body of the HTTP request.
=, :, !=
response.status
The status code of the HTTP response.
=, !=, >, <, >=, <=
response.headers
The headers sent in the HTTP response.
=, :, !=
response.body
The body of the HTTP response.
=, :, !=
request.content_type
The content type of the request.
=, !=
url.full
The full URL requested.
=, :, !=
url.domain
The domain part of the URL.
=, !=
url.path
The path part of the URL.
=, :, !=
url.query
The query string part of the URL.
=, !=
url.port
The port part of the URL.
=, !=, >, <, >=, <=
function.id
The unique identifier of the Function.
=, !=
function.run_id
The unique identifier of the Function run.
=, !=
function.name
The name of the Function.
=, !=
function.log
The log output of the Function.
=, :, !=
function.status
The status of the Function.
=, !=
function.initialisation.duration
The duration of the Function initialisation.
=, !=, >, <, >=, <=
function.duration
The duration of the Function.
=, !=, >, <, >=, <=
crypto.fields.encryptCount
The number of fields encrypted.
=, !=, >, <, >=, <=
crypto.fields.decryptCount
The number of fields decrypted.
=, !=, >, <, >=, <=
crypto.files.encryptCount
The number of files encrypted.
=, !=, >, <, >=, <=
crypto.files.decryptCount
The number of files decrypted.
=, !=, >, <, >=, <=
network_token.id
The unique identifier of the network token.
=, !=
3ds.id
The unique identifier of the 3D Secure session.
=, !=
3ds.status
The status of a 3D Secure session.
=, !=
3ds.authentication_flow
The authentication flow used in the 3D Secure session.
=, !=
3ds.card.last_four
The last four digits of a card number.
=, !=
3ds.card.funding
The card funding type.
=, !=
3ds.card.issuer
The issuer of the card.
=, !=
3ds.card.country
The country the card is issued in.
=, !=
3ds.card.currency
The currency of the card.
=, !=
3ds.card.segment
The card segment.
=, !=
3ds.payment_type
The type of payment.
=, !=
3ds.card.brand
The brand of the card.
=, !=
3ds.initiator
The initiator of the 3D Secure session.
=, !=
3ds.version
The version of the 3D Secure protocol used.
=, !=

Correlation IDs


Correlation IDs let you tie requests to Evervault with events in your own systems. This makes requests easier to trace across services, and easier to look up when you contact Evervault support.

You can send correlation IDs in two ways. Sending both is fine, and neither is required.

Trace context header


Add a traceparent header that follows the W3C Trace Context specification. You can send it on requests to the Evervault API and on requests sent through Relay. Relay passes the header through to the destination.

External customer reference


Add an externalCustomerReference attribute to the JSON body of the request. This method only works with the Evervault API. For requests sent through Relay, use the traceparent header instead.

To find requests in the Logs section of the Dashboard, search on the external_customer_reference field.