Supported query filter fields

See query filters for reference on syntax of the filters. You could also start by checking out our examples before you read other sections on query filters.

Query filters fields supported by v1beta1 alerts.list

Filter fields
alertId	Should be used to filter alerts based on alert id. Corresponding value should be of type: string.
type	Should be used to filter alerts based on alert type. Corresponding value should be of type: string. Possible values for this filter are listed in the Alert.type field description.
source	Should be used to filter alerts based on alert source. Corresponding value should be of type: string. Possible values for this filter are listed in the Alert.type field description.
createTime	Should be used to filter alerts based on alert creation time. Corresponding value should be of type: string (Timestamp format); more specifically, an RFC 3339 date-time string, for example, "2018-01-01T00:00:00Z"
startTime	Should be used to filter alerts based on alert start time. Corresponding value should be of type: string (Timestamp format); more specifically, an RFC 3339 date-time string, for example, "2018-01-01T00:00:00Z"
endTime	Should be used to filter alerts based on alert end time. Corresponding value should be of type: string (Timestamp format); more specifically, an RFC 3339 date-time string, for example, "2018-01-01T00:00:00Z"

Alert listing Examples

To query for all alerts created on or after April 5, 2018:
createTime >= "2018-04-05T00:00:00Z"

To query for all alerts from the source "Gmail phishing":
source:"Gmail phishing"

To query for all alerts which started in 2017:
startTime >= "2017-01-01T00:00:00Z" AND startTime < "2018-01-01T00:00:00Z"

To query for all user reported phishing alerts from the source "Gmail phishing":
type:"User reported phishing" source:"Gmail phishing"

Query filters fields supported by v1beta1 alerts.feedback.list

Filter fields
alertId	Should be used to filter alert feedback based on alert id. Corresponding value should be of type: string. Can be used to list feedback for selected alerts in one call when the '-' wildcard is used in request's alertId.
feedbackId	Should be used to filter alert feedback based on feedback id. Corresponding value should be of type: string.

Alert feedback listing Examples

To query feedback of alerts with ids alertId01 or alertId02:
alertId = alertId01 OR alertId = alertId02

To query feedback of an alert alertId01 with feedback id feedbackId01:
alertId = alertId01 AND feedbackId = feedbackId01