--- schema_version: "1" id: 2c6dea091f75c7afab047d89a28f4b6d00fa2c5518fd42c6751282b3386581e7 title: EventLogFile collection: legacydeveloper version: current locale: en-us portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/object_reference/sforce_api_objects_eventlogfile.md canonical_url: https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile.htm source_site: developer.salesforce.com content_type: documentation content_hash: 0875266efd3e342e47101879121a596e6a199ba49f1d0f186dac37b3b75b6b47 description: Represents event log files generated by Event Monitoring. Use event log file data to analyze usage trends and user behavior in your Salesforce org. This object is available in API version 32.0 and later. The Interval and Sequence fields are available only in API version 37.0 and later. --- # EventLogFile Represents event log files generated by Event Monitoring. Use event log file data to analyze usage trends and user behavior in your Salesforce org. This object is available in API version 32.0 and later. The Interval and Sequence fields are available only in API version 37.0 and later. You can interact with event monitoring data by querying fields on the EventLogFile object (like EventType and LogDate). CreatedDate tracks when the log file was generated. To view the underlying event data, query the LogFile field. The EventType determines the schema of this field. Log files don’t count towards your org’s data or file storage allocations. For more information, see [EventLogFile Supported Event Types](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_supportedeventtypes.htm "The EventType field in the EventLogFile object supports these events. Some common fields, such as CPU_TIME and RUN_TIME, can have null or zero values depending on how the events are generated for a given feature. Sometimes, three quotation marks appear around event data containing special characters in the CSV file. The third quotation mark is necessary for tools and applications to parse the field data at the correct field value boundary."). Composite requests that include multiple API requests in a single call aren’t supported. In the event of a composite request, EventLogFile captures only the parent request. ![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png) #### Note Log data schema for each EventType can change. With each new release, use the LogFileFieldNames and LogFileFieldTypes fields to validate the schema changes. In the unlikely case in which no log files are generated for 24 hours, contact Salesforce Customer Support. ![Tip](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note_tip.png) #### Tip Debug and troubleshoot performance issues by correlating logs using the customizable Request Identifier field, available in all Event Monitoring logs. To correlate logs pertaining to an API request call, set the X-SFDC-REQUEST-ID header with a 32 character OTEL compatible TraceId or a 22 -character alphanumeric Id. Using SOQL, search for the Event Monitoring logs with this RequestId to correlate the logs and see the unit of work performed as a part of the API transaction. For details about event monitoring, see the [Trailhead Event Monitoring module](https://trailhead.salesforce.com/en/modules/event_monitoring/units/event_monitoring_intro "HTML (New Window)"). ## Special Access Rules Accessing this object requires View Event Log Files and API Enabled user permissions. Users with View All Data permission can view event log files. ## Supported Calls describeSObjects(), query(), retrieve() ![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png) #### Note You can only delete event log file data if you enable the **Delete event monitoring data** setting in Setup. ![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png) #### Note All Shield and Event Monitoring customers have 1 year of Event Log File storage enabled by default. ## Fields | Field | Details | | --- | --- | | ApiVersion | Type double Properties Filter, Sort Description The specific API version for this log file. This field is available in API version 30.0 and later. | | EventType | Type picklist Properties Filter, Group, Restricted picklist, Sort Description The event type—API, Login, Report, URI, and so forth. Use to determine which files were generated for your org. For the corresponding LogFile schema, see [EventLogFile Supported Event Types](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_supportedeventtypes.htm "The EventType field in the EventLogFile object supports these events. Some common fields, such as CPU_TIME and RUN_TIME, can have null or zero values depending on how the events are generated for a given feature. Sometimes, three quotation marks appear around event data containing special characters in the CSV file. The third quotation mark is necessary for tools and applications to parse the field data at the correct field value boundary."). | | LogDate | Type dateTime Properties Filter, Sort Description The date and time of the log file’s creation. For daily event log files, tracks usage activity for a 24-hour period, from 12:00 a.m. to 11:59 p.m. UTC time. For hourly event log files, indicates the hour in which the log file was generated. For example, for events that occur between 11:00 AM and 12:00 PM on 3/7/2016, this field’s value is 2016-03-07T11:00:00.000Z. ![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png) #### Note For hourly event log files, we recommend using CreatedDate to query the date and time that an EventLogFile object was created. | | LogFile | Type base64 Description Encoded file data in .csv format. The EventType field defines the schema for this data. | | LogFileContentType | Type string Properties Filter, Group, Sort Description The content type of the log file; always .csv. | | LogFileFieldNames | Type string Properties Nillable Description The ordered list of fields in the log file data. ![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png) #### Note LogFileFieldNames and LogFileFieldTypes are specific to each EventType. For example, LogFileFieldNames has a different value for an API EventType and a Login EventType. | | LogFileFieldTypes | Type string Properties Nillable Description The ordered list of field types in the log file data (String, Id, and so forth). ![Note](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/images/icon_note.png) #### Note LogFileFieldNames and LogFileFieldTypes are specific to each EventType. For example, LogFileFieldTypes has a different value for an API EventType and a Login EventType. | | LogFileLength | Type double Properties Filter, Sort Description The log file length in bytes. You can use this field to plan storage needs for your log files. | - **[EventLogFile Supported Event Types](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_eventlogfile_supportedeventtypes.htm)** The EventType field in the EventLogFile object supports these events. Some common fields, such as CPU\_TIME and RUN\_TIME, can have null or zero values depending on how the events are generated for a given feature. Sometimes, three quotation marks appear around event data containing special characters in the CSV file. The third quotation mark is necessary for tools and applications to parse the field data at the correct field value boundary.