Supported query filter fields

See Query filters for reference on filter syntax, and review the following filter examples.

Fields supported by alerts.list

Filter fields
alertId	Filters alerts by alert ID. Value must be a string .
type	Filters alerts by alert type. Value must be a string . For possible values, see the Alert.type field description .
source	Filters alerts by alert source. Value must be a string . For possible values, see the Alert.type field description .
createTime	Filters alerts by alert creation time. Value must be a string in Timestamp format. Use an RFC 3339 date-time string (for example, "2018-01-01T00:00:00Z" ).
startTime	Filters alerts by alert start time. Value must be a string in Timestamp format. Use an RFC 3339 date-time string (for example, "2018-01-01T00:00:00Z" ).
endTime	Filters alerts by alert end time. Value must be a string in Timestamp format. Use an RFC 3339 date-time string (for example, "2018-01-01T00:00:00Z" ).

List query examples

• To query for all alerts created on or after April 5, 2018:

  createTime >= "2018-04-05T00:00:00Z"

• To query for all alerts from the source "Gmail phishing":

  source:"Gmail phishing"

• To query for all alerts that started in 2017:

  startTime >= "2017-01-01T00:00:00Z" AND startTime < "2018-01-01T00:00:00Z"

• To query for all user-reported phishing alerts from the source "Gmail phishing":

  type:"User reported phishing" source:"Gmail phishing"

Fields supported by alerts.feedback.list

Filter fields
alertId	Filters alert feedback by alert ID. Value must be a string .
feedbackId	Filters alert feedback by feedback ID. Value must be a string .

Feedback list query examples

• To query feedback for alerts with IDs alertId01 or alertId02 :

  alertId = alertId01 OR alertId = alertId02

• To query feedback for an alert alertId01 with feedback ID feedbackId01 :

  alertId = alertId01 AND feedbackId = feedbackId01