Events API: filter on acteeName, and add "not equal to" operator

[jonathaningram]

At cloud.gov.au we'd like to be able to query the CF API /v2/events endpoint and say "give me events where the acteeName is NOT xxx". There are two parts to this:

1. We need to be able to filter on the acteeName. Note: we could do some prework to look up the guid of the app, except because of blue/green deployments the guid changes, so this is a moving target.
2. We need to be able to use the "not equal to" operator which currently does not exist. We can get around this by running two queries and using the difference but it would be good if we didn't have to do this.

Are either or both of these features something that the core team would be interested in accepting if we made a PR?

I note a related issue: #1031

I asked in the #capi slack channel, but wasn't able to get any insights there, so I decided to make a ticket here.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/153864955

The labels on this github issue will be updated when the story is started.

[anniesing]

Hi @jonathaningram,

Sorry we didn't get back to you in slack. I just bumped @zrob in the slack conversation. We appreciate you submitting an issue here as well. I am categorizing this issue under PM Review.

Thanks,
Annie

[christarazi]

If audit events had labels, you could label each audit event with its actee, then you could query the labels however you want. @ssisil @ankitjain1988 @zrob

Is there a specific reason we don't have labels on audit events?

[selzoc]

@Gerg is this a potential use case of advanced filtering? or are we keeping that to timestamp-based stuff?

[Gerg]

@selzoc I could definitely see a request like GET /v3/audit_events?target_names[not]=my-app

[Gerg]

This capability was added in ecc2cee and released in capi-release 1.100.0.