m365-exchange-mail-flows
Fetch Exchange mail flow message trace logs using Office 365 Reporting API
m365-exchange-mail-flows [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]
- profile=PROFILE
- Microsoft 365 connect profile name
- duration=NUM{mon|w|d|h|m|s}
- Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Time | |
| profile | String | Connect profile | Microsoft 365 connect profile code |
| mail_from | String | Sender address | Email address format |
| mail_to | String | Recipient address | Email address format |
| mail_subject | String | Mail subject | |
| size | Long | Size | In bytes |
| status | String | Status | e.g. Failed, Delivered, Expanded, Quarantined |
| src_ip | IP address | Source IP | |
| index | Integer | Index | |
| msg_id | String | Massage ID | |
| msg_trace_id | String | Massage Trace ID | GUID format |
| organization | String | Organization name | e.g. TENANT.onmicrosoft.com |
| start_date | String | Start date | e.g. /Date(1723102739000)/ |
| end_date | String | End date | e.g. /Date(1723189139000)/ |