title: How to only pull last 24 hours logs from Slack accesslogs API?
body: <p><strong>API reference</strong>: <a href="https://api.slack.com/methods/team.accessLogs" rel="nofollow noreferrer">https://api.slack.com/methods/team.accessLogs</a></p>
  <p><strong>Overview:</strong>
  Slack Access logs API does not have 'start date' parameter, it only has 'before' date parameter. Each access log entry in the response has date_first and date_last fields. date_first is the first time user accessed slack using the combination of IP address and user agent and date_last is the last time the user accessed slack using that same combination. The logs in response are sorted in reverse chronological order on date_first. Pagination is by 1000 records per page.</p>
  <p><strong>My use-case:</strong>
  I want to get all the access logs which have date_last in the last 24 hours. Once I get all the logs with date_last that belong to the last 24 hours, I want to stop the execution for requesting more data from slack</p>
  <p><strong>Issue:</strong>
  Since the logs in the response are sorted based on date_first, I don't know where to stop my request call because if I stop when I reach date_first for a log beyond 24 hours, I might lose data beyond that record for which date_last might be within last 24 hours which is possible as a log might have date_first not within 24 hours but still have date_last within 24 hours. If I stop when I find date_last greater than 24 hours, I will lose data after it which might have date_last within 24 hours which is possible as the logs are not sorted based on date_last.</p>
  <p><strong>Example of accesslogs API response</strong>:</p>
  <pre><code>{
  &quot;ok&quot;: true,
  &quot;logins&quot;: [
      {
          &quot;user_id&quot;: &quot;U45678&quot;,
          &quot;username&quot;: &quot;alice&quot;,
          &quot;date_first&quot;: 1422922864,
          &quot;date_last&quot;: 1422922864,
          &quot;count&quot;: 1,
          &quot;ip&quot;: &quot;127.0.0.1&quot;,
          &quot;user_agent&quot;: &quot;SlackWeb Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.35 Safari/537.36&quot;,
          &quot;isp&quot;: &quot;BigCo ISP&quot;,
          &quot;country&quot;: &quot;US&quot;,
          &quot;region&quot;: &quot;CA&quot;
      },
      {
          &quot;user_id&quot;: &quot;U12345&quot;,
          &quot;username&quot;: &quot;white_rabbit&quot;,
          &quot;date_first&quot;: 1422922493,
          &quot;date_last&quot;: 1422922493,
          &quot;count&quot;: 1,
          &quot;ip&quot;: &quot;127.0.0.1&quot;,
          &quot;user_agent&quot;: &quot;SlackWeb Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B466 Safari/600.1.4&quot;,
          &quot;isp&quot;: &quot;BigCo ISP&quot;,
          &quot;country&quot;: &quot;US&quot;,
          &quot;region&quot;: &quot;CA&quot;
      }
  ],
  &quot;paging&quot;: {
      &quot;count&quot;: 100,
      &quot;total&quot;: 2,
      &quot;page&quot;: 1,
      &quot;pages&quot;: 1
  }
  </code></pre>
  <p>}</p>