De eerste link bevat overall uitleg en considerations. Ook zegt het iets over de verschillende mogelijkheden van data verwerking(1a en 1b).
De tweede link gaat over het Object (tabel) dat de event data bevat, en die we dus moeten gaan aanroepen.
De derde link beschrijft welke event types beschikbaar zijn. Ik heb alvast een voorselectie gemaakt van events die mogelijk het gewenste beeld geven. (3a, 3b…)

1 Using Event Monitoring

These examples use REST API event monitoring data that contains information useful for assessing org usage trends and user behavior.

Event monitoring is accessed through the Lightning Platform SOAP API and REST API by way of the EventLogFile object.

Therefore, you can integrate log data with your own back-end storage and data marts to correlate data from multiple orgs and across disparate systems.

• 1a Query Event Monitoring Data with REST
  Download large event file
  X-PrettyPrint:1 Staat 1 voor cvs en zijn er dan andere ook nog andere output formaten
• 1b Query or View Hourly Event Log Files

2 EventLogFile

Represents event log files for event monitoring. The event monitoring product gathers information about your Salesforce org’s operational events, which you can use to analyze usage trends and user behavior. This object is available in API version 32.0 and later. The Interval and Sequence fields are available only in API version 37.0 and later.
You can interact with event monitoring data by querying fields on the EventLogFile object (like EventType and LogDate). CreatedDate tracks when the log file was generated. To view the underlying event data, query the LogFile field. The EventType determines the schema of this field. For more information, see EventLogFile Supported Event Types.

3 EventLogFile Supported Event Types

The EventType field in the EventLogFile object supports these events. Some common fields, such as CPU_TIME and RUN_TIME, can have null or zero values depending on how the events are generated for a given feature.

1. Console Event Type
   COMPONENT_ID ?, TIMESTAMP_DERIVED, URI_ID_DERIVED ?, USER_ID_DERIVED


2. Content Document Link Event Type
   USER_ID_DERIVED (wat houdt een document in?), SHARED_WITH_ENTITY_ID , SHARING_OPERATION, TIMESTAMP_DERIVED


3. Content Transfer Event Type
   DOCUMENT_ID_DERIVED, FILE_PREVIEW_TYPE, TIMESTAMP_DERIVED, USER_ID_DERIVED


4. Continuation Callout Summary Event Type
   SUCCESS, TIMESTAMP_DERIVED, URL, USER_ID_DERIVED


5. Document Attachment Downloads Event Type
   ENTITY_ID (wat betekent entity hier?, FILE_TYPE, TIMESTAMP_DERIVED, USER_ID_DERIVED


6. External Custom Apex Callout Event Type
   ACTION, ENTITY, FILTER, REQUEST_ID, STATUS, TIMESTAMP_DERIVED, USER_ID_DERIVED (Waarom is deze hier niet, daarom USER_ID gebruiken?


7. External OData Callout Event Type
   ACTION, ENTITY, FILTER, REQUEST_ID, STATUS, TIMESTAMP_DERIVED, USER_ID
8. Lightning Interaction Event Type
   APP_NAME, CLIENT_ID, GRANDPARENT_UI_ELEMENT, PAGE_APP_NAME, PAGE_CONTEXT, PAGE_ENTITY_TYPE, PAGE_URL, PARENT_UI_ELEMENT, RECORD_ID, RECORD_TYPE, TIMESTAMP_DERIVED, USER_ID_DERIVED
9. Lightning Page View Event Type
   APP_NAME, CLIENT_ID, GRANDPARENT_UI_ELEMENT, PAGE_APP_NAME, PAGE_CONTEXT, PAGE_ENTITY_TYPE, PAGE_URL, PARENT_UI_ELEMENT, TIMESTAMP_DERIVED, USER_ID_DERIVED
11. Search Click Event Type
    TIMESTAMP_DERIVED, USER_ID
12. Visualforce Request Event Type PAGE_NAME, QUERY, TIMESTAMP_DERIVED, USER_AGENT, USER_ID_DERIVED

1 Using Event Monitoring

2 soorten logging
daily
voordeel : volledig
nadeel : loopt minimaal 1 dag achter
nadeel : alles in 1 x (dus geen mogelijkheid op 1x per uur Barbie regel)
hourly
Nadeel : hoeft niet perse volledig te zijn

Voor beide geldt dat er duplicaten kunnen ontstaan. Dus deduplicatie is vereist.

https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_diff.htm
Relatie leggen tussen client leggen en user id?
Volledige logfile binary coded?