Add a Query to the Blocklist

Organization owners or administrators with root access can add queries to a blocklist through either the Query Monitor's Block and Kill panel or by explicitly adding blocks based on query strings and regular expressions. The process involves selecting pattern types (exact match or regex), defining matching criteria, and choosing whether to apply blocks organization-wide or to specific repositories, with any matching queries being immediately stopped and prevented from running until an administrator removes the block.

There are two ways to block a query:

Important

To add a query to the blocklist you must be an organization owner.

To add a query to the Blocklist page:

  1. Go to the Blocklist.

  2. Click the + Add Item button.

  3. You will be prompted to define the block:

    Screenshot of the LogScale Query Administration interface showing the first step of adding a query block. The dialog displays a form where administrators can define blocking parameters with two main options: Pattern Type selection (dropdown menu to choose between 'Regular Expression' or 'Exact Match') and a Pattern input field where the query text or regex pattern to be blocked can be entered.

    Figure 10. Query Administration Adding a Block


    • Select the Pattern Type: either Regular Expression or Exact Match.

    • Enter the matching pattern or exact query into the Pattern box.

  4. Click Next.

  5. You will be prompted to select the repository to which the block applies, whether across the entire organization, or only for selected repositories and views.

    Screenshot of the LogScale Query Administration interface showing the second step of adding a query block - the scope selection dialog. The interface presents two radio button options for administrators to define the scope of the block: 'Organization wide' (applies the block to all repositories including future ones) or 'For selected repositories and views' (restricts the block to specific repositories). This dialog allows administrators to control the reach of query blocks, enabling either broad protection across the entire organization or targeted restrictions on specific data collections.

    Figure 11. Query Administration Adding a Block Organization or Repository Selection


    If you select Organization wide the block will apply to all repositories within the organization, including new repositories that are created after you have created the block.

    If you select For selected repositories and views, you will be prompted to select the repositories that you want the block to apply to. Click Next and select or search for one or more repositories.

    Screenshot of the LogScale Query Administration interface showing the repository selection dialog that appears when creating a targeted query block. This screen is displayed after selecting 'For selected repositories and views' in the previous step and allows administrators to specifically choose which repositories the query block will apply to. The interface includes a searchable repository list with selection checkboxes and confirms the block pattern being created.

    Figure 12. Query Administration Adding a Block Repository Selection


  6. Click Block Query.

Note

If you cancel the process, you will be warned that the query block specification will be lost.

Queries that are currently running and match the new pattern are stopped immediately and prevented from running until this entry on the blocklist is removed by an administrator, or until the query is changed in such a way that it no longer matches the pattern defined in the block.