addAggregateAlertLabel()

The administering of aggregate alerts, especially when you have many of them to monitor your servers and other systems, can be cumbersome. Labeling related aggregate alerts can help you to stay organized, reduce redundancy, and ensure there are no gaps in coverage.

The addAggregateAlertLabel() mutation can be used to add a label to an aggregate alert. However, this mutation is deprecated since it doesn't support multiple labels. It will be removed at the earliest in version 1.273. Use instead addAggregateAlertLabels(), which lets you add several labels at at time. Use removeAggregateAlertLabels() to remove labels.

Hide Query Example

Show Aggregate Alert Labels Query

To get a list of aggregate alert labels, you could execute the repository() query like this:

graphql

query {
     repository ( name: "humio" )
      { aggregateAlerts { labels } }
   }

For more information on saved queries, see the Aggregate alerts documentation page. To manage labels through the UI, see the Triggers and Manage Triggers pages of the main documentation.

Stability Level

Deprecated

Syntax

graphql

addAggregateAlertLabel(
       input: AddAggregateAlertLabel!
    ): boolean

For the input, you have to give the name of the view or repository, and the unique identifier of the aggregate alert to which you want to add a label (click on Show Query below). And, you'll have to provide the label to add.

There are no special return datatypes for this mutation field. You'll get only confirmation of success or failure. The new mutation, addAggregateAlertLabels() will return details on the aggregate alert, including a list of labels for it. That's much more useful and another reason to use the new mutation.

Hide Query Example

Show Aggregate Alert Identifiers Query

To get a list of all aggregate alerts for a repository, use the repository() query like this:

graphql

query {
     repository( name: "humio" )
        { aggregateAlerts { name, id } }
   }

With these results you can use an aggregate alert's unique identifier to add a label to it.

Example

Raw

graphql

mutation {
  addAggregateAlertLabel(
    input: { 
      viewName: "humio",
      id: "abc123",
      label: "aggie-alert-1"  }
  )
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addAggregateAlertLabel( ^
    input: {  ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      label: \"aggie-alert-1\"  } ^
  ) ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addAggregateAlertLabel": true
  }
}

Given Datatype

You'll have to give the view or repository name, and the unique identifier of the aggregate alert to which you want to add a label — and the label to add. Click on the Show Query link under the Syntax section above for an example of how to get the aggregate alert identifiers.

Table: AddAggregateAlertLabel

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Aug 11, 2025
id	string	yes	`Long-Term`	The unique identifier of the aggregate alert.
label	string	yes	`Long-Term`	The label for the aggregate alert.
viewName	RepoOrViewName	yes	`Long-Term`	The name of the view or repository of the aggregate alert. RepoOrViewName is a scalar.

Versions of this Page

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes