addAggregateAlertLabels()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The addAggregateAlertLabels() mutation adds one or more labels to an existing aggregate alert in a repository or view. Labels let you organize and filter aggregate alerts by category, team ownership, or operational priority. You can add up to 100 labels per call.

On success, the mutation returns the updated AggregateAlert object. On failure, it returns null with error details. This mutation replaces the deprecated addAggregateAlertLabel(), which accepts only a single label per call and returns a boolean.

To remove labels from an aggregate alert, use removeAggregateAlertLabels().

Hide Query Example

Show Aggregate Alert Labels Query

To get a list of aggregate alert labels, execute the repository() query like this:

graphql

query {
     repository ( name: "humio" )
      { aggregateAlerts { labels } }
   }

For more information on aggregate alerts, see the Aggregate alerts documentation page. To manage labels through the UI, see the Triggers and Manage Triggers pages of the main documentation.

Syntax

graphql

addAggregateAlertLabels(
      input: AddAggregateAlertLabels!
   ): AggregateAlert

The mutation takes a single required input argument of type AddAggregateAlertLabels. Provide the repository or view name, the aggregate alert ID, and the list of labels to add. The return type AggregateAlert is nullable: the mutation returns the updated alert on success and null on failure. A null result indicates the alert was not found or the labels could not be applied.

Use the query in the following collapsed example to retrieve aggregate alert IDs before calling this mutation.

Hide Query Example

Show Aggregate Alert Identifiers Query

To get a list of all aggregate alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { aggregateAlerts { name, id } }
   }

Use an aggregate alert's unique identifier from these results to add labels to it.

Example

Raw

graphql

mutation {
  addAggregateAlertLabels(
    input: { 
      viewName: "humio",
      id: "abc123",
      labels: [ "aggie-alert",
                "night-shift",
                "admin-focus" ]
    }
  )
  {enabled, createdInfo { author {displayString} } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"aggie-alert\",
                \"night-shift\",
                \"admin-focus\" ]
    }
  )
  {enabled, createdInfo { author {displayString} } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"aggie-alert\",
                \"night-shift\",
                \"admin-focus\" ]
    }
  )
  {enabled, createdInfo { author {displayString} } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addAggregateAlertLabels( ^
    input: {  ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      labels: [ \"aggie-alert\", ^
                \"night-shift\", ^
                \"admin-focus\" ] ^
    } ^
  ) ^
  {enabled, createdInfo { author {displayString} } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"aggie-alert\",
                \"night-shift\",
                \"admin-focus\" ]
    }
  )
  {enabled, createdInfo { author {displayString} } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"aggie-alert\",
                \"night-shift\",
                \"admin-focus\" ]
    }
  )
  {enabled, createdInfo { author {displayString} } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"aggie-alert\",
                \"night-shift\",
                \"admin-focus\" ]
    }
  )
  {enabled, createdInfo { author {displayString} } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"aggie-alert\",
                \"night-shift\",
                \"admin-focus\" ]
    }
  )
  {enabled, createdInfo { author {displayString} } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addAggregateAlertLabels": {
      "enabled": true,
      "createdInfo": {
        "author": "teddy"
      }
    }
  }
}

Input Parameters

Provide the repository or view name, the unique identifier of the target aggregate alert, and the list of labels to add. You can add up to 100 labels per call. To retrieve aggregate alert identifiers, use the query in the collapsed example in the preceding Syntax section.

Returned Values

The mutation returns the updated AggregateAlert object. Include labels in your return fields to confirm the full set of labels after the mutation completes. You can also retrieve the query string, triggered actions, and trigger mode from the returned object.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes