addAlertLabelV2()

You can attach labels to alerts to make it easier to keep them organized — to spot duplicates or gaps. You can add labels when creating an alert, or later with the addAlertLabelV2() GraphQL mutation. Since it doesn't allow for the addition of multiple labels, it has been deprecated — to be removed by version 1.273 — and it's been replaced with addLegacyAlertLabels().

After using this mutation, you may decide to delete some labels. Use the removeLegacyAlertLabels() mutation to do that.

Hide Query Example

Show Alert Labels Query

To get a list of alert labels, you could execute the repository() query like this:

graphql

query {
     repository ( name: "humio" )
      { alerts { labels } }
   }

For more information on alerts, see the Triggers documentation page. To manage labels through the UI, see the Triggers and Manage Triggers pages of the main documentation.

API Stability Deprecated

Syntax

graphql

addAlertLabelV2(
      input: AddAlertLabel!
    ): Alert!

For the input, you have to give the name of the view or repository, and the unique identifier of the alert to which you want to add a label (click on Show Query below). Last, you'll have to provide the label, which can be up to sixty characters.

For the return datatype, you can get details on the alert, including a list of labels for it. See the Returned Datatype section farther down this page.

Hide Query Example

Show Alert Identifiers Query

To get a list of all alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { alerts { name, id } }
   }

With these results you can use an alert's unique identifier to add a label to it.

Example

Raw

graphql

mutation {
  addAlertLabelV2(input: {
    viewName: "humio",
    id: "abc123", 
    label: "humioator" } 
    )
  { displayName, description }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addAlertLabelV2(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    label: \"humioator\" } 
    )
  { displayName, description }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addAlertLabelV2(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    label: \"humioator\" } 
    )
  { displayName, description }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addAlertLabelV2(input: { ^
    viewName: \"humio\", ^
    id: \"abc123\",  ^
    label: \"humioator\" }  ^
    ) ^
  { displayName, description } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addAlertLabelV2(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    label: \"humioator\" } 
    )
  { displayName, description }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addAlertLabelV2(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    label: \"humioator\" } 
    )
  { displayName, description }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addAlertLabelV2(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    label: \"humioator\" } 
    )
  { displayName, description }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addAlertLabelV2(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    label: \"humioator\" } 
    )
  { displayName, description }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addAlertLabelV2": {
      "displayName": "Late Night",
      "description": "Any activities late at night."
    }
  }
}

Given Datatype

You'll have to give the view or repository name and the unique identifier of the alert to which you want to add a label — and the label to add. This is described here in the table for this datatype. Click on the Show Query link under the Syntax section above for an example of how to get the aggregate alert identifiers.

Table: AddAlertLabel

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 17, 2024
id	string	yes	`Long-Term`	Identifier of the alert.
label	string	yes	`Long-Term`	Label for the alert.
viewName	string	yes	`Long-Term`	Name of the view of the alert.

Returned Datatype

You can get the query string used by the alert, what is triggered, and any error messages when it was last executed. These and other parameters are listed in the table below, along with links to related datatype tables. Be sure to include the labels parameter so you can see the results of your addition, in case there's one you want to eliminate or you forgot to add.

Table: Alert

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 29, 2025
actions	string	yes	`Long-Term`	List of identifiers for actions to fire on query result.
actionsV2	[Action]	yes	`Long-Term`	List of unique identifiers for actions to fire on query result. See Action.
allowedActions	[AssetAction]	yes	`Short-Term`	List of allowed actions. See AssetAction .
createdInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the creation of the alert. See AssetCommitMetadata.
description	string		`Long-Term`	Description of alert.
displayName	string	yes	`Long-Term`	Name of the alert.
enabled	boolean	yes	`Long-Term`	Flag indicating whether the alert is enabled.
id	string	yes	`Long-Term`	The identifier of the alert.
labels	[string]	yes	`Long-Term`	Labels attached to the alert.
lastError	string		`Long-Term`	Last error encountered while running the alert.
lastWarnings	[string]	yes	`Long-Term`	Last warnings encountered while running the alert.
name	string	yes	`Long-Term`	The name of the alert.
package	PackageInstallation		`Long-Term`	A package installation. See PackageInstallation.
packageId	VersionedPackageSpecifier		`Long-Term`	The unique identifier of the package installed, if one was used. VersionedPackageSpecifier is a scalar.
queryOwnership	QueryOwnership	yes	`Long-Term`	Ownership of the query run by the alert. See QueryOwnership.
queryStart	string	yes	`Long-Term`	Start of the relative time interval for the query.
queryString	string	yes	`Long-Term`	LogScale query to execute.
resource	string	yes	`Short-Term`	The resource identifier for the alert.
runAsUser	User		`Long-Term`	Identifier of user by which the alert is run. See User.
throttleField	string		`Long-Term`	Field on which to throttle alert.
throttleTimeMillis	long	yes	`Long-Term`	Throttle time in milliseconds.
timeOfLastTrigger	long		`Long-Term`	UNIX timestamp for when the alert was last triggered.
yamlTemplate	string	yes	`Long-Term`	The yaml formatted text that describes the alert.

Versions of this Page

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes