Summary

You can reduce the data shown in a dashboard with filters. They also allow you to screen out unwanted data from all of the widgets in a dashboard. You can save these dashboard filters for use with different views, for different environments and users.

To create a dashboard filter through the GraphQL API, use the addDashboardFilter() mutation. As indicated, you can add several of them, by executing this mutation for each.

API Stability Long-Term

Syntax

graphql
addDashboardFilter(
     name: string!, 
     prefixFilter: string!, 
     searchDomainName: string!,
     id: string!
   ): Dashboard!

You'll have to provide a name for the dashboard filter, a prefix for it, the name of the repository or view, and the unique identifier of the dashboard. Click on Show Query below to find the dashboard identifier.

Hide Query Example

Show Dashboard Identifiers Query

Example

Raw
graphql
mutation {
  addDashboardFilter(
      name: "filtration",
      id: "abc123", 
      searchDomainName: "humio",
      prefixFilter: "server1_")
  {id, name, widgets { id, title } }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addDashboardFilter( ^
      name: \"filtration\", ^
      id: \"abc123\",  ^
      searchDomainName: \"humio\", ^
      prefixFilter: \"server1_\") ^
  {id, name, widgets { id, title } } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "addDashboardFilter": {
      "id": "abc123",
      "name": "Hosts",
      "widgets": [
        {
          "id": "def456",
          "title": "Cluster Time Skew (Millis)"
        },
        {
          "id": "ghi789",
          "title": "Open File Descriptors"
        },
        ...
      ]
    }
  }
}

Input Parameters

For the input, you would provide a name for the dashboard filter, a prefix for it, the name of the repository or view, and the unique identifier of the dashboard. Click on Show Query in the Syntax section above to find the dashboard identifier.

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
id string yes   The dashboard identifier with which the filter is associated.
name string yes   A name for the dashboard filter.
prefixFilter string yes   The filter's prefix.
searchDomainName string yes   The name of the search domain (i.e., the repository or view).

Returned Values

For the returned values, there are several related to the dashboard. The table below lists them. For this mutation you will probably be most interested in the filters choice and the link to its datatype to get a list of all of the dashboard filters in use.

Table: Dashboard Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Aug 19, 2025
allowedActions[AssetAction]yes Short-TermThe allowed asset actions. See AssetAction Table). This is feature is a preview and may be changed.
createdInfoAssetCommitMetadata  Long-TermMetadata related to the creation of the dashboard. See AssetCommitMetadata.
defaultFilterDashboardFilter  Long-TermThe default filter used with the dashboard (see DashboardFilter Table).
defaultSharedTimeEnabledbooleanyes Long-TermWhether the shared time by default is enabled.
defaultSharedTimeEndstringyes Long-TermThe default shared ending time.
defaultSharedTimeStartstringyes Long-TermThe default shared starting time.
descriptionstring  Long-TermA description of the dashboard.
displayNamestringyes Long-TermThe display name of the dashboard.
filters[DashboardFilter]yes Long-TermThe filters used with the dashboard. See DashboardFilter.
idstringyes Long-TermThe unique identifier for the dashboard.
isStarredbooleanyes Long-TermWhether the dashboard is marked with a star.
labels[string]yes Long-TermAny labels associated with the dashboard.
modifiedInfoAssetCommitMetadata  Long-TermMetadata related to the latest modification of the dashboard. See AssetCommitMetadata.
namestringyes Long-TermThe name of the dashboard.
packagePackageInstallationyes Long-TermThe package, if there is one, in which the dashboard is included (see PackageInstallation Table).
packageIdVersionedPackageSpecifieryes Long-TermThe unique identifiers of the package. VersionedPackageSpecifier is a scalar.
parameters[DashboardParameter]yes Long-TermList of dashboard parameters (see DashboardParameter Table).
readOnlyTokens[DashboardLink]yes Long-TermList of tokens used to access the dashboard without logging in. Useful for wall mounted dashboards or public dashboards. See DashboardLink.
resourcestringyes Short-TermThe resource identifier for this dashboard.
searchDomainSearchDomainyes Long-TermThe search domain for the dashboard. See SearchDomain.
sections[Section]yes Long-TermThe sections for the dashboard. See Section.
series[SeriesConfig]yes Long-TermThe series configuration for the dashboard. See SeriesConfig.
templateYamlstringyes DeprecatedA yaml formatted string that describes the dashboard. This field has been replaced with yamlTemplate. It will be removed at the earliest in version 1.225.
timeJumpSizeInMsinteger  Long-TermThe skip time in milliseconds for the dashboard.
updateFrequencyDashboardUpdateFrequencyTypeyes Long-TermThe frequency in which dashboard is updated. See DashboardUpdateFrequencyType, and the explanations under the DashboardParameter.
widgets[Widget]yes Long-TermWidgets for the dashboard (see Widget Table).
yamlTemplateYAMLyes Long-TermA yaml formatted string that describes the dashboard. YAML is a scalar. It doesn't contain links or permissions, and is safe to share and use for making copies of a dashboard. This replaced templateYaml starting in LogScale version 1.165.