🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The addDashboardFilter() mutation adds a named filter to a dashboard's filter list. A dashboard filter prepends a filter expression to every widget query in the dashboard, restricting all widget results to events that match that expression. Call this mutation once for each filter to define the dashboard's filter set.

To update an existing filter, use updateDashboardFilter(). To remove a filter, use removeDashboardFilter().

Syntax

graphql
addDashboardFilter(
      name: String!,
      prefixFilter: String!,
      id: String!,
      searchDomainName: String!
   ): Dashboard!

All four arguments are required. Provide the filter display name, the filter expression to prepend to widget queries (prefixFilter), the repository or view name (searchDomainName), and the dashboard's unique identifier (id). The mutation returns the full Dashboard object, including the updated filter list.

To retrieve a dashboard's unique identifier, use the repository() query shown in the following example.

Hide Query Example

Show Dashboard Identifiers Query

Example

Raw
graphql
mutation {
  addDashboardFilter(
      name: "filtration",
      id: "abc123", 
      searchDomainName: "humio",
      prefixFilter: "server1_")
  {id, name, widgets { id, title } }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addDashboardFilter( ^
      name: \"filtration\", ^
      id: \"abc123\",  ^
      searchDomainName: \"humio\", ^
      prefixFilter: \"server1_\") ^
  {id, name, widgets { id, title } } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addDashboardFilter(
      name: \"filtration\",
      id: \"abc123\", 
      searchDomainName: \"humio\",
      prefixFilter: \"server1_\")
  {id, name, widgets { id, title } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "addDashboardFilter": {
      "id": "abc123",
      "name": "Hosts",
      "widgets": [
        {
          "id": "def456",
          "title": "Cluster Time Skew (Millis)"
        },
        {
          "id": "ghi789",
          "title": "Open File Descriptors"
        },
        ...
      ]
    }
  }
}

Input Parameters

All four parameters are required. To find the dashboard identifier, use the repository() query in the Syntax section.

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
id string yes   The unique identifier of the dashboard to which the filter is added.
name string yes   The display name shown for this filter in the dashboard filter list.
prefixFilter string yes   The filter expression prepended to every widget query in the dashboard. Only events matching this expression appear in any widget while this filter is active.
searchDomainName string yes   The name of the search domain (that is, the repository or view).

Returned Values

The mutation returns a Dashboard object. Inspect the filters field to confirm the new filter was added and to retrieve its assigned identifier. You need this identifier to call updateDashboardFilter() or removeDashboardFilter().

Table: Dashboard Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
allowedActionsAssetActionyes Short-Term The allowed asset actions. See AssetAction Table). This is feature is a preview and may be changed.
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the dashboard. See AssetCommitMetadata.
defaultFilterDashboardFilter  Long-Term The default filter used with the dashboard (see DashboardFilter Table).
defaultSharedTimeEnabledBooleanyes Long-Term Whether the shared time by default is enabled.
defaultSharedTimeEndStringyes Long-Term The default shared ending time.
defaultSharedTimeStartStringyes Long-Term The default shared starting time.
descriptionString  Long-Term A description of the dashboard.
displayNameStringyes Long-Term The display name of the dashboard.
filtersDashboardFilteryes Long-Term The filters used with the dashboard. See DashboardFilter.
idStringyes Long-Term The unique identifier for the dashboard.
isStarredBooleanyes Long-Term Whether the dashboard is marked with a star.
labelsStringyes Long-Term Any labels associated with the dashboard.
modifiedInfoAssetCommitMetadata  Long-Term Metadata related to the latest modification of the dashboard. See AssetCommitMetadata.
nameStringyes Long-Term The name of the dashboard.
packagePackageInstallation  Long-Term The package, if there is one, in which the dashboard is included (see PackageInstallation Table).
packageIdVersionedPackageSpecifier  Long-Term The unique identifiers of the package. VersionedPackageSpecifier is a scalar.
parametersDashboardParameteryes Long-Term List of dashboard parameters (see DashboardParameter Table).
readOnlyTokensDashboardLinkyes Long-Term List of tokens used to access the dashboard without logging in. Useful for wall mounted dashboards or public dashboards. See DashboardLink.
resourceStringyes Short-Term The resource identifier for this dashboard.
searchDomainSearchDomainyes Long-Term The search domain for the dashboard. See SearchDomain.
sectionsSectionyes Long-Term The sections for the dashboard. See Section.
seriesSeriesConfigyes Long-Term The series configuration for the dashboard. See SeriesConfig.
seriesColorPaletteString  Short-Term Stability: Short-term
templateYamlStringyes  deprecated in 1.225A YAML formatted string that describes the dashboard. It does not contain links or permissions, and is safe to share and use for making copies of a dashboard.
timeJumpSizeInMsInt  Long-Term The skip time in milliseconds for the dashboard.
updateFrequencyDashboardUpdateFrequencyTypeyes Long-Term The frequency in which dashboard is updated. See DashboardUpdateFrequencyType, and the explanations under the DashboardParameter.
widgetsWidgetyes Long-Term Widgets for the dashboard (see Widget Table).
yamlTemplateYAMLyes Long-Term A yaml formatted string that describes the dashboard. YAML is a scalar. It doesn't contain links or permissions, and is safe to share and use for making copies of a dashboard. This replaced templateYaml starting in LogScale version 1.165.