addFilterAlertLabels()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The addFilterAlertLabels() mutation adds one or more labels to an existing filter alert in a LogScale view or repository. Labels help you organize and categorize filter alerts when managing large numbers of them across a workspace.

Each filter alert supports at most ten labels, with a maximum length of sixty characters per label. On success, this mutation returns the updated FilterAlert object. On failure, it returns null with errors. To add a single label to a filter alert, use addFilterAlertLabel() instead.

To remove labels from a filter alert, use the removeFilterAlertLabels() mutation.

Hide Query Example

Show Filter Alert Labels Query

To get a list of filter alert labels, execute the repository() query like this:

graphql

query {
     repository ( name: "humio" )
      { filterAlerts { labels } }
   }

For more information on filter alerts, see the Filter alerts documentation page. To manage labels through the UI, see the Triggers and Manage Triggers pages of the main documentation.

Syntax

graphql

addFilterAlertLabels(
      input: AddFilterAlertLabels!
   ): FilterAlert

The required input argument accepts an AddFilterAlertLabels input object. Provide the view or repository name, the unique identifier of the target filter alert, and the list of labels to add. The return type is FilterAlert, which is nullable: the mutation returns null on failure.

The returned FilterAlert object contains the updated label list along with other alert details. See the Returned Values section for the full field reference.

Hide Query Example

Show Filter Alert Identifiers Query

To get a list of all filter alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { filterAlerts { name, id } }
   }

Use a filter alert's unique identifier from these results to add labels to it.

Example

Raw

graphql

mutation {
  addFilterAlertLabels(
    input: { 
      viewName: "humio",
      id: "abc123",
      labels: [ "key-alerts",
                "manager-alerts",
                "admin-focus" ]
  )
  {enabled, createdInfo { author {displayString} } }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\",
                \"manager-alerts\",
                \"admin-focus\" ]
  )
  {enabled, createdInfo { author {displayString} } }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\",
                \"manager-alerts\",
                \"admin-focus\" ]
  )
  {enabled, createdInfo { author {displayString} } }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addFilterAlertLabels( ^
    input: {  ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      labels: [ \"key-alerts\", ^
                \"manager-alerts\", ^
                \"admin-focus\" ] ^
  ) ^
  {enabled, createdInfo { author {displayString} } } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\",
                \"manager-alerts\",
                \"admin-focus\" ]
  )
  {enabled, createdInfo { author {displayString} } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\",
                \"manager-alerts\",
                \"admin-focus\" ]
  )
  {enabled, createdInfo { author {displayString} } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\",
                \"manager-alerts\",
                \"admin-focus\" ]
  )
  {enabled, createdInfo { author {displayString} } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\",
                \"manager-alerts\",
                \"admin-focus\" ]
  )
  {enabled, createdInfo { author {displayString} } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addFilterAlertLabels": {
      "enabled": true,
      "createdInfo": {
        "author": "teddy"
      }
    }
  }
}

Input Parameters

Provide the view or repository name in viewName, the unique identifier of the target filter alert in id, and the labels to add in labels. Each call replaces nothing: the mutation appends the supplied labels to any existing ones, subject to the ten-label maximum. Use the Show Filter Alert Identifiers Query in the preceding Syntax section to retrieve filter alert identifiers.

Returned Values

The mutation returns the updated FilterAlert object on success. Use labels to verify the current label set after the operation, or to identify labels to remove with removeFilterAlertLabels(). The object also includes the alert query string, configured actions, and any errors or warnings from the last execution.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes