addLegacyAlertLabels()

Stability Level

Long-Term

You can attach labels to legacy alerts to make it easier to keep them organized — to spot duplicates or gaps. You can add them when creating an alert, or later with the addLegacyAlertLabels() GraphQL mutation. There can be at most ten labels per alert, with a maximum length of sixty characters per label.

When you execute this mutation, it will return information on the updated alert if successful — null with errors, if not. The return values can include all of the labels for the alert, the ones added and already saved. From this you may decide to delete some labels. Use the removeLegacyAlertLabels() mutation to do that.

Hide Query Example

Show Legacy Alert Labels Query

To get a list of alert labels, you could execute the repository() query like this:

graphql

query {
     repository ( name: "humio")
      { alerts { labels } }
   }

For more information on legacy alerts, see the Legacy alerts documentation page. To manage labels through the UI, see the Triggers and Manage Triggers pages of the main documentation.

Syntax

graphql

addLegacyAlertLabels(
      input: AddLegacyAlertLabels!
   ): Alert

For the input, you have to give the name of the view or repository, and the unique identifier of the legacy alert to which you want to add labels (click on Show Query below). Last, you'll has to provide within brackets, a comma-separated list of labels.

For the return datatype, you can get details on the alert, including a list of labels for it. See the Returned Datatype section farther down this page.

Hide Query Example

Show Legacy Alert Identifiers Query

To get a list of all legacy alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { alerts { name, id } }
   }

With these results you can use an alert's unique identifier to add labels to it.

Example

Raw

graphql

mutation {
  addLegacyAlertLabels(input: {
    viewName: "humio",
    id: "abc123", 
    labels: [ "key-alerts",
              "night-shift",
              "admin-focus" ]
  )
  { displayName, description }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\",
              \"night-shift\",
              \"admin-focus\" ]
  )
  { displayName, description }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\",
              \"night-shift\",
              \"admin-focus\" ]
  )
  { displayName, description }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addLegacyAlertLabels(input: { ^
    viewName: \"humio\", ^
    id: \"abc123\",  ^
    labels: [ \"key-alerts\", ^
              \"night-shift\", ^
              \"admin-focus\" ] ^
  ) ^
  { displayName, description } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\",
              \"night-shift\",
              \"admin-focus\" ]
  )
  { displayName, description }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\",
              \"night-shift\",
              \"admin-focus\" ]
  )
  { displayName, description }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\",
              \"night-shift\",
              \"admin-focus\" ]
  )
  { displayName, description }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\",
              \"night-shift\",
              \"admin-focus\" ]
  )
  { displayName, description }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "addLegacyAlertLabels": {
      "displayName": "Late Night",
      "description": "Any activities late at night."
    }
  }
}

Given Datatype

You'll have to give the view or repository name, and the unique identifier of the legacy alert to which you want to add labels — and a comma-separated list of labels to add, within square-brackets. Click on the Show Query link under the Syntax section above for an example of how to get the legacy alert identifiers.

Table: AddLegacyAlertLabels

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Nov 14, 2025
id	string	yes	`Long-Term`	The unique identifier of a legacy alert.
labels	[string]	yes	`Long-Term`	Labels to add to a legacy alert, at most one-hundred at a time.
viewName	RepoOrViewName	yes	`Long-Term`	The name of the view of a legacy alert. RepoOrViewName is a scalar.

Returned Datatype

You can get the query string used by the alert, what actions are triggered, and any error messages when it was last executed. These and other parameters are listed in the table below, along with links to related datatype tables. Include the labels parameter so you can see the results of your addition, in case there's one you want to eliminate any or some you forgot to add.

Table: Alert

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 29, 2025
actions	string	yes	`Long-Term`	List of identifiers for actions to fire on query result.
actionsV2	[Action]	yes	`Long-Term`	List of unique identifiers for actions to fire on query result. See Action.
allowedActions	[AssetAction]	yes	`Short-Term`	List of allowed actions. See AssetAction .
createdInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the creation of the alert. See AssetCommitMetadata.
description	string		`Long-Term`	Description of alert.
displayName	string	yes	`Long-Term`	Name of the alert.
enabled	boolean	yes	`Long-Term`	Flag indicating whether the alert is enabled.
id	string	yes	`Long-Term`	The identifier of the alert.
labels	[string]	yes	`Long-Term`	Labels attached to the alert.
lastError	string		`Long-Term`	Last error encountered while running the alert.
lastWarnings	[string]	yes	`Long-Term`	Last warnings encountered while running the alert.
name	string	yes	`Long-Term`	The name of the alert.
package	PackageInstallation		`Long-Term`	A package installation. See PackageInstallation.
packageId	VersionedPackageSpecifier		`Long-Term`	The unique identifier of the package installed, if one was used. VersionedPackageSpecifier is a scalar.
queryOwnership	QueryOwnership	yes	`Long-Term`	Ownership of the query run by the alert. See QueryOwnership.
queryStart	string	yes	`Long-Term`	Start of the relative time interval for the query.
queryString	string	yes	`Long-Term`	LogScale query to execute.
resource	string	yes	`Short-Term`	The resource identifier for the alert.
runAsUser	User		`Long-Term`	Identifier of user by which the alert is run. See User.
throttleField	string		`Long-Term`	Field on which to throttle alert.
throttleTimeMillis	long	yes	`Long-Term`	Throttle time in milliseconds.
timeOfLastTrigger	long		`Long-Term`	UNIX timestamp for when the alert was last triggered.
yamlTemplate	string	yes	`Long-Term`	The yaml formatted text that describes the alert.

Versions of this Page

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes