🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The addToBlocklist() mutation adds a pattern-based block entry to the blocklist. The block prevents any query matching the pattern from executing. The pattern can be a regular expression or an exact string. Provide a viewName to restrict the block to a specific view. To apply the block across the entire cluster, set clusterWide to true. To block by view ID rather than view name, use addToBlocklistById() instead.

Syntax

graphql
addToBlocklist(
      input: AddToBlocklistInput!
   ): [BlockedQuery!]!

The mutation accepts a single required input argument of type AddToBlocklistInput, which provides the match pattern, match type, and optional scope. It returns a non-null list of BlockedQuery objects representing all active block entries after the operation completes.

Example

Raw
graphql
mutation {
  addToBlocklist(input: 
    { pattern: ".*local",
      type: REGEX, 
      viewName: "humio" } )
    { id, expiresAt, 
      pattern, type,
      view{ id, name } }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addToBlocklist(input: 
    { pattern: \".*local\",
      type: REGEX, 
      viewName: \"humio\" } )
    { id, expiresAt, 
      pattern, type,
      view{ id, name } }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addToBlocklist(input: 
    { pattern: \".*local\",
      type: REGEX, 
      viewName: \"humio\" } )
    { id, expiresAt, 
      pattern, type,
      view{ id, name } }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addToBlocklist(input:  ^
    { pattern: \".*local\", ^
      type: REGEX,  ^
      viewName: \"humio\" } ) ^
    { id, expiresAt,  ^
      pattern, type, ^
      view{ id, name } } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addToBlocklist(input: 
    { pattern: \".*local\",
      type: REGEX, 
      viewName: \"humio\" } )
    { id, expiresAt, 
      pattern, type,
      view{ id, name } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addToBlocklist(input: 
    { pattern: \".*local\",
      type: REGEX, 
      viewName: \"humio\" } )
    { id, expiresAt, 
      pattern, type,
      view{ id, name } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addToBlocklist(input: 
    { pattern: \".*local\",
      type: REGEX, 
      viewName: \"humio\" } )
    { id, expiresAt, 
      pattern, type,
      view{ id, name } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addToBlocklist(input: 
    { pattern: \".*local\",
      type: REGEX, 
      viewName: \"humio\" } )
    { id, expiresAt, 
      pattern, type,
      view{ id, name } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "addToBlocklist": [
      {
        "pattern": ".*hacker",
        "expiresAt": null,
        "id": "abc123",
        "type": "REGEX",
        "view": null
      },
      {
        "pattern": ".*local",
        "expiresAt": null,
        "id": "def456",
        "type": "REGEX",
        "view": {
          "id": "ghi789",
          "name": "humio"
        }
      }
    ]
  }
}

Input Parameters

The AddToBlocklistInput type requires a pattern string and a type value. The type controls whether the pattern is interpreted as a regular expression or an exact string. To limit the block to a specific view, provide a viewName. To apply the block across the entire cluster, set clusterWide to true. This requires the ManageCluster permission. The following table lists all available fields:

Table: AddToBlocklistInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
clusterWideBoolean  Long-Term Whether to apply the pattern, globally. Requires the ManageCluster permission.
patternStringyes Long-Term The pattern to match for selecting data to add to the blocklist.
typeBlockedQueryMatcherTypeyes Long-Term Whether the pattern should be matched exactly or interpreted as a regex pattern. See BlockedQueryMatcherType .
viewNameString  Long-Term Limits the scope of the pattern to a specific view preventing matching queries from execution in that context only.

Returned Values

The mutation returns a non-null list of BlockedQuery objects. The list reflects all active block entries after the operation, not only the newly added entry. Each BlockedQuery object provides the match pattern, match type, associated view, and expiration time. It also indicates whether the current user has permission to remove the entry. A null view field indicates a cluster-wide block. A null expiresAt field indicates the block does not expire. The following table lists all available fields:

Table: BlockedQuery Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
expiresAtDateTime  Long-Term The date and time in which any matching queries will cease to be blocked.
expiresInMillisecondsInt  Long-Term The amount of milliseconds until any matching queries won't be blocked.
idStringyes Long-Term The unique identifier of the blocked query.
limitedToOrganizationBooleanyes Long-Term Whether the blocked query should be limited to the organization.
organizationOrganization  Long-Term The organization associated with the view, if any. See Organization.
patternStringyes Long-Term The exact or regular expression pattern used to match queries to block.
typeBlockedQueryMatcherTypeyes Long-Term How the pattern should be matched (e.g., as a regular expression). See BlockedQueryMatcherType .
unblockAllowedBooleanyes Long-Term Whether the current user is allowed to unblock the query.
viewView  Long-Term The related view, if any. See View.