🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The addToBlocklistById() mutation adds a pattern to the blocklist for a specific view, preventing matching queries from executing in that view. Patterns match by regular expression or exact text. Blocklisting stops runaway or resource-intensive queries from degrading cluster performance. Use this mutation when the view ID is known. To add a blocklist entry by view name instead of view ID, use addToBlocklist().

Syntax

graphql
addToBlocklistById(
      input: AddToBlocklistByIdInput!
   ): [BlockedQuery!]!

The mutation accepts a single required input argument of type AddToBlocklistByIdInput, which provides the view ID, the pattern to match, and the match type. The mutation returns a non-null list of BlockedQuery objects representing all active blocklist entries for the targeted view, not only the newly added entry. Use the blockedQueries() query to retrieve the view ID before calling this mutation.

Example

Raw
graphql
mutation {
  addToBlocklistById(input: {pattern: ".*local", type: REGEX, 
    viewId: "abc123" })
  { id, expiresAt, pattern, type, view{id, name} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addToBlocklistById(input: {pattern: \".*local\", type: REGEX, 
    viewId: \"abc123\" })
  { id, expiresAt, pattern, type, view{id, name} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  addToBlocklistById(input: {pattern: \".*local\", type: REGEX, 
    viewId: \"abc123\" })
  { id, expiresAt, pattern, type, view{id, name} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  addToBlocklistById(input: {pattern: \".*local\", type: REGEX,  ^
    viewId: \"abc123\" }) ^
  { id, expiresAt, pattern, type, view{id, name} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  addToBlocklistById(input: {pattern: \".*local\", type: REGEX, 
    viewId: \"abc123\" })
  { id, expiresAt, pattern, type, view{id, name} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  addToBlocklistById(input: {pattern: \".*local\", type: REGEX, 
    viewId: \"abc123\" })
  { id, expiresAt, pattern, type, view{id, name} }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  addToBlocklistById(input: {pattern: \".*local\", type: REGEX, 
    viewId: \"abc123\" })
  { id, expiresAt, pattern, type, view{id, name} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  addToBlocklistById(input: {pattern: \".*local\", type: REGEX, 
    viewId: \"abc123\" })
  { id, expiresAt, pattern, type, view{id, name} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "addToBlocklistById": [
      {
        "pattern": ".*local",
        "expiresAt": null,
        "id": "def456",
        "type": "REGEX",
        "view": {
          "id": "aK9GKAsTnMXfRxT8Fpecx3fX",
          "name": "humio"
        }
      }

Input Parameters

The AddToBlocklistByIdInput datatype requires the view ID, the pattern to match against executing queries, and the match type. Set type to REGEX to interpret the pattern as a regular expression, or to EXACT for a literal string match. Regex matching is case-sensitive by default.

Table: AddToBlocklistByIdInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
clusterWideBoolean  Long-Term Whether to apply the pattern, globally. Requires the ManageCluster permission.
patternStringyes Long-Term The pattern to match for selecting data to add to the blocklist.
typeBlockedQueryMatcherTypeyes Long-Term Whether the pattern should be matched exactly or interpreted as a regex pattern. See BlockedQueryMatcherType .
viewIdString    Limits the scope of the pattern to a specific view preventing matching queries from execution in that context only.

Returned Values

The mutation returns all active BlockedQuery entries for the view. Each entry includes the match pattern, pattern type, the associated view, the expiration time, and a flag indicating whether the calling user can remove the entry. A null expiresAt value means the block is permanent and has no expiration. The canRemove flag reflects whether the calling user has sufficient permissions to call removeFromBlocklist() for that entry.

Table: BlockedQuery Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
expiresAtDateTime  Long-Term The date and time in which any matching queries will cease to be blocked.
expiresInMillisecondsInt  Long-Term The amount of milliseconds until any matching queries won't be blocked.
idStringyes Long-Term The unique identifier of the blocked query.
limitedToOrganizationBooleanyes Long-Term Whether the blocked query should be limited to the organization.
organizationOrganization  Long-Term The organization associated with the view, if any. See Organization.
patternStringyes Long-Term The exact or regular expression pattern used to match queries to block.
typeBlockedQueryMatcherTypeyes Long-Term How the pattern should be matched (e.g., as a regular expression). See BlockedQueryMatcherType .
unblockAllowedBooleanyes Long-Term Whether the current user is allowed to unblock the query.
viewView  Long-Term The related view, if any. See View.