🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The clearErrorOnAggregateAlert() mutation clears the error status on an aggregate alert in LogScale. Use this mutation after you investigate and resolve the underlying cause of the error. If the error reoccurs, LogScale updates the status automatically.

Syntax

graphql
clearErrorOnAggregateAlert(
      input: ClearErrorOnAggregateAlertInput!
   ): AggregateAlert!

The mutation requires a single input argument of type ClearErrorOnAggregateAlertInput!, which accepts the view name and the unique identifier of the aggregate alert. The mutation returns a non-null AggregateAlert object representing the updated alert. See the Input Parameters section for field details.

The Returned Values section describes the fields available on the returned AggregateAlert object.

Example

Raw
graphql
mutation {
  clearErrorOnAggregateAlert(input:
       { viewName: "humio", 
         id: "abc123"} )
  {name, enabled}
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  clearErrorOnAggregateAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\"} )
  {name, enabled}
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  clearErrorOnAggregateAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\"} )
  {name, enabled}
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  clearErrorOnAggregateAlert(input: ^
       { viewName: \"humio\",  ^
         id: \"abc123\"} ) ^
  {name, enabled} ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  clearErrorOnAggregateAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\"} )
  {name, enabled}
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  clearErrorOnAggregateAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\"} )
  {name, enabled}
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  clearErrorOnAggregateAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\"} )
  {name, enabled}
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  clearErrorOnAggregateAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\"} )
  {name, enabled}
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "clearErrorOnAggregateAlert": {
      "name": "Special Aggregator",
      "enabled": true
    }
  }
}

Input Parameters

Provide the view name and the unique identifier of the aggregate alert on which to clear the error. Use the repositories() query shown in the Related section to retrieve aggregate alert identifiers.

Table: ClearErrorOnAggregateAlertInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
idStringyes Long-Term The unique identifier of the aggregate alert.
viewNameRepoOrViewNameyes Long-Term The name of the view of the aggregate alert. RepoOrViewName is a scalar.

Returned Values

The mutation returns the updated AggregateAlert object. You can retrieve the query string, triggered actions, and the most recent error or warning information. The following table lists all available fields and links to related datatype tables.

Table: AggregateAlert Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsActionyes Long-Term List of actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term List of actions allowed to fire on query result. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the aggregate alert. See AssetCommitMetadata.
descriptionString  Long-Term Description of the aggregate alert.
enabledBooleanyes Long-Term Flag indicating whether the aggregate alert is enabled.
idStringyes Long-Term Unique identifier of of the aggregate alert.
labelsStringyes Long-Term Labels attached to the aggregate alert.
lastErrorString  Long-Term Last error encountered while running the aggregate alert.
lastSuccessfulPollLong  Long-Term Unix timestamp for last successful poll of the aggregate alert query. If this isn't very recent, the alert might have problems.
lastTriggeredLong  Long-Term Unix timestamp for last execution of trigger.
lastWarningsStringyes Long-Term Last warnings encountered while running the aggregate alert.
modifiedInfoModifiedInfoyes Long-Term User or token used to modify the asset. See ModifiedInfo.
nameStringyes Long-Term Name of the aggregate alert.
packagePackageInstallation  Long-Term The package of which the aggregate alert was installed. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The unique identifier of the package of the aggregate alert template. VersionedPackageSpecifier is a scalar.
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this alert. See QueryOwnership.
queryStringStringyes Long-Term LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-Term Timestamp type to use for a query. See QueryTimestampType and the FAQ: How to handle ingest delays in aggregate alerts and scheduled searches KB article.
resourceStringyes Short-Term The resource identifier for the aggregate alert.
searchIntervalSecondsLongyes Long-Term Search interval in seconds.
throttleFieldString  Deprecateddeprecated in 1.282The field on which to throttle. This can be set only if throttleTimeSeconds is set. Aggregate alerts now support multiple throttle fields. This field will be removed at the earliest in version 1.279. Use instead the throttleFields field.
throttleFieldsStringyes Long-Term The fields on which to throttle. This can be set only if throttleTimeSeconds is set.
throttleTimeSecondsLongyes Long-Term Throttle time in seconds.
triggerModeTriggerModeyes Long-Term Trigger mode used for triggering the alert. See TriggerMode and the FAQ: How to handle ingest delays in aggregate alerts and scheduled searches KB article.
yamlTemplateYAMLyes Long-Term The yaml specification of the aggregate alert. YAML is a scalar.