🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The clearErrorOnAlert() mutation clears the error status on a legacy alert in a specified view. Call this mutation after resolving the underlying cause of the error. If the alert encounters the same error again, the error status reappears.

Syntax

graphql
clearErrorOnAlert(
      input: ClearErrorOnAlertInput!
   ): Alert!

The input argument is required and accepts a ClearErrorOnAlertInput object. Provide the view name and the ID of the legacy alert on which to clear the error. Use the repositories() query to retrieve the alert ID.

The mutation returns a non-null Alert! object containing the updated alert state. The Returned Values section lists available fields.

Example

Raw
graphql
mutation {
  clearErrorOnAlert(input:
       { viewName: "humio", 
         id: "abc123" } )
  {name, enabled}
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  clearErrorOnAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\" } )
  {name, enabled}
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  clearErrorOnAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\" } )
  {name, enabled}
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  clearErrorOnAlert(input: ^
       { viewName: \"humio\",  ^
         id: \"abc123\" } ) ^
  {name, enabled} ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  clearErrorOnAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\" } )
  {name, enabled}
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  clearErrorOnAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\" } )
  {name, enabled}
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  clearErrorOnAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\" } )
  {name, enabled}
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  clearErrorOnAlert(input:
       { viewName: \"humio\", 
         id: \"abc123\" } )
  {name, enabled}
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "clearErrorOnAlert": {
      "name": "Late Night",
      "enabled": true
    }
  }
}

Input Parameters

The input argument accepts a ClearErrorOnAlertInput object with two fields: the view name and the legacy alert ID. The following table describes the input fields.

Table: ClearErrorOnAlertInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
idStringyes Long-Term Unique identifier of the alert.
viewNameStringyes Long-Term Name of the view of the alert.

Returned Values

The mutation returns the updated Alert object. Available fields include the query string, triggered actions, last error message, and last warnings. The following table lists all available fields:

Table: Alert Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsStringyes Long-Term List of identifiers for actions to fire on query result.
actionsV2Actionyes Long-Term List of unique identifiers for actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term List of allowed actions. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the alert. See AssetCommitMetadata.
descriptionString  Long-Term Description of alert.
displayNameStringyes Long-Term Name of the alert.
enabledBooleanyes Long-Term Flag indicating whether the alert is enabled.
idStringyes Long-Term The identifier of the alert.
labelsStringyes Long-Term Labels attached to the alert.
lastErrorString  Long-Term Last error encountered while running the alert.
lastWarningsStringyes Long-Term Last warnings encountered while running the alert.
nameStringyes Long-Term The name of the alert.
packagePackageInstallation  Long-Term A package installation. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The id of the package that the alert was installed as part of. Stability: Long-term
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this alert Stability: Long-term
queryStartStringyes Long-Term Start of the relative time interval for the query. Stability: Long-term
queryStringStringyes Long-Term LogScale query to execute. Stability: Long-term
resourceStringyes Short-Term The resource identifier for the alert.
runAsUserUser  Long-Term Id of user which the alert is running as. Stability: Long-term
throttleFieldString  Long-Term Field to throttle on. Stability: Long-term
throttleTimeMillisLongyes Long-Term Throttle time in milliseconds. Stability: Long-term
timeOfLastTriggerLong  Long-Term Unix timestamp for when the alert was last triggered. Stability: Long-term
yamlTemplateStringyes Long-Term A YAML formatted string that describes the alert. Stability: Long-term