🔒Security Requirements and Controls
🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createAlert() mutation creates a legacy alert in a LogScale view. A legacy alert runs a query on a schedule and triggers one or more actions when the query returns results. To create aggregate or filter-based alerts, use createAggregateAlert() or createFilterAlert() instead.

Syntax

graphql
createAlert(
      input: CreateAlert!
   ): Alert!

The mutation accepts a single required argument, input, of type CreateAlert!. The input specifies the view name, query string, time window, throttle interval, and action identifiers for the alert.

On success, the mutation returns an Alert! object representing the newly created alert. The return type is non-null.

Example

Raw
graphql
mutation {
  createAlert(input:
        {viewName: "humio", 
         name: "sneak-alert",
         queryString: "@host=*sneak*"
         queryStart: "1day",
         actions: "email-admin",
         throttleTimeMillis: 180000,
         queryOwnershipType: Organization
        } )
  { id, name }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createAlert(input:
        {viewName: \"humio\", 
         name: \"sneak-alert\",
         queryString: \"@host=*sneak*\"
         queryStart: \"1day\",
         actions: \"email-admin\",
         throttleTimeMillis: 180000,
         queryOwnershipType: Organization
        } )
  { id, name }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createAlert(input:
        {viewName: \"humio\", 
         name: \"sneak-alert\",
         queryString: \"@host=*sneak*\"
         queryStart: \"1day\",
         actions: \"email-admin\",
         throttleTimeMillis: 180000,
         queryOwnershipType: Organization
        } )
  { id, name }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createAlert(input: ^
        {viewName: \"humio\",  ^
         name: \"sneak-alert\", ^
         queryString: \"@host=*sneak*\" ^
         queryStart: \"1day\", ^
         actions: \"email-admin\", ^
         throttleTimeMillis: 180000, ^
         queryOwnershipType: Organization ^
        } ) ^
  { id, name } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createAlert(input:
        {viewName: \"humio\", 
         name: \"sneak-alert\",
         queryString: \"@host=*sneak*\"
         queryStart: \"1day\",
         actions: \"email-admin\",
         throttleTimeMillis: 180000,
         queryOwnershipType: Organization
        } )
  { id, name }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createAlert(input:
        {viewName: \"humio\", 
         name: \"sneak-alert\",
         queryString: \"@host=*sneak*\"
         queryStart: \"1day\",
         actions: \"email-admin\",
         throttleTimeMillis: 180000,
         queryOwnershipType: Organization
        } )
  { id, name }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createAlert(input:
        {viewName: \"humio\", 
         name: \"sneak-alert\",
         queryString: \"@host=*sneak*\"
         queryStart: \"1day\",
         actions: \"email-admin\",
         throttleTimeMillis: 180000,
         queryOwnershipType: Organization
        } )
  { id, name }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createAlert(input:
        {viewName: \"humio\", 
         name: \"sneak-alert\",
         queryString: \"@host=*sneak*\"
         queryStart: \"1day\",
         actions: \"email-admin\",
         throttleTimeMillis: 180000,
         queryOwnershipType: Organization
        } )
  { id, name }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createAlert": {
      "id": "abc123",
      "name": "sneak-alert"
    }
  }
}

Input Parameters

The input argument requires the view name, query string, action identifiers, and throttle interval. The following table describes all fields of the CreateAlert input type:

Table: CreateAlert Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsStringyes Long-Term List of unique identifiers of actions to execute on query result.
descriptionString  Long-Term Description of the alert.
enabledBoolean  Long-Term Flag indicating whether the alert is enabled.
labelsStringyes Long-Term Labels attached to the alert.
nameStringyes Long-Term Name of the alert.
queryOwnershipTypeQueryOwnershipType  Long-Term Ownership of the query run by this alert. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStartStringyes Long-Term Start of the relative time interval for the query.
queryStringStringyes Long-Term LogScale query to execute.
runAsUserIdString  Long-Term The alert will run with the permissions of the user corresponding to this unique identifier if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst this field is set, this will result in an error. If not specified, the alert will run with the permissions of the calling user. It requires the ChangeTriggersToRunAsOtherUsers permission to set this field to a user id different from the calling user.
throttleFieldString  Long-Term Field on which to throttle.
throttleTimeMillisLongyes Long-Term Throttle time in milliseconds.
viewNameStringyes Long-Term Name of the view of the alert.

Returned Values

The mutation returns an Alert object representing the newly created alert. The returned fields include the alert's unique identifier, query string, configured actions, enabled status, and any error messages from the most recent execution. Use the returned identifier to reference the alert in subsequent updateAlert(), enableLegacyAlert(), disableLegacyAlert(), or deleteLegacyAlert() calls.

Table: Alert Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsStringyes Long-Term List of identifiers for actions to fire on query result.
actionsV2Actionyes Long-Term List of unique identifiers for actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term List of allowed actions. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the alert. See AssetCommitMetadata.
descriptionString  Long-Term Description of alert.
displayNameStringyes Long-Term Name of the alert.
enabledBooleanyes Long-Term Flag indicating whether the alert is enabled.
idStringyes Long-Term The identifier of the alert.
labelsStringyes Long-Term Labels attached to the alert.
lastErrorString  Long-Term Last error encountered while running the alert.
lastWarningsStringyes Long-Term Last warnings encountered while running the alert.
nameStringyes Long-Term The name of the alert.
packagePackageInstallation  Long-Term A package installation. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The id of the package that the alert was installed as part of. Stability: Long-term
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this alert Stability: Long-term
queryStartStringyes Long-Term Start of the relative time interval for the query. Stability: Long-term
queryStringStringyes Long-Term LogScale query to execute. Stability: Long-term
resourceStringyes Short-Term The resource identifier for the alert.
runAsUserUser  Long-Term Id of user which the alert is running as. Stability: Long-term
throttleFieldString  Long-Term Field to throttle on. Stability: Long-term
throttleTimeMillisLongyes Long-Term Throttle time in milliseconds. Stability: Long-term
timeOfLastTriggerLong  Long-Term Unix timestamp for when the alert was last triggered. Stability: Long-term
yamlTemplateStringyes Long-Term A YAML formatted string that describes the alert. Stability: Long-term