createAlertFromTemplate()

API Stability LongTerm

The createAlertFromTemplate() GraphQL mutation may be used to create an alert from yaml template.

This mutation is no longer used internally and will be removed in a future release. Contact support if you are using this and cannot use createAlert() as a replacement.

For more information on creating alerts, see the Creating Alerts documentation page. You may also want to look at the Alerts and Message Templates and Variables pages for related information.

Syntax

Below is the syntax for the createAlertFromTemplate() mutation field:

graphql

createAlertFromTemplate(
      input: CreateAlertFromTemplateInput!
   ): Alert!

Below is an example of how this mutation field might be used:

Raw

graphql

mutation {
  createAlertFromTemplate(input:
        {viewName: "humio", 
         name: "myAlert",
         yamlTemplate: "name: my-alert..."
        } )
  {name, enabled }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createAlertFromTemplate(input:
        {viewName: \"humio\", 
         name: \"myAlert\",
         yamlTemplate: \"name: my-alert...\"
        } )
  {name, enabled }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createAlertFromTemplate(input:
        {viewName: \"humio\", 
         name: \"myAlert\",
         yamlTemplate: \"name: my-alert...\"
        } )
  {name, enabled }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createAlertFromTemplate(input: ^
        {viewName: \"humio\",  ^
         name: \"myAlert\", ^
         yamlTemplate: \"name: my-alert...\" ^
        } ) ^
  {name, enabled } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createAlertFromTemplate(input:
        {viewName: \"humio\", 
         name: \"myAlert\",
         yamlTemplate: \"name: my-alert...\"
        } )
  {name, enabled }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  createAlertFromTemplate(input:
        {viewName: \"humio\", 
         name: \"myAlert\",
         yamlTemplate: \"name: my-alert...\"
        } )
  {name, enabled }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createAlertFromTemplate(input:
        {viewName: \"humio\", 
         name: \"myAlert\",
         yamlTemplate: \"name: my-alert...\"
        } )
  {name, enabled }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createAlertFromTemplate(input:
        {viewName: \"humio\", 
         name: \"myAlert\",
         yamlTemplate: \"name: my-alert...\"
        } )
  {name, enabled }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "createAlertFromTemplate": {
      "name": "myAlert",
      "enabled": true
    }
  }
}

Given Datatypes

For CreateAlertFromTemplateInput, there are a few parameters. Below is a list of them:

Table: CreateAlertFromTemplateInput

Parameter	Type	Required	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 17, 2024
`name`	string	yes	Name of the alert.
`viewName`	`RepoOrViewName`	yes	Name of the view of the alert. RepoOrViewName is a scalar.
`yamlTemplate`	`yaml`	yes	YAML specification of the alert.

Returned Datatypes

Alert has its own parameters. Below is a list of them along with a description of each:

Table: Alert

Parameter	Type	Required	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 23, 2024
`actions`	string	yes	List of identifiers for actions to fire on query result.
`actionsV2`	[`Action`]	yes	List of unique identifiers for actions to fire on query result. See `Action`.
`allowedActions`	[`AssetAction`]	yes	List of allowed actions. The is a preview; it may be changed. See `AssetAction`.
`assetType`	`AssetType`	yes	The type of asset from an enumerated list. See `AssetType`. This parameter has been deprecated and will be removed in version 1.136 of LogScale.
`description`	string		Description of alert.
`displayName`	string	yes	Name of the alert.
`enabled`	boolean	yes	Flag indicating whether the alert is enabled.
`id`	string	yes	The identifier of the alert.
`isStarred`	boolean	yes	Whether the calling user has starred the alert. This has been deprecated and is no longer in use and has no effect. It will be removed in version 1.213.
`labels`	[string]	yes	Labels attached to the alert.
`lastError`	string		Last error encountered while running the alert.
`lastWarnings`	[string]	yes	Last warnings encountered while running the alert.
`name`	string	yes	The name of the alert.
`package`	`PackageInstallation`		A package installation. See `PackageInstallation`.
`packageId`	`VersionedPackageSpecifier`		The unique identifier of the package installed, if one was used. `VersionedPackageSpecifier` is a scalar.
`queryOwnership`	`QueryOwnership`	yes	Ownership of the query run by the alert. See `QueryOwnership`.
`queryStart`	string	yes	Start of the relative time interval for the query.
`queryString`	string	yes	LogScale query to execute.
`runAsUser`	`User`		Identifier of user by which the alert is run. See `User`.
`throttleField`	string		Field on which to throttle alert.
`throttleTimeMillis`	long	yes	Throttle time in milliseconds.
`timeOfLastTrigger`	long		UNIX timestamp for when the alert was last triggered.
`yamlTemplate`	string	yes	A YAML formatted string that describes the alert.

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes