createAwsS3SqsIngestFeed()

API Stability	`Long-Term`

The createAwsS3SqsIngestFeed() GraphQL mutation is used to create an ingest feed that uses Amazon's AWS S3 and SQS.

This is an experimental feature, not ready for production.

Syntax

Below is the syntax for the createAwsS3SqsIngestFeed() mutation field:

graphql

createAwsS3SqsIngestFeed(
     input: CreateAwsS3SqsIngestFeed!
   ): IngestFeed!

The input contains data for creating an ingest feed that uses AWS S3 and SQS. Below is an example of how this mutation field might be used:

Show:

graphql

mutation {
  createAwsS3SqsIngestFeed(input:
        { repositoryName: "humio", 
          name: "main-server",
          parser: "audit-log",
          authentication: {kind: IamRole, roleArn: "arn:aws_iam::1234:user/admin"},
          sqsUrl: "http://address.com/something",
          region: "us-west-2",
          enabled: true,
          preprocessing: {kind: SplitAwsRecords},
          compression: Auto
        } )
  {name, enabled }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createAwsS3SqsIngestFeed(input:
        { repositoryName: \"humio\", 
          name: \"main-server\",
          parser: \"audit-log\",
          authentication: {kind: IamRole, roleArn: \"arn:aws_iam::1234:user/admin\"},
          sqsUrl: \"http://address.com/something\",
          region: \"us-west-2\",
          enabled: true,
          preprocessing: {kind: SplitAwsRecords},
          compression: Auto
        } )
  {name, enabled }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createAwsS3SqsIngestFeed(input:
        { repositoryName: \"humio\", 
          name: \"main-server\",
          parser: \"audit-log\",
          authentication: {kind: IamRole, roleArn: \"arn:aws_iam::1234:user/admin\"},
          sqsUrl: \"http://address.com/something\",
          region: \"us-west-2\",
          enabled: true,
          preprocessing: {kind: SplitAwsRecords},
          compression: Auto
        } )
  {name, enabled }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createAwsS3SqsIngestFeed(input: ^
        { repositoryName: \"humio\",  ^
          name: \"main-server\", ^
          parser: \"audit-log\", ^
          authentication: {kind: IamRole, roleArn: \"arn:aws_iam::1234:user/admin\"}, ^
          sqsUrl: \"http://address.com/something\", ^
          region: \"us-west-2\", ^
          enabled: true, ^
          preprocessing: {kind: SplitAwsRecords}, ^
          compression: Auto ^
        } ) ^
  {name, enabled } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createAwsS3SqsIngestFeed(input:
        { repositoryName: \"humio\", 
          name: \"main-server\",
          parser: \"audit-log\",
          authentication: {kind: IamRole, roleArn: \"arn:aws_iam::1234:user/admin\"},
          sqsUrl: \"http://address.com/something\",
          region: \"us-west-2\",
          enabled: true,
          preprocessing: {kind: SplitAwsRecords},
          compression: Auto
        } )
  {name, enabled }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  createAwsS3SqsIngestFeed(input:
        { repositoryName: \"humio\", 
          name: \"main-server\",
          parser: \"audit-log\",
          authentication: {kind: IamRole, roleArn: \"arn:aws_iam::1234:user/admin\"},
          sqsUrl: \"http://address.com/something\",
          region: \"us-west-2\",
          enabled: true,
          preprocessing: {kind: SplitAwsRecords},
          compression: Auto
        } )
  {name, enabled }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createAwsS3SqsIngestFeed(input:
        { repositoryName: \"humio\", 
          name: \"main-server\",
          parser: \"audit-log\",
          authentication: {kind: IamRole, roleArn: \"arn:aws_iam::1234:user/admin\"},
          sqsUrl: \"http://address.com/something\",
          region: \"us-west-2\",
          enabled: true,
          preprocessing: {kind: SplitAwsRecords},
          compression: Auto
        } )
  {name, enabled }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createAwsS3SqsIngestFeed(input:
        { repositoryName: \"humio\", 
          name: \"main-server\",
          parser: \"audit-log\",
          authentication: {kind: IamRole, roleArn: \"arn:aws_iam::1234:user/admin\"},
          sqsUrl: \"http://address.com/something\",
          region: \"us-west-2\",
          enabled: true,
          preprocessing: {kind: SplitAwsRecords},
          compression: Auto
        } )
  {name, enabled }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Given Datatypes

For createAwsS3SqsIngestFeed, there are several parameters. Below is a list of them:

Table: CreateAwsS3SqsIngestFeed

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 17, 2024
`authentication`	`IngestFeedAwsAuthenticationInput`	yes	`Long-Term`	How to authenticate to AWS. See `IngestFeedAwsAuthenticationInput`.
`compression`	`IngestFeedCompression`	yes	`Long-Term`	Compression scheme of the file. See `IngestFeedCompression`.
`description`	`UpdateIngestFeedDescription`		`Long-Term`	The description of the ingest feed. See `UpdateIngestFeedDescription`.
`enabled`	boolean	yes	`Long-Term`	Whether ingest from the ingest feed is enabled.
`name`	string	yes	`Long-Term`	The name of the ingest feed.
`parser`	string	yes	`Long-Term`	The unique identifier or name of the parser that should be used to parse the ingest feed. Parsers in packages can be referred to as `packagescope/packagename:parsername`.
`preprocessing`	`IngestFeedPreprocessingInput`	yes	`Long-Term`	The preprocessing to apply to an ingest feed before parsing. See `IngestFeedPreprocessingInput`.
`region`	string	yes	`Long-Term`	The AWS region in which to connect.
`repositoryName`	`RepoOrViewName`	yes	`Long-Term`	Name of the repository of the ingest feed. `RepoOrViewName` is a scalar.
`sqsUrl`	string	yes	`Long-Term`	The AWS SQS queue URL.

Returned Datatypes

The IngestFeed return datatype has many parameters. Below is a list of them:

Table: IngestFeed

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 26, 2025
`createdAt`	long	yes	`Long-Term`	Unix timestamp for when this feed was created.
`description`	string		`Long-Term`	A description of the ingest feed.
`enabled`	boolean	yes	`Long-Term`	Whether the ingest from the ingest feed is enabled.
`executionInfo`	`IngestFeedExecutionInfo`		`Long-Term`	Details about how the ingest feed is running. See `IngestFeedExecutionInfo`.
`id`	string	yes	`Long-Term`	The unique identifier of the ingest feed.
`name`	string	yes	`Long-Term`	The name of the ingest feed.
`parser`	`parser`		`Long-Term`	The parser used to parse the ingest feed. See `parser`.
`source`	`IngestFeedSource`	yes	`Long-Term`	The source from which the ingest feed will ingest. See `IngestFeedS3SqsSource`.

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes