🎯API Stability
Short-TermThis API may change in future versions. Use with caution in production environments.

Summary

Cross-organization view connections let you federate data from repositories owned by one LogScale organization into a view in a separate organization. This is useful in multi-tenant deployments where distinct organizations own their own data but require a unified view for cross-team or cross-environment analysis.

The createCrossOrgView() mutation creates a new view that aggregates data from repositories across multiple organizations. Provide the view name and an initial list of cross-organization repository connections. Each connection specifies the source organization ID, the repository name in that organization, and a filter expression that controls which events are visible in the view. To add connections to an existing cross-organization view, use addCrossOrgViewConnections() instead.

This mutation is in Preview and carries Short-Term API stability. The signature may change in future releases.

Syntax

graphql
createCrossOrgView(
      input: CreateCrossOrgViewInput!
   ): View!

The required input argument takes a CreateCrossOrgViewInput object. Provide the name for the new view and an initial list of cross-organization repository connections. The mutation returns a non-null View object representing the newly created view. See the Input Parameters section for field details.

Example

Raw
graphql
mutation {
  createCrossOrgView(input:
        { name: "our-multi-org-view",
          connections: [ {repoName: "humio", filter: "#vhost", organizationId: "1"},
                         {repoName: "humio", filter: "#vhost", organizationId: "2"} ],
        } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createCrossOrgView(input:
        { name: \"our-multi-org-view\",
          connections: [ {repoName: \"humio\", filter: \"#vhost\", organizationId: \"1\"},
                         {repoName: \"humio\", filter: \"#vhost\", organizationId: \"2\"} ],
        } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createCrossOrgView(input:
        { name: \"our-multi-org-view\",
          connections: [ {repoName: \"humio\", filter: \"#vhost\", organizationId: \"1\"},
                         {repoName: \"humio\", filter: \"#vhost\", organizationId: \"2\"} ],
        } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createCrossOrgView(input: ^
        { name: \"our-multi-org-view\", ^
          connections: [ {repoName: \"humio\", filter: \"#vhost\", organizationId: \"1\"}, ^
                         {repoName: \"humio\", filter: \"#vhost\", organizationId: \"2\"} ], ^
        } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createCrossOrgView(input:
        { name: \"our-multi-org-view\",
          connections: [ {repoName: \"humio\", filter: \"#vhost\", organizationId: \"1\"},
                         {repoName: \"humio\", filter: \"#vhost\", organizationId: \"2\"} ],
        } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createCrossOrgView(input:
        { name: \"our-multi-org-view\",
          connections: [ {repoName: \"humio\", filter: \"#vhost\", organizationId: \"1\"},
                         {repoName: \"humio\", filter: \"#vhost\", organizationId: \"2\"} ],
        } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createCrossOrgView(input:
        { name: \"our-multi-org-view\",
          connections: [ {repoName: \"humio\", filter: \"#vhost\", organizationId: \"1\"},
                         {repoName: \"humio\", filter: \"#vhost\", organizationId: \"2\"} ],
        } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createCrossOrgView(input:
        { name: \"our-multi-org-view\",
          connections: [ {repoName: \"humio\", filter: \"#vhost\", organizationId: \"1\"},
                         {repoName: \"humio\", filter: \"#vhost\", organizationId: \"2\"} ],
        } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Input Parameters

Provide the name of the new view and an initial list of cross-organization repository connections. Each connection in the connections list requires three fields: the name of the repository in the source organization (repoName), the unique identifier of the source organization (organizationId), and a LogScale query filter expression (filter) that restricts which events from that repository are visible in the view. Pass an empty string as the filter to include all events. The organizationId is the system identifier of the source organization, not its display name; obtain it from your LogScale administrator or from the organization settings API.

Table: CreateCrossOrgViewInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
connectionsCrossOrganizationViewConnectionInputModelyes Preview The name of the repository, the organizations, and other data for creating the new view. See CrossOrganizationViewConnectionInputModel.
nameStringyes Preview The name of the view to create.

The connections field takes a list of CrossOrganizationViewConnectionInputModel objects. The filter field in each object accepts any valid LogScale query expression and limits event visibility to matching events only. The following table lists the fields of the nested input type:

Table: CrossOrganizationViewConnectionInputModel Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
filterStringyes Preview The filter to apply to the cross organization view connection.
organizationIdStringyes Preview The unique identifier of the organization.
repoNameStringyes Preview The name of the repository or view.

Returned Values

The mutation returns a View object representing the newly created cross-organization view. Include crossOrgConnections in the return fields to confirm which connections were created. Each entry in crossOrgConnections exposes an id that uniquely identifies the connection, a name (the repository name in the source organization), and an orgId identifying the source organization. The following table lists all available fields:

Table: View Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
action(id: string): Actionmultipleyes Long-Term A saved action. The id is the unique identifier of the action. See Action.
actions(actionIds: [string]): [Action]multipleyes Long-Term A list of saved actions. See Action.
aggregateAlert(id: string): AggregateAlertmultipleyes Long-Term A saved aggregate alert. See AggregateAlert.
aggregateAlerts[AggregateAlert]yes Long-Term Saved aggregate alerts. See AggregateAlert.
alert(id: string): Alertmultipleyes Long-Term A saved alert. See Alert.
alerts[Alert]yes Long-Term Saved alerts. See Alert.
allowedViewActions[ViewAction]yes Long-Term Returns all actions the user is allowed to perform on the view. See ViewAction.
automaticSearchbooleanyes Long-Term Whether the search is executed automatically.
availablePackages(filter: string, tags: [PackageTag], categories: [string]): [PackageRegistrySearchResultItem]multiple  Long-Term Returns a list of available packages that can be installed. PackageTag is a scalar. See PackageRegistrySearchResultItem.
checkClusterConnections[ClusterConnectionStatus]  Short-Term Check all of this search domain's cluster connections. This is a preview and subject to change. See ClusterConnectionStatus.
clusterConnection(id: string): ClusterConnectionmultiple  Short-Term A specific cluster connection. See ClusterConnection.
clusterConnections[ClusterConnection]  Short-Term The search domain's cluster connections. See ClusterConnection.
connections[ViewConnection]yes Long-Term The connections for the view. This is a preview and subject to change. See ViewConnection.
crossOrgConnections[CrossOrgViewConnection]yes Short-Term The connections for the cross organization connections (see CrossOrgViewConnection Table).
dashboard(id: string): Dashboardmultipleyes Long-Term A saved dashboard. See Dashboard.
dashboards[Dashboard]yes Long-Term Saved dashboards. See Dashboard.
defaultQuerySavedQuery  Long-Term The default saved query. See SavedQuery.
deletedDatelong  Long-Term The point in time the search domain was marked for deletion.
descriptionstring  Long-Term A description of the view.
fileFieldSearch(fileName: string, fieldName: string, prefixFilter: string, valueFilters: [FileFieldFilterType], fieldsToInclude: [string], maxEntries: integer): [DictionaryEntryType]multipleyes Long-Term The fields to search in a given file. See FileFieldFilterType and DictionaryEntryType.
files[File]yes Long-Term A list of files used. See File.
filterAlert(id: string): FilterAlertmultipleyes Long-Term A saved filter alert. See FilterAlert.
filterAlerts[FilterAlert]yes Long-Term Saved filter alerts. See FilterAlert.
groups[Group]yes Long-Term Groups with assigned roles. See Group.
hasPackageInstalled(packageId: VersionedPackageSpecifier): booleanmultipleyes Long-Term Determines whether package has been installed. VersionedPackageSpecifier is a scalar.
idstringyes Long-Term The unique identifier of the view.
installedPackages[PackageInstallation]yes Long-Term List packages installed on a specific view or repository See PackageInstallation.
interactions[ViewInteraction]yes Long-Term All interactions defined for the view. See ViewInteraction.
isActionAllowed(action: ViewAction): booleanmultipleyes Long-Term Determines whether current user is allowed to perform the given action on the view. See ViewAction.
isFederatedbooleanyes Preview Whether the view is Federated. This is a preview and subject to change.
isStarredbooleanyes Long-Term Whether the view should be marked with a star.
nameRepoOrViewNameyes Long-Term The name of the repository or view. RepoOrViewName is a scalar.
packageV2(packageId: VersionedPackageSpecifier): Package2multiple  Long-Term Returns a specific version of a package given a package version. VersionedPackageSpecifier is a scalar. See Package2.
packageVersions(packageId: UnversionedPackageSpecifier): [RegistryPackageVersionInfo]multiple  Long-Term The available versions of a package. UnversionedPackageSpecifier is a scalar. See RegistryPackageVersionInfo.
permanentlyDeletedAtlong  Long-Term The point in time the search domain will not be restorable anymore.
persistedAggregations(sortBy: PersistedAggregationSortBy, orderBy: OrderBy, skip: integer, limit: integer): PersistedAggregationResultSetmultiple  Preview 

List of persisted aggregations for view, with sorting and pagination. See PersistedAggregationSortBy.

recentQueriesV2[RecentQuery]yes Long-Term List of recent queries. See RecentQuery.
redirectQueryAssetLookupToSearchDomain  Preview The redirected query asset lookup view used for asset resolution when set. Assets like saved queries and lookup files will be resolved from this view instead of the current view. See SearchDomain.
reposExcludedInSearchLimit[string]yes Long-Term Repositories not part of the search limitation.
resourcestringyes Short-Term The resource identifier for the search domain.
savedQueries[SavedQuery]yes Long-Term A list of saved queries. See SavedQuery.
savedQuery(id: string): SavedQuerymultipleyes Long-Term A saved query. See SavedQuery.
scheduledReport(id: string): ScheduledReportmultiple  Long-Term Saved scheduled report. See ScheduledReport.
scheduledReports[ScheduledReport]yes Long-Term Saved scheduled reports See ScheduledReport.
scheduledSearch(id: string): ScheduledSearchmultipleyes Long-Term A saved scheduled search. See ScheduledSearch.
scheduledSearches[ScheduledSearch]yes Long-Term Saved scheduled searches. See ScheduledSearch.
searchLimitedMslong  Long-Term Search limit in milliseconds, by which searches are limited.
starredFields[string]yes Long-Term Fields marked with a star.
tags[string]yes Long-Term All tags from all datasources.
users[User]yes Long-Term Users who have access. See User.
usersAndGroups(search: string, skip: integer, limit: integer): UsersAndGroupsSearchResultSetmultiple  Long-Term Users or groups who have access. See UsersAndGroupsSearchResultSet.
usersV2(search: string, permissionFilter: Permission, skip: integer, limit: integer): Usersmultiple  Short-Term Search users with a given permission. See Users.
viewerQueryPrefixstringyes Long-Term The query prefix prepended to each search in the domain.