createEventForwardingRule()

API Stability	`Long-Term`

The createEventForwardingRule() GraphQL mutation field is used to create an event forwarding rule on a repository and return it.

For more information on event forwarding rules, see the Event Forwarding Rules documentation page. You may also want to look at the Event Forwarding and the Events page for related information.

Syntax

Below is the syntax for the createEventForwardingRule() mutation field:

graphql

createEventForwardingRule(
      input: CreateEventForwardingRule!
   ): EventForwardingRule!

Below is an example of how this mutation field might be used:

Show:

graphql

mutation {
  createEventForwardingRule(input:
      { repoName: "humio",
        queryString: "@host=localhost",
        eventForwarderId: "RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K",
        languageVersion: legacy
      } )
  { id }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createEventForwardingRule(input: ^
      { repoName: \"humio\", ^
        queryString: \"@host=localhost\", ^
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\", ^
        languageVersion: legacy ^
      } ) ^
  { id } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "createEventForwardingRule": {
      "id": "CiTUcuRYTtZIRfzqbhyBzn9O6HRehy9R"
    }
  }
}

Given Datatypes

For createEventForwardingRule, there are a few parameters. Below is a list of them along with descriptions of each:

Table: CreateEventForwardingRule

Parameter	Type	Required	Default	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 28, 2025
`eventForwarderId`	string	yes		`Long-Term`	The id of the event forwarder.
`languageVersion`	`LanguageVersionEnum`	yes	legacy	`Long-Term`	The version of Human language to use: legacy, xdr1, or xdrdetects1. If non-null, it will be a version known by the current LogScale installation. See `LanguageVersionEnum`.
`queryString`	string	yes		`Long-Term`	The query string for filtering and mapping the events to forward.
`repoName`	string	yes		`Long-Term`	The name of the repository of the event forwarding rule.

Returned Datatypes

The returned datatype EventForwardingRule has several parameters. Below is a list of them along with descriptions of each:

Table: EventForwardingRule

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 26, 2025
`createdAt`	long		`Long-Term`	The UNIX timestamp of when the event forwarder was created.
`eventForwarderId`	string	yes	`Long-Term`	The unique identifier of the event forwarder.
`id`	string	yes	`Long-Term`	The unique identifier for the event forwarding rule.
`languageVersion`	`LanguageVersion`	yes	`Long-Term`	The version of the LogScale query language to use. See `LanguageVersion`.
`queryString`	string	yes	`Long-Term`	The query string for filtering and mapping the events to forward.

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes