createEventForwardingRule()

Summary

The createEventForwardingRule() GraphQL mutation field is used to create an event forwarding rule on a repository and return it.

To update an event forwarding rule, you can use the updateEventForwardingRule() mutation. You can use deleteEventForwardingRule() to delete one.

Hide Query Example

Show Event Forwarding Rules Query

To get a list of event forwarding rules for a repository, you can use the repository() query:

graphql

query {
     repository( name: "humio" )
      { eventForwardingRules 
           { id, eventForwarderId, queryString } 
        } 
   }

For more information on event forwarding rules, see the Event Forwarding Rules documentation page. You may also want to look at the Event Forwarding and the Events page for related information.

API Stability Long-Term

Syntax

graphql

createEventForwardingRule(
      input: CreateEventForwardingRule!
   ): EventForwardingRule!

For the input, you'll have to give the name of the repository, the query for filtering and mapping events. See the Input Parameters section for details.

For the results, as confirmation, you can get the unique identifier for the event forwarding rule that you can use with other mutations and queries.

Example

Raw

graphql

mutation {
  createEventForwardingRule(input:
      { repoName: "humio",
        queryString: "@host=localhost",
        eventForwarderId: "RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K",
        languageVersion: legacy
      } )
  { id }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createEventForwardingRule(input: ^
      { repoName: \"humio\", ^
        queryString: \"@host=localhost\", ^
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\", ^
        languageVersion: legacy ^
      } ) ^
  { id } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createEventForwardingRule(input:
      { repoName: \"humio\",
        queryString: \"@host=localhost\",
        eventForwarderId: \"RhLcbl3OJcjfIOmfPyLxVUpR9I2Fma6K\",
        languageVersion: legacy
      } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "createEventForwardingRule": {
      "id": "abc123"
    }
  }
}

Input Parameters

For the input, you would provide the name of the repository associated with the event forwarding rule, the query for filtering and mapping events. These are listed and explained in the table below:

Table: CreateEventForwardingRule Input Datatype

Parameter	Type	Required	Default	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Mar 28, 2025
eventForwarderId	string	yes		`Long-Term`	The id of the event forwarder.
languageVersion	LanguageVersionEnum	yes	legacy	`Long-Term`	The version of Human language to use: legacy, xdr1, or xdrdetects1. If non-null, it will be a version known by the current LogScale installation. See LanguageVersionEnum.
queryString	string	yes		`Long-Term`	The query string for filtering and mapping the events to forward.
repoName	string	yes		`Long-Term`	The name of the repository of the event forwarding rule.

Returned Values

For the results, you can get the unique identifier for the event forwarding rule, the query string for filtering and mapping events to forward, and other details.

Table: EventForwardingRule Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Mar 26, 2025
createdAt	long		`Long-Term`	The UNIX timestamp of when the event forwarder was created.
eventForwarderId	string	yes	`Long-Term`	The unique identifier of the event forwarder.
id	string	yes	`Long-Term`	The unique identifier for the event forwarding rule.
languageVersion	LanguageVersion	yes	`Long-Term`	The version of the LogScale query language to use. See LanguageVersion.
queryString	string	yes	`Long-Term`	The query string for filtering and mapping the events to forward.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes