🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createFieldAliasSchema() mutation creates a field alias schema. A field alias schema defines a set of canonical field names and alias mappings that normalize field names across log sources with different naming conventions. If a schema with the same name already exists, this mutation overwrites it entirely, replacing all existing field definitions and alias mappings.

To create a schema from a YAML template instead, use createFieldAliasSchemaFromTemplate().

Syntax

graphql
createFieldAliasSchema(
      input: CreateFieldAliasSchemaInput!
   ): FieldAliasSchema!

The mutation takes a single required input argument of type CreateFieldAliasSchemaInput!. The input specifies the schema name, its field definitions, and optional alias mappings. The mutation returns a non-null FieldAliasSchema object representing the created or overwritten schema.

Example

Raw
graphql
mutation {
  createFieldAliasSchema(input:
      { name: "my-scheme",
        fields: [{name: "host"}],
        aliasMappings: [{name:"test", tags: [{name: "#kind", value: "#make"}],
                        aliases: [{source: "something", alias: "other"}]} ]
      } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createFieldAliasSchema(input:
      { name: \"my-scheme\",
        fields: [{name: \"host\"}],
        aliasMappings: [{name:\"test\", tags: [{name: \"#kind\", value: \"#make\"}],
                        aliases: [{source: \"something\", alias: \"other\"}]} ]
      } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createFieldAliasSchema(input:
      { name: \"my-scheme\",
        fields: [{name: \"host\"}],
        aliasMappings: [{name:\"test\", tags: [{name: \"#kind\", value: \"#make\"}],
                        aliases: [{source: \"something\", alias: \"other\"}]} ]
      } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createFieldAliasSchema(input: ^
      { name: \"my-scheme\", ^
        fields: [{name: \"host\"}], ^
        aliasMappings: [{name:\"test\", tags: [{name: \"#kind\", value: \"#make\"}], ^
                        aliases: [{source: \"something\", alias: \"other\"}]} ] ^
      } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createFieldAliasSchema(input:
      { name: \"my-scheme\",
        fields: [{name: \"host\"}],
        aliasMappings: [{name:\"test\", tags: [{name: \"#kind\", value: \"#make\"}],
                        aliases: [{source: \"something\", alias: \"other\"}]} ]
      } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createFieldAliasSchema(input:
      { name: \"my-scheme\",
        fields: [{name: \"host\"}],
        aliasMappings: [{name:\"test\", tags: [{name: \"#kind\", value: \"#make\"}],
                        aliases: [{source: \"something\", alias: \"other\"}]} ]
      } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createFieldAliasSchema(input:
      { name: \"my-scheme\",
        fields: [{name: \"host\"}],
        aliasMappings: [{name:\"test\", tags: [{name: \"#kind\", value: \"#make\"}],
                        aliases: [{source: \"something\", alias: \"other\"}]} ]
      } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createFieldAliasSchema(input:
      { name: \"my-scheme\",
        fields: [{name: \"host\"}],
        aliasMappings: [{name:\"test\", tags: [{name: \"#kind\", value: \"#make\"}],
                        aliases: [{source: \"something\", alias: \"other\"}]} ]
      } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createFieldAliasSchema": {
      "id": "abc123"
    }
  }
}

Input Parameters

The input argument takes a CreateFieldAliasSchemaInput object. The name field is the unique key for the schema — this mutation uses it to determine whether to create a new schema or overwrite an existing one. The fields list defines the canonical output field names. Each aliasMappings entry scopes the normalization to specific log sources identified by tags, and maps source field names to the canonical names defined in fields.

Table: CreateFieldAliasSchemaInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
aliasMappingsAliasMappingInputyes Long-Term The alias mapping inputs. See AliasMappingInput.
fieldsSchemaFieldInputyes Long-Term The schema field inputs. See SchemaFieldInput.
nameStringyes Long-Term The name of the field alias schema.

Returned Values

The mutation returns a non-null FieldAliasSchema object. The returned id field is the unique schema identifier required by updateFieldAliasSchema(), deleteFieldAliasSchema(), enableFieldAliasSchemaOnViews(), and related management mutations.

Table: FieldAliasSchema Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
fieldsSchemaFieldyes Long-Term The schema fields. See SchemaField.
idStringyes Long-Term The unique identifier of the field alias schema.
instancesAliasMappingyes Long-Term The instances used. See AliasMapping.
nameStringyes Long-Term The name of the schema.
versionStringyes Long-Term The version.
yamlTemplateYAMLyes Long-Term A yaml template. YAML is a scalar.