🔒Security Requirements and Controls
🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createFilterAlert() mutation creates a filter alert in a LogScale repository or view. A filter alert runs a query against incoming log data and triggers configured actions when matching events arrive. Use this mutation to programmatically define real-time alerting without manual UI configuration.

Syntax

graphql
createFilterAlert(
      input: CreateFilterAlert!
   ): FilterAlert!

The mutation accepts a single required input argument of type CreateFilterAlert!. The input specifies the view name, query string, and associated actions. The mutation returns a non-nullable FilterAlert object representing the created alert.

The Input Parameters section describes all fields accepted by CreateFilterAlert.

Example

Raw
graphql
mutation {
  createFilterAlert(input:
      { viewName: "humio",
        name: "rose-alert",
        queryString: "@host=localhost",
        actionIdsOrNames: "email-admin",
        queryOwnershipType: Organization
      } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createFilterAlert(input:
      { viewName: \"humio\",
        name: \"rose-alert\",
        queryString: \"@host=localhost\",
        actionIdsOrNames: \"email-admin\",
        queryOwnershipType: Organization
      } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createFilterAlert(input:
      { viewName: \"humio\",
        name: \"rose-alert\",
        queryString: \"@host=localhost\",
        actionIdsOrNames: \"email-admin\",
        queryOwnershipType: Organization
      } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createFilterAlert(input: ^
      { viewName: \"humio\", ^
        name: \"rose-alert\", ^
        queryString: \"@host=localhost\", ^
        actionIdsOrNames: \"email-admin\", ^
        queryOwnershipType: Organization ^
      } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createFilterAlert(input:
      { viewName: \"humio\",
        name: \"rose-alert\",
        queryString: \"@host=localhost\",
        actionIdsOrNames: \"email-admin\",
        queryOwnershipType: Organization
      } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createFilterAlert(input:
      { viewName: \"humio\",
        name: \"rose-alert\",
        queryString: \"@host=localhost\",
        actionIdsOrNames: \"email-admin\",
        queryOwnershipType: Organization
      } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createFilterAlert(input:
      { viewName: \"humio\",
        name: \"rose-alert\",
        queryString: \"@host=localhost\",
        actionIdsOrNames: \"email-admin\",
        queryOwnershipType: Organization
      } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createFilterAlert(input:
      { viewName: \"humio\",
        name: \"rose-alert\",
        queryString: \"@host=localhost\",
        actionIdsOrNames: \"email-admin\",
        queryOwnershipType: Organization
      } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createFilterAlert": {
      "id": "abc123"
    }
  }
}

Input Parameters

Provide the name of the view, the query string to run against incoming data, and the actions to trigger when the alert fires. The following table describes each field in the CreateFilterAlert input type:

Table: CreateFilterAlert Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionIdsOrNamesStringyes Long-Term List of unique identifiers or names for actions to fire on query result. Actions in packages can be referred to as packagescope/packagename:actionname.
descriptionString  Long-Term Description of the filter alert.
enabledBoolean  Long-Term Flag indicating whether the filter alert is enabled.
labelsStringyes Long-Term Labels attached to the filter alert.
nameStringyes Long-Term Name of the filter alert.
queryOwnershipTypeQueryOwnershipTypeyes Long-Term Ownership of the query run by this filter alert. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStringStringyes Long-Term LogScale query to execute.
runAsUserIdString  Long-Term The filter alert will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the filter alert will run with the permissions of the calling user. It requires the ChangeTriggersToRunAsOtherUsers permission to set this field to a user id different from the calling user.
throttleFieldString  Deprecateddeprecated in 1.282The field on which to throttle. This can be set only if throttleTimeSeconds is set. Filter alerts now support multiple throttle fields. This field will be removed at the earliest in version 1.279. Use instead the throttleFields field.
throttleFieldsStringyes Long-Term The fields on which to throttle. This can be set only if throttleTimeSeconds is set. Ten throttle fields can be added at most.
throttleTimeSecondsLong  Long-Term Throttle time in seconds.
viewNameRepoOrViewNameyes Long-Term Name of the view of the filter alert. RepoOrViewName is a scalar.

Returned Values

The mutation returns a FilterAlert object. You can retrieve the alert ID, query string, enabled state, and associated actions to confirm the created configuration. The following table describes the available fields:

Table: FilterAlert Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsActionyes Long-Term List of unique identifiers for actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term List of actions allowed on which to filter query results. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the filter alert. See AssetCommitMetadata.
descriptionString  Long-Term Description of the filter alert.
enabledBooleanyes Long-Term Whether the filter alert is enabled.
idStringyes Long-Term The unique identifier of the filter alert.
labelsStringyes Long-Term Labels attached to the filter alert.
lastErrorString  Long-Term Last error encountered while running the filter alert.
lastErrorTimeLong  Long-Term Unix timestamp for last error.
lastSuccessfulPollLong  Long-Term Unix timestamp for last successful poll of the filter alert query. If this is not quite recent, then the alert might be having problems.
lastTriggeredLong  Long-Term Unix timestamp for last execution of trigger.
lastWarningsStringyes Long-Term Last warnings encountered while running the filter alert.
modifiedInfoModifiedInfoyes Long-Term User or token used to modify the asset. See ModifiedInfo. This is a preview and subject to change.
nameStringyes Long-Term The name of the filter alert.
packagePackageInstallation  Long-Term The package of which the alert was installed. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The unique identifier of the package of which the alert was installed. VersionedPackageSpecifier is a scalar.
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this alert. See QueryOwnership.
queryStringStringyes Long-Term The LogScale query to execute.
resourceStringyes Short-Term The resource identifier for this filter alert.
throttleFieldString  Deprecateddeprecated in 1.282The field on which to throttle. This can be set only if throttleTimeSeconds is set. Filter alerts now support multiple throttle fields. This field will be removed at the earliest in version 1.279. Use instead the throttleFields field.
throttleFieldsStringyes Long-Term The fields on which to throttle. This can be set only if throttleTimeSeconds is set.
throttleTimeSecondsLong  Long-Term The throttle time in seconds.
yamlTemplateYAMLyes Long-Term The yaml specification of the filter alert. YAML is a scalar.