🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

When an alert or scheduled search fires, a repository action can forward matching event data to another LogScale repository for further analysis, archiving, or cross-team visibility. The createHumioRepoAction() mutation creates such an action in a specified repository. The action authenticates writes to the destination repository using an ingest token. Create the action before attaching it to an alert or scheduled search.

Syntax

graphql
createHumioRepoAction(
      input: CreateHumioRepoAction!
   ): HumioRepoAction!

The mutation takes a single required input argument of type CreateHumioRepoAction. Provide the name of the owning repository or view in viewName, a unique action name in name, and an ingest token for the destination repository in ingestToken. The labels argument is optional. The mutation returns a non-null HumioRepoAction object. See the Input Parameters section for argument details and the Returned Values section for the fields available on the returned object.

Example

Raw
graphql
mutation {
  createHumioRepoAction(input:
       { viewName: "humio"
         name: "acting-up",
         ingestToken: "test-token" } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createHumioRepoAction(input:
       { viewName: \"humio\"
         name: \"acting-up\",
         ingestToken: \"test-token\" } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createHumioRepoAction(input:
       { viewName: \"humio\"
         name: \"acting-up\",
         ingestToken: \"test-token\" } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createHumioRepoAction(input: ^
       { viewName: \"humio\" ^
         name: \"acting-up\", ^
         ingestToken: \"test-token\" } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createHumioRepoAction(input:
       { viewName: \"humio\"
         name: \"acting-up\",
         ingestToken: \"test-token\" } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createHumioRepoAction(input:
       { viewName: \"humio\"
         name: \"acting-up\",
         ingestToken: \"test-token\" } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createHumioRepoAction(input:
       { viewName: \"humio\"
         name: \"acting-up\",
         ingestToken: \"test-token\" } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createHumioRepoAction(input:
       { viewName: \"humio\"
         name: \"acting-up\",
         ingestToken: \"test-token\" } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createHumioRepoAction": {
      "id": "abc123"
    }
  }
}

Input Parameters

The viewName argument specifies the repository or view that owns the action. The name argument specifies the action name, which must be unique within the owning repository. The ingestToken argument provides the ingest token for the destination repository that receives the forwarded event data. The labels argument is optional and accepts a list of strings to categorize the action.

Table: CreateHumioRepoAction Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
ingestTokenStringyes Long-Term LogScale ingest token for the dataspace into which the action should ingest.
labelsStringyes   Labels to categorize the action.
nameStringyes Long-Term Name of the action.
viewNameStringyes Long-Term Name of the view of the action.

Returned Values

The mutation returns a non-null HumioRepoAction object representing the newly created action. Include id in the return fields to retrieve the action identifier for use with subsequent mutations such as updateHumioRepoAction() or deleteActionV2(). The returned object also includes the display name, ingest token, creation and modification metadata, and any associated labels.

Table: HumioRepoAction Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
allowedActions[AssetAction]yes Short-Term The allowed asset actions. This is a preview and may change. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the action. See AssetCommitMetadata.
displayNamestringyes Long-Term The display name of the action.
idstringyes Long-Term The unique identifier of the action.
ingestTokenstringyes Long-Term The LogScale ingest token for the dataspace into which the action should ingest.
isAllowedToRunbooleanyes Long-Term Whether this type of action is allowed.
labels[string]  Preview A list of actions, if any, associated with the action.
modifiedInfoAssetCommitMetadata  Long-Term Metadata related to the latest modification of the action. See AssetCommitMetadata.
namestringyes Long-Term The name of the action.
packagePackageInstallation  Long-Term The package, if any, of which the action is part (see PackageInstallation Table).
packageIdVersionedPackageSpecifier  Long-Term The unique identifier of the package used. VersionedPackageSpecifier is a scalar.
requiresOrganizationOwnedQueriesPermissionToEditbooleanyes Long-Term Whether this action is used by triggers, where the query is run by the organization. The OrganizationOwnedQueries permission is required to edit the action.
resourcestringyes Short-Term The resource identifier for the action.
yamlTemplateYAMLyes Long-Term A template that can be used to recreate the action. YAML is a scalar.