The createLookupFileFromPackageTemplate() GraphQL mutation field may be used to create a lookup file from a package lookup file template.

For more information on lookup files, see the Lookup API reference page. You may also want to look at the Package Management documentation page for related information.

API Stability Long-Term
Security Requirement & Control CreateFiles API permission

Syntax

graphql
createLookupFileFromPackageTemplate(
      viewName: RepoOrViewName!
      packageId: VersionedPackageSpecifier!
      lookupFileTemplateName: string!
      overrideName: string
   ): FileNameAndPath!

For the input datatype, you'll have to give the name of view or repository, and the name of the lookup file template contained in the package. You'll also have to give the package name, followed by an ampersand and then the version number (see Example below).

For the results, you can get the absolute or relative path for the lookup file created and its file name. See the Returned Datatype section for more.

Example

Raw
graphql
mutation {
  createLookupFileFromPackageTemplate(
      viewName: "humio",
      packageId: "linux/guards@1.2.0",
      lookupFileTemplateName: "lookups.csv",
      overrideName: "my-lookup.csv",
    )
  { name, path }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createLookupFileFromPackageTemplate( ^
      viewName: \"humio\", ^
      packageId: \"linux/guards@1.2.0\", ^
      lookupFileTemplateName: \"lookups.csv\", ^
      overrideName: \"my-lookup.csv\", ^
    ) ^
  { name, path } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createLookupFileFromPackageTemplate": {
      "name": "my-lookup.csv",
      "path": null
    }
  }
}

Given Datatype

For the input datatype, you'll have to give the name of view or repository, and the name of the lookup file template contained in the package. You'll also have to give the package name, followed by an ampersand and then the version number (see Example above).

Table: Input Using Standard Datatypes

Parameter Type Required Default Description
lookupFileTemplateName string yes   The filename of the lookup file template in the package.
overrideName string     The name of the new lookup file to create.
packageId VersionedPackageSpecifier yes   The identifier of the package containing the lookup file template to use. VersionedPackageSpecifier is a scalar value.
viewName RepoOrViewName yes   The name of the view or repository. RepoOrViewName is a scalar.

Returned Datatype

For this returned datatype, you can request the absolute or relative path for the lookup file created and its file name. See the table below for much more details:

Table: FileNameAndPath

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 25, 2024
namestringyes Long-TermThe name of the file.
pathstring  Long-TermPaths for files can be one of two types: absolute or relative. Absolute paths start with a slash, and relative paths start without a slash, like Unix paths. Every repository or view in the system is considered a "folder" in its own right, meaning that every relative path is relative to the current view. An absolute path points to something that can be addressed from any view, and a relative path points to a file located inside the view. If there is no path, it means the file is located at your current location.