🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createLookupFileFromPackageTemplate() mutation creates a lookup file in a view or repository from a lookup file template defined in an installed package. Use this mutation when a package provides a lookup file template that you want to instantiate as a usable lookup file. To give the new file a custom name, supply the optional overrideName argument; otherwise, LogScale uses the template's default name.

Syntax

graphql
createLookupFileFromPackageTemplate(
      viewName: RepoOrViewName!,
      packageId: VersionedPackageSpecifier!,
      lookupFileTemplateName: String!,
      overrideName: String
   ): FileNameAndPath!

The required arguments identify the target view or repository (viewName), the installed package (packageId), and the template within that package (lookupFileTemplateName). The packageId value is a VersionedPackageSpecifier scalar in the form packageName@version, for example my-package@1.0.0. The optional overrideName argument sets a custom name for the new lookup file; omit it to use the template's default name. The mutation returns a non-null FileNameAndPath object containing the new file's name and path.

To retrieve template names for installed packages, use the repository() query as shown in the following example.

Hide Query Example

Show Installed Packages Query

Example

Raw
graphql
mutation {
  createLookupFileFromPackageTemplate(
      viewName: "humio",
      packageId: "linux/guards@1.2.0",
      lookupFileTemplateName: "lookups.csv",
      overrideName: "my-lookup.csv",
    )
  { name, path }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createLookupFileFromPackageTemplate( ^
      viewName: \"humio\", ^
      packageId: \"linux/guards@1.2.0\", ^
      lookupFileTemplateName: \"lookups.csv\", ^
      overrideName: \"my-lookup.csv\", ^
    ) ^
  { name, path } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createLookupFileFromPackageTemplate": {
      "name": "my-lookup.csv",
      "path": null
    }
  }
}

Input Parameters

Provide the target view or repository name, the versioned package identifier, and the template filename. The packageId value must include the version, for example my-package@1.0.0. Use the repository() query shown in the Syntax section to retrieve available template names from installed packages.

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
lookupFileTemplateName String yes   The filename of the lookup file template in the package. This value must match a template name from the package's lookupFileTemplates list.
overrideName String     A custom name for the new lookup file. When omitted, LogScale uses the template's default name. Supply this argument to avoid naming conflicts or to distinguish multiple files created from the same template.
packageId VersionedPackageSpecifier yes   The identifier of the installed package that contains the lookup file template. VersionedPackageSpecifier is a scalar in the form packageName@version.
viewName RepoOrViewName yes   The name of the view or repository where the package is installed and where the lookup file will be created. RepoOrViewName is a scalar.

Returned Values

The mutation returns a non-null FileNameAndPath object. Request the name field to get the name assigned to the new lookup file, and the path field to get its storage path within LogScale. The following table lists all available fields:

Table: FileNameAndPath Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
nameStringyes Long-Term The name of the file.
pathString  Long-Term Paths for files can be one of two types: absolute or relative. Absolute paths start with a slash, and relative paths start without a slash, like Unix paths. Every repository or view in the system is considered a "folder" in its own right, meaning that every relative path is relative to the current view. An absolute path points to something that can be addressed from any view, and a relative path points to a file located inside the view. If there is no path, it means the file is located at your current location.