Security Requirements and Controls
API Stability Long-Term

The createLookupFileFromPackageTemplate() GraphQL mutation field may be used to create a lookup file from a package lookup file template.

For more information on lookup files, see the Lookup API reference page. You may also want to look at the Package Management documentation page for related information.

Syntax

graphql
createLookupFileFromPackageTemplate(
      viewName: RepoOrViewName!
      packageId: VersionedPackageSpecifier!
      lookupFileTemplateName: string!
      overrideName: string
   ): FileNameAndPath!

There are no special input datatypes for this mutation field. RepoOrViewName and VersionedPackageSpecifier is a scalars. For the package identifier, enter the name of the package, followed by an ampersand and the version number.

Example

Below is an example of how this mutation field might be used:

Raw
graphql
mutation {
  createLookupFileFromPackageTemplate(
      viewName: "humio",
      packageId: "linux/guards@1.2.0",
      lookupFileTemplateName: "lookups.csv",
      overrideName: "my-lookup.csv",
    )
  { name, path }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createLookupFileFromPackageTemplate( ^
      viewName: \"humio\", ^
      packageId: \"linux/guards@1.2.0\", ^
      lookupFileTemplateName: \"lookups.csv\", ^
      overrideName: \"my-lookup.csv\", ^
    ) ^
  { name, path } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createLookupFileFromPackageTemplate": {
      "name": "my-lookup.csv",
      "path": null
    }
  }
}

Returned Datatype

For this returned datatype, you can request the absolute or relative path for the lookup file created and its file name. See the table below for much more details:

Table: FileNameAndPath

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 25, 2024
namestringyes Long-TermThe name of the file.
pathstring  Long-TermPaths for files can be one of two types: absolute or relative. Absolute paths start with a slash, and relative paths start without a slash, like Unix paths. Every repository or view in the system is considered a "folder" in its own right, meaning that every relative path is relative to the current view. An absolute path points to something that can be addressed from any view, and a relative path points to a file located inside the view. If there is no path, it means the file is located at your current location.