Summary

The createLookupFileFromPackageTemplate() GraphQL mutation field may be used to create a lookup file from a package lookup file template.

API Stability Long-Term
Security Requirement & Control CreateFiles API permission

Syntax

graphql
createLookupFileFromPackageTemplate(
      viewName: RepoOrViewName!
      packageId: VersionedPackageSpecifier!
      lookupFileTemplateName: string!
      overrideName: string
   ): FileNameAndPath!

For the input datatype, you'll have to give the name of view or repository, and the name of the lookup file template contained in the package. You'll also have to give the package name, followed by an ampersand and then the version number (see Example below). Click on the Show Query link below for an example of how to get these details.

For the results, you can get the absolute or relative path for the lookup file created and its file name. See the Returned Values section for more.

Hide Query Example

Show Installed Packages Query

Example

Raw
graphql
mutation {
  createLookupFileFromPackageTemplate(
      viewName: "humio",
      packageId: "linux/guards@1.2.0",
      lookupFileTemplateName: "lookups.csv",
      overrideName: "my-lookup.csv",
    )
  { name, path }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createLookupFileFromPackageTemplate( ^
      viewName: \"humio\", ^
      packageId: \"linux/guards@1.2.0\", ^
      lookupFileTemplateName: \"lookups.csv\", ^
      overrideName: \"my-lookup.csv\", ^
    ) ^
  { name, path } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createLookupFileFromPackageTemplate(
      viewName: \"humio\",
      packageId: \"linux/guards@1.2.0\",
      lookupFileTemplateName: \"lookups.csv\",
      overrideName: \"my-lookup.csv\",
    )
  { name, path }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createLookupFileFromPackageTemplate": {
      "name": "my-lookup.csv",
      "path": null
    }
  }
}

Input Parameters

For the input, you'll have to give the name of view or repository, and the name of the lookup file template contained in the package. You'll also have to give the package name, followed by an ampersand and then the version number (see Example above). Click on the Show Query link in the Syntax section for an example of how to get this.

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
lookupFileTemplateName string yes   The filename of the lookup file template in the package.
overrideName string     The name of the new lookup file to create.
packageId VersionedPackageSpecifier yes   The identifier of the package containing the lookup file template to use. VersionedPackageSpecifier is a scalar value.
viewName RepoOrViewName yes   The name of the view or repository. RepoOrViewName is a scalar.

Returned Values

For the results, you can request the absolute or relative path for the lookup file created and its file name. See the table below for details:

Table: FileNameAndPath Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 25, 2024
namestringyes Long-TermThe name of the file.
pathstring  Long-TermPaths for files can be one of two types: absolute or relative. Absolute paths start with a slash, and relative paths start without a slash, like Unix paths. Every repository or view in the system is considered a "folder" in its own right, meaning that every relative path is relative to the current view. An absolute path points to something that can be addressed from any view, and a relative path points to a file located inside the view. If there is no path, it means the file is located at your current location.