Summary

The createParserFromPackageTemplate() GraphQL mutation field may be used to create a parser from a package parser template.

API Stability Long-Term

Syntax

graphql
createParserFromPackageTemplate(
      viewName: string!
      packageId: VersionedPackageSpecifier!
      parserTemplateName: string!
      overrideName: string
   ): CreateParserFromPackageTemplateMutation!

For the input, you'll have to give the package name, followed by an ampersand and then the version number (see Example above). You'll also have to give the name of the template contained in the package. Click on the Show Query link below for an example of how to get these details. See the Input Parameters section for more on the parameters.

For the results, you can get the event fields that will be removed from events, a template for recreating the parser, and other information. See the Returned Values section for more.

Hide Query Example

Show Installed Packages Query

Example

Raw
graphql
mutation {
  createParserFromPackageTemplate(
        viewName: "humio",
        packageId: "humio/insights@0.0.14",
        parserTemplateName: "humio",
        overrideName: "my-basic-parser"
      )
  { parser { id, fieldsToTag } }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserFromPackageTemplate(
        viewName: \"humio\",
        packageId: \"humio/insights@0.0.14\",
        parserTemplateName: \"humio\",
        overrideName: \"my-basic-parser\"
      )
  { parser { id, fieldsToTag } }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserFromPackageTemplate(
        viewName: \"humio\",
        packageId: \"humio/insights@0.0.14\",
        parserTemplateName: \"humio\",
        overrideName: \"my-basic-parser\"
      )
  { parser { id, fieldsToTag } }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createParserFromPackageTemplate( ^
        viewName: \"humio\", ^
        packageId: \"humio/insights@0.0.14\", ^
        parserTemplateName: \"humio\", ^
        overrideName: \"my-basic-parser\" ^
      ) ^
  { parser { id, fieldsToTag } } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createParserFromPackageTemplate(
        viewName: \"humio\",
        packageId: \"humio/insights@0.0.14\",
        parserTemplateName: \"humio\",
        overrideName: \"my-basic-parser\"
      )
  { parser { id, fieldsToTag } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createParserFromPackageTemplate(
        viewName: \"humio\",
        packageId: \"humio/insights@0.0.14\",
        parserTemplateName: \"humio\",
        overrideName: \"my-basic-parser\"
      )
  { parser { id, fieldsToTag } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createParserFromPackageTemplate(
        viewName: \"humio\",
        packageId: \"humio/insights@0.0.14\",
        parserTemplateName: \"humio\",
        overrideName: \"my-basic-parser\"
      )
  { parser { id, fieldsToTag } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createParserFromPackageTemplate(
        viewName: \"humio\",
        packageId: \"humio/insights@0.0.14\",
        parserTemplateName: \"humio\",
        overrideName: \"my-basic-parser\"
      )
  { parser { id, fieldsToTag } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Input Parameters

For the input, you'll have to give the package name, followed by an ampersand and then the version number (see Example above). You'll also have to give the name of the template contained in the package. Click on the Show Query link in the Syntax section for an example of how to get this.

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
overrideName string     The name of the new parser to create.
packageId VersionedPackageSpecifier yes   The identifier of the package containing the parser template. VersionedPackageSpecifier is a scalar.
parserTemplateName string yes   The name of the parser template in the package.
viewName string yes   The name of the view where the package is installed.

Returned Values

For the results, you can get the fields that will be removed from events, a template for recreating the parser, and other information. What is available is listed in the table here:

Table: CreateParserFromPackageTemplateMutation Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 24, 2024
parserParseryes Long-TermThe parser to create from the package template. See Parser.

The datatype above uses a core datatype for getting parser information. For your convenience, the table for that sub-datatype is included here:

Table: Parser Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 30, 2025
createdInfoAssetCommitMetadata  Long-TermMetadata related to the creation of the parser. See AssetCommitMetadata.
descriptionstring  Long-TermA description of the parser.
displayNamestringyes Long-TermThe full name of the parser, including package information if part of an application.
fieldsToBeRemovedBeforeParsing[string]yes Long-TermA list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
fieldsToTag[string]yes Long-TermThe fields that are used as tags.
idstringyes Long-TermThe unique identifier of the parser.
isBuiltInbooleanyes Long-TermTrue if the parser is one of LogScale's built-in parsers.
isOverriddenbooleanyes PreviewTrue if the parser is one of LogScale's built-in parsers, and it is overridden by a custom parser.
languageVersionLanguageVersionyes Long-TermThe language version used by the parser. See LanguageVersion.
modifiedInfoAssetCommitMetadata  Long-TermMetadata related to the latest modification of the parser. See AssetCommitMetadata.
namestringyes Long-TermThe name of the parser.
originDisplayStringstringyes PreviewThe origin of a parser. Can either be "Built in", "Local" or a package.
overridesBuiltInParserbooleanyes PreviewTrue if the parser is overrides one of LogScale's built-in parsers.
packagePackageInstallation  Long-TermThe package associated with the parser, if any. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-TermThe identifier of the package used, if one. VersionedPackageSpecifier is a scalar.
scriptstringyes Long-TermThe parser script that is executed for every incoming event.
testCases[ParserTestCase]yes Long-TermTest cases that can be used to help verify that the parser works as expected. See ParserTestCase.
yamlTemplateYAMLyes Long-TermA template that can be used to recreate the parser. YAML is a scalar.