API Stability Long-Term

The createParserFromTemplate() GraphQL mutation may be used to create a parser from a yaml specification.

For more information on creating a parser, see the Create a Parser documentation page. You may also want to look at the Parse Data page for related information.

Syntax

Below is the syntax for the createParserFromTemplate() mutation field:

graphql
createParserFromTemplate(
      input: CreateParserFromTemplateInput!
   ): Parser!

Below is an example of how this mutation field might be used:

Raw
graphql
mutation {
  createParserFromTemplate(input:
      { viewName: "humio",
        name: "my-parser",
        yamlTemplate: "favorite-yaml-template"
      } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createParserFromTemplate(input: ^
      { viewName: \"humio\", ^
        name: \"my-parser\", ^
        yamlTemplate: \"favorite-yaml-template\" ^
      } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Given Datatypes

For CreateParserFromTemplateInput, there are several parameters that may be given. Below is a list of them along with a description of each:

Table: CreateParserFromTemplateInput

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 17, 2024
namestringyes Long-TermName of the parser.
viewNameRepoOrViewNameyes Long-TermName of the view of the parser. RepoOrViewName is a scalar.
yamlTemplateYAMLyes Long-TermThe yaml specification of the parser. YAML is a scalar.

Returned Datatypes

The returned datatype Parser has many parameters. Below is a list of them along with a description of each:

Table: Parser

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 30, 2025
createdInfoAssetCommitMetadata  Long-TermMetadata related to the creation of the parser. See AssetCommitMetadata.
descriptionstring  Long-TermA description of the parser.
displayNamestringyes Long-TermThe full name of the parser, including package information if part of an application.
fieldsToBeRemovedBeforeParsing[string]yes Long-TermA list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
fieldsToTag[string]yes Long-TermThe fields that are used as tags.
idstringyes Long-TermThe unique identifier of the parser.
isBuiltInbooleanyes Long-TermTrue if the parser is one of LogScale's built-in parsers.
isOverriddenbooleanyes PreviewTrue if the parser is one of LogScale's built-in parsers, and it is overridden by a custom parser.
languageVersionLanguageVersionyes Long-TermThe language version used by the parser. See LanguageVersion.
modifiedInfoAssetCommitMetadata  Long-TermMetadata related to the latest modification of the parser. See AssetCommitMetadata.
namestringyes Long-TermThe name of the parser.
originDisplayStringstringyes PreviewThe origin of a parser. Can either be "Built in", "Local" or a package.
overridesBuiltInParserbooleanyes PreviewTrue if the parser is overrides one of LogScale's built-in parsers.
packagePackageInstallation  Long-TermThe package associated with the parser, if any. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-TermThe identifier of the package used, if one. VersionedPackageSpecifier is a scalar.
scriptstringyes Long-TermThe parser script that is executed for every incoming event.
testCases[ParserTestCase]yes Long-TermTest cases that can be used to help verify that the parser works as expected. See ParserTestCase.
yamlTemplateYAMLyes Long-TermA template that can be used to recreate the parser. YAML is a scalar.