🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createParserFromTemplate() mutation creates a parser in a LogScale repository from a YAML specification. The YAML format matches the value returned by the yamlTemplate field on the Parser type, making this mutation suitable for round-trip workflows such as exporting a parser from one repository and recreating it in another. Use this mutation when you have a complete YAML template that defines the parser configuration. To build a parser from individual fields instead, use createParserV2(). To create a parser from a template within an installed package, use createParserFromPackageTemplate().

Syntax

graphql
createParserFromTemplate(
      input: CreateParserFromTemplateInput!
   ): Parser!

The mutation accepts a single required argument, input, of type CreateParserFromTemplateInput!. The viewName field identifies the target repository or view by name. The yamlTemplate field accepts a YAML string defining the full parser configuration; its format matches the value returned by yamlTemplate on the Parser type, enabling round-trip export and import between repositories. The optional name field overrides the parser name embedded in the YAML; when omitted, the mutation derives the parser name from the name key in the YAML template.

The mutation returns a non-null Parser! object representing the newly created parser. The Returned Values section lists the available fields.

Example

Raw
graphql
mutation {
  createParserFromTemplate(input:
      { viewName: "humio",
        name: "my-parser",
        yamlTemplate: "favorite-yaml-template"
      } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createParserFromTemplate(input: ^
      { viewName: \"humio\", ^
        name: \"my-parser\", ^
        yamlTemplate: \"favorite-yaml-template\" ^
      } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createParserFromTemplate(input:
      { viewName: \"humio\",
        name: \"my-parser\",
        yamlTemplate: \"favorite-yaml-template\"
      } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Input Parameters

The viewName field identifies the target repository or view by name. The yamlTemplate field accepts the full YAML parser definition; its format matches the value returned by yamlTemplate on the Parser type, so you can retrieve a parser's YAML from one repository and pass it directly to this mutation to recreate the parser elsewhere. The optional name field overrides the parser name embedded in the YAML; when omitted, the mutation uses the name key from the YAML.

Table: CreateParserFromTemplateInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
nameString  Long-Term Name of the parser.
viewNameRepoOrViewNameyes Long-Term Name of the view of the parser. RepoOrViewName is a scalar.
yamlTemplateYAMLyes Long-Term The yaml specification of the parser. YAML is a scalar.

Returned Values

The mutation returns a Parser! object representing the newly created parser. Key fields include id and name for identification, script for the Falcon LogScale Query Language parsing logic, and testCases for the test cases defined on the parser, which you can execute in CI/CD workflows via testParserV2(). The fieldsToBeRemovedBeforeParsing field lists event fields stripped before the parser runs; removing high-volume fields here reduces both storage and processing costs. The yamlTemplate field returns the YAML representation of the newly created parser, which you can use to inspect the configuration or export it to another repository. The isBuiltin field returns false for custom parsers created by this mutation.

Table: Parser Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the parser. See AssetCommitMetadata.
descriptionString  Long-Term A description of the parser.
displayNameStringyes Long-Term The full name of the parser, including package information if part of an application.
fieldsToBeRemovedBeforeParsingStringyes Long-Term A list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
fieldsToTagStringyes Long-Term The fields that are used as tags.
idStringyes Long-Term The unique identifier of the parser.
isBuiltInBooleanyes Long-Term True if the parser is one of LogScale's built-in parsers.
isOverriddenBooleanyes Short-Term True if the parser is one of LogScale's built-in parsers, and it is overridden by a custom parser.
languageVersionLanguageVersionyes Long-Term The language version used by the parser. See LanguageVersion.
modifiedInfoAssetCommitMetadata  Long-Term Metadata related to the latest modification of the parser. See AssetCommitMetadata.
nameStringyes Long-Term The name of the parser.
originDisplayStringStringyes Short-Term The origin of a parser. Can either be "Built in", "Local" or a package.
overridesBuiltInParserBooleanyes Short-Term True if the parser is overrides one of LogScale's built-in parsers.
packagePackageInstallation  Long-Term The package associated with the parser, if any. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The identifier of the package used, if one. VersionedPackageSpecifier is a scalar.
scriptStringyes Long-Term The parser script that is executed for every incoming event.
testCasesParserTestCaseyes Long-Term Test cases that can be used to help verify that the parser works as expected. See ParserTestCase.
yamlTemplateYAMLyes Long-Term A template that can be used to recreate the parser. YAML is a scalar.