The createParserV2() GraphQL mutation may be used to create a parser in LogScale.

For more information on creating a parser, see the Creating a Parser documentation page. You may also want to look at the Parsing Data and Parsing Log Data pages for related information.

Syntax

Below is the syntax for the createParserV2() mutation field:

graphql
createParserV2(
      input: CreateParserInputV2!
   ): Parser!

Below is an example of how this mutation field might be used:

Raw
graphql
mutation {
  createParserV2(input:
      { repositoryName: "humio",
        name: "myKvParser",
        script: "kvParse()",
        testCases: [{
          event: {rawString: "key=value"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: "key", expectedValue: "value"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createParserV2(input: ^
      { repositoryName: \"humio\", ^
        name: \"myKvParser\", ^
        script: \"kvParse()\", ^
        testCases: [{ ^
          event: {rawString: \"key=value\"},  ^
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}], ^
        }], ^
        fieldsToTag: [], ^
        fieldsToBeRemovedBeforeParsing: [] ^
      }) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}'
"$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Given Datatypes

For the given datatype, CreateParserInputV2, there are several parameters that may be given. Below is a list of them:

Table: CreateParserInputV2

ParameterTypeRequiredDefaultDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 17, 2024
allowOverwritingExistingParserboolean  Allows saving a parser with a name that is already in use, by overwriting the parser that previously had the name.
fieldsToTag[string]yes Fields that are used as tags.
fieldsToBeRemovedBeforeParsing[string]yes A list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
languageVersionmultiple  A specific language version. The multiple datatype consists of LanguageVersionInputType = {name: 'legacy'}. See LanguageVersionInputType.
namestringyes The name to use for the parser.
repositoryNameRepoOrViewNameyes The repository where the parser is located. RepoOrViewName is a scalar.
scriptstringyes The parser script that is executed for every incoming event.
testCases[ParserTestCaseInput]yes Test cases that can be used to help verify that the parser works as expected. See ParserTestCaseInput.

Returned Datatypes

The returned datatype Parser has many parameters. Below is a list of them along:

Table: Parser

ParameterTypeRequiredDefaultDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 27, 2024
assetTypeAssetTypeyes The type of asset. See AssetType. This is deprecated and will be removed in LogScale 1.142.
descriptionstring  A description of the parser.
displayNamestringyes The full name of the parser, including package information if part of an application.
fieldsToBeRemovedBeforeParsing[string]yes A list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
fieldsToTag[string]yes The fields that are used as tags.
idstringyes The unique identifier of the parser.
isBuiltInbooleanyes True if the parser is one of LogScale's built-in parsers.
languageVersionLanguageVersionyes The language version used by the parser. See LanguageVersion.
namestringyes The name of the parser.
scriptstringyes The parser script that is executed for every incoming event.
sourceCodestringyes The source code of the parser. This is deprecated and will be replaced with script starting in version 1.142.
tagFields[string]yes The fields to use as tags. This is deprecated and will be replaced with fieldsToTag starting in version 1.142.
testCases[ParserTestCase]yes Test cases that can be used to help verify that the parser works as expected. See ParserTestCase.
testData[string]yes Saved test data (e.g., log lines) that you can use to test the parser. This is deprecated and will be replaced with testCases starting with version 1.142.
packagePackageInstallation  The package associated with the parser, if any. See PackageInstallation.
packageIdVersionedPackageSpecifier  The identifier of the package used, if one. VersionedPackageSpecifier is a scalar.
yamlTemplateyamlyes A template that can be used to recreate the parser.