createParserV2()

API Stability	`Long-Term`

The createParserV2() GraphQL mutation may be used to create a parser in LogScale.

For more information on creating a parser, see the Creating a Parser documentation page. You may also want to look at the Parsing Data and Parsing Log Data pages for related information.

Syntax

Below is the syntax for the createParserV2() mutation field:

graphql

createParserV2(
      input: CreateParserInputV2!
   ): Parser!

Below is an example of how this mutation field might be used:

Show:

graphql

mutation {
  createParserV2(input:
      { repositoryName: "humio",
        name: "myKvParser",
        script: "kvParse()",
        testCases: [{
          event: {rawString: "key=value"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: "key", expectedValue: "value"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createParserV2(input: ^
      { repositoryName: \"humio\", ^
        name: \"myKvParser\", ^
        script: \"kvParse()\", ^
        testCases: [{ ^
          event: {rawString: \"key=value\"},  ^
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}], ^
        }], ^
        fieldsToTag: [], ^
        fieldsToBeRemovedBeforeParsing: [] ^
      }) ^
  { id } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createParserV2(input:
      { repositoryName: \"humio\",
        name: \"myKvParser\",
        script: \"kvParse()\",
        testCases: [{
          event: {rawString: \"key=value\"}, 
          outputAssertions: [{outputEventIndex: 0, assertions: {fieldsHaveValues: [{fieldName: \"key\", expectedValue: \"value\"}]}}],
        }],
        fieldsToTag: [],
        fieldsToBeRemovedBeforeParsing: []
      })
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Given Datatypes

For the given datatype, CreateParserInputV2, there are several parameters that may be given. Below is a list of them:

Table: CreateParserInputV2

Parameter	Type	Required	Default	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 28, 2025
`allowOverwritingExistingParser`	boolean		false	Allows saving a parser with a name that is already in use, by overwriting the parser that previously had the name.
`fieldsToTag`	[string]	yes		Fields that are used as tags.
`fieldsToBeRemovedBeforeParsing`	[string]	yes		A list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
`languageVersion`	multiple		{name: ”legacy“}	A specific language version. The multiple datatype consists of `LanguageVersionInputType = {name: 'legacy'}`. See `LanguageVersionInputType`.
`name`	string	yes		The name to use for the parser.
`repositoryName`	`RepoOrViewName`	yes		The repository where the parser is located. `RepoOrViewName` is a scalar.
`script`	string	yes		The parser script that is executed for every incoming event.
`testCases`	[`ParserTestCaseInput`]	yes		Test cases that can be used to help verify that the parser works as expected. See `ParserTestCaseInput`.

Returned Datatypes

The returned datatype Parser has many parameters. Below is a list of them along:

Table: Parser

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 26, 2025
`assetType`	`AssetType`	yes	`Long-Term`	The type of asset. See `AssetType`. This is deprecated and will be removed in LogScale 1.142.
`description`	string		`Long-Term`	A description of the parser.
`displayName`	string	yes	`Long-Term`	The full name of the parser, including package information if part of an application.
`fieldsToBeRemovedBeforeParsing`	[string]	yes	`Long-Term`	A list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
`fieldsToTag`	[string]	yes	`Long-Term`	The fields that are used as tags.
`id`	string	yes	`Long-Term`	The unique identifier of the parser.
`isBuiltIn`	boolean	yes	`Long-Term`	True if the parser is one of LogScale's built-in parsers.
`languageVersion`	`LanguageVersion`	yes	`Long-Term`	The language version used by the parser. See `LanguageVersion`.
`name`	string	yes	`Long-Term`	The name of the parser.
`script`	string	yes	`Long-Term`	The parser script that is executed for every incoming event.
`sourceCode`	string	yes	`Long-Term`	The source code of the parser. This is deprecated and will be replaced with `script` starting in version 1.142.
`tagFields`	[string]	yes	`Long-Term`	The fields to use as tags. This is deprecated and will be replaced with `fieldsToTag` starting in version 1.142.
`testCases`	[`ParserTestCase`]	yes	`Long-Term`	Test cases that can be used to help verify that the parser works as expected. See `ParserTestCase`.
`testData`	[string]	yes	`Long-Term`	Saved test data (e.g., log lines) that you can use to test the parser. This is deprecated and will be replaced with `testCases` starting with version 1.142.
`package`	`PackageInstallation`		`Long-Term`	The package associated with the parser, if any. See `PackageInstallation`.
`packageId`	`VersionedPackageSpecifier`		`Long-Term`	The identifier of the package used, if one. `VersionedPackageSpecifier` is a scalar.
`yamlTemplate`	`yaml`	yes	`Long-Term`	A template that can be used to recreate the parser.

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes

createParserV2()

Syntax

Given Datatypes

Returned Datatypes

Enter search term