Stability Level Preview

The createPersistedAggregation() GraphQL mutation is used to create a new persisted aggregation. It returns FieldValidationException on validation errors.

To enable and disable a persisted aggregation, use the enablePersistedAggregation() and disablePersistedAggregation() mutations. To make changes to a persisted aggreation, use updatePersistedAggregation(). To delete one, use the deletePersistedAggregation() mutation. To get a list of all persisted aggregations accessible, use the persistedAggregations() query.

Syntax

graphql
createPersistedAggregation(
      input: CreatePersistedAggregationInput!
   ): PersistedAggregation!

For the input, you'll have to provide the name of the view or repository, and a name for the persisted aggregation to create and whether to enable it, initially. You'll have to give details on the schedule, as well as the query used. See the Given Datatype section for more on this.

You can request several return parameters, but since you're creating the persisted aggregation, you will know all of the values except for the unique identfier, which you may need later. See the Returned Datatype section farther down this page for more parameters.

Example

Raw
graphql
mutation {
  createPersistedAggregation(
    input: { viewName: "humio", 
             name: "dont-stop",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: "@host=*something*"
     }
  ) { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createPersistedAggregation( ^
    input: { viewName: \"humio\",  ^
             name: \"dont-stop\", ^
             enabled: True, ^
             schedule: { backfillAmount: 7,  ^
                         backfillUnit: Days,  ^
                         interval: Weekly, ^
                         timestampType: EventTime }, ^
             queryOwnershipType: Organization, ^
             queryString: \"@host=*something*\" ^
     } ^
  ) { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createPersistedAggregation": {
      "id": "123abc" 
    }
  }
}

Given Datatype

For the input datatype, you'll have to provide the name of the view or repository, and a name for the persisted aggregation to create and whether to enable it, initially. You'll have to give the query to use and details on the schedule through sub-parameters. The table below provides details on these parameters and a link to the sub-parameters:

Table: CreatePersistedAggregationInput

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Mar 30, 2026
descriptionstring  PreviewA description of what the persisted aggregation does.
enabledbooleanyes PreviewWhether the persisted aggregation should be enabled when created.
labels[string]  PreviewA list of labels to tag the persisted aggregation for organizing and filtering. Each label can be up to sixty-four characters long and may contain only alphanumeric characters, spaces, hyphens, and underscores.
namestringyes PreviewThe unique name for the persisted aggregation. It can be up to one-hundred twenty-eight characters long, must start with an alphanumeric character, and may contain only alphanumeric characters, spaces, hyphens, and underscores. The name must be unique within the organization.
queryOwnershipTypeQueryOwnershipTypeyes PreviewThe ownership type of the query (e.g., User or Organization). See QueryOwnershipType.
queryStringstringyes PreviewThe LogScale query string that defines the aggregation logic. This must be a valid query.
schedulePersistedAggregationScheduleInputyes PreviewThe schedule configuration defining when and how often the aggregation runs. See PersistedAggregationScheduleInput.
viewNamestringyes PreviewThe LogScale repository or saved search set to query against. This must be non-empty, and reference an existing repository to which the requester has access.

Returned Datatype

For the returned datatype, since you'll provide the details of the persisted aggreation to be created, the only data that you probably won't know is the value of the id parameter.

Table: PersistedAggregation

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Mar 30, 2026
descriptionstring  PreviewThe description of the persisted aggregation.
enabledbooleanyes PreviewWhether the persisted aggregation is enabled.
idstringyes PreviewThe unique identifier of the persisted aggregation.
labels[string]yes PreviewThe labels associated with the aggregation.
namestringyes PreviewThe name of the persisted aggregation.
queryOwnershipTypestringyes PreviewThe ownership type of the query.
queryStringstringyes PreviewThe query string for the aggregation.
schedulePersistedAggregationScheduleyes PreviewThe schedule configuration for the aggregation. See PersistedAggregationSchedule.
viewNamestringyes PreviewThe name of the view to which the persisted aggregation belongs.