🎯API Stability
PreviewThis API is under active development and may change significantly. Not recommended for production use.

Summary

The createPersistedAggregation() mutation creates a persisted aggregation in a LogScale view or repository. A persisted aggregation runs a LogScale query on a fixed schedule and writes results to a dedicated destination repository of kind PersistedAggregation. Queries against that destination repository read from precomputed results rather than scanning raw event data, which reduces execution time for frequently accessed aggregations.

You must provide the source view, query string, execution schedule, destination repository, ownership type, and an immutable tag. The tag and destinationRepositoryName fields cannot be changed after creation.

Syntax

graphql
createPersistedAggregation(
      input: CreatePersistedAggregationInput!
   ): PersistedAggregation!

The mutation requires a single input argument of type CreatePersistedAggregationInput. The required fields are viewName, destinationRepositoryName, name, tag, queryString, schedule, queryOwnershipType, enabled, labels, and staticFields.

The tag and destinationRepositoryName fields are immutable after creation. The destinationRepositoryName must reference an existing repository of kind PersistedAggregation. The queryOwnershipType field accepts Organization or User. Organization-owned aggregations are visible to all organization members with sufficient permissions. The isRollupable field is optional and defaults to false.

The mutation returns a non-null PersistedAggregation object containing the system-assigned id. Retain this identifier for subsequent enable, disable, update, and delete operations.

Example

Raw
graphql
mutation {
        createPersistedAggregation(
          input: { viewName: "humio",
                   name: "dont-stop",
                   enabled: True,
                   schedule: { backfillAmount: 7,
                               backfillUnit: Days,
                               interval: Weekly,
                               timestampType: EventTime },
                   queryOwnershipType: Organization,
                   destinationRepositoryName: "my-destination",
                   queryString: "count()"
           }
        ) { name }
      }
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
        createPersistedAggregation(
          input: { viewName: \"humio\",
                   name: \"dont-stop\",
                   enabled: True,
                   schedule: { backfillAmount: 7,
                               backfillUnit: Days,
                               interval: Weekly,
                               timestampType: EventTime },
                   queryOwnershipType: Organization,
                   destinationRepositoryName: \"my-destination\",
                   queryString: \"count()\"
           }
        ) { name }
      }"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
        createPersistedAggregation(
          input: { viewName: \"humio\",
                   name: \"dont-stop\",
                   enabled: True,
                   schedule: { backfillAmount: 7,
                               backfillUnit: Days,
                               interval: Weekly,
                               timestampType: EventTime },
                   queryOwnershipType: Organization,
                   destinationRepositoryName: \"my-destination\",
                   queryString: \"count()\"
           }
        ) { name }
      }"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
        createPersistedAggregation( ^
          input: { viewName: \"humio\", ^
                   name: \"dont-stop\", ^
                   enabled: True, ^
                   schedule: { backfillAmount: 7, ^
                               backfillUnit: Days, ^
                               interval: Weekly, ^
                               timestampType: EventTime }, ^
                   queryOwnershipType: Organization, ^
                   destinationRepositoryName: \"my-destination\", ^
                   queryString: \"count()\" ^
           } ^
        ) { name } ^
      }" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
        createPersistedAggregation(
          input: { viewName: \"humio\",
                   name: \"dont-stop\",
                   enabled: True,
                   schedule: { backfillAmount: 7,
                               backfillUnit: Days,
                               interval: Weekly,
                               timestampType: EventTime },
                   queryOwnershipType: Organization,
                   destinationRepositoryName: \"my-destination\",
                   queryString: \"count()\"
           }
        ) { name }
      }"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
        createPersistedAggregation(
          input: { viewName: \"humio\",
                   name: \"dont-stop\",
                   enabled: True,
                   schedule: { backfillAmount: 7,
                               backfillUnit: Days,
                               interval: Weekly,
                               timestampType: EventTime },
                   queryOwnershipType: Organization,
                   destinationRepositoryName: \"my-destination\",
                   queryString: \"count()\"
           }
        ) { name }
      }";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
        createPersistedAggregation(
          input: { viewName: \"humio\",
                   name: \"dont-stop\",
                   enabled: True,
                   schedule: { backfillAmount: 7,
                               backfillUnit: Days,
                               interval: Weekly,
                               timestampType: EventTime },
                   queryOwnershipType: Organization,
                   destinationRepositoryName: \"my-destination\",
                   queryString: \"count()\"
           }
        ) { name }
      }"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
        createPersistedAggregation(
          input: { viewName: \"humio\",
                   name: \"dont-stop\",
                   enabled: True,
                   schedule: { backfillAmount: 7,
                               backfillUnit: Days,
                               interval: Weekly,
                               timestampType: EventTime },
                   queryOwnershipType: Organization,
                   destinationRepositoryName: \"my-destination\",
                   queryString: \"count()\"
           }
        ) { name }
      }"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
        "data": {
          "createPersistedAggregation": {
            "name": "dont-stop"
          }
        }
      }

Input Parameters

Specify the source view or repository in viewName. Specify the destination repository in destinationRepositoryName. The destination must be an existing repository of kind PersistedAggregation. This value cannot be changed after creation. The tag field is also immutable after creation. It must start with a letter and contain only alphanumeric characters, underscores, hyphens, and periods. The tag must be unique within the organization and cannot exceed 128 characters. The name must be unique within the organization, must start with an alphanumeric character, and cannot exceed 128 characters.

The schedule field takes a PersistedAggregationScheduleInput object. Provide the required interval and timestampType fields. Optionally provide backfillAmount and backfillUnit to process historical data on first run. The offsetSeconds field applies only to EventTime scheduling. For IngestTime, it must be null.

Set enabled to true to activate the aggregation immediately, or false to defer activation. The labels field is required. Supply an empty list to create the aggregation without labels. Each label can be up to 64 characters. Labels may contain only alphanumeric characters, spaces, hyphens, and underscores. The staticFields field is also required. Supply an empty list if no static fields are needed. Static field names cannot start with @ or #. The list cannot exceed 20 entries.

Returned Values

The mutation returns a non-null PersistedAggregation object. Request id to retrieve the system-assigned identifier needed for subsequent operations. Request tag and destination to confirm the immutable fields set at creation. Request enabled to confirm whether the aggregation is active. Request schedule to verify the execution configuration.