The createPersistedAggregation() GraphQL mutation is used to create a new persisted aggregation. It returns FieldValidationException on validation errors.

To enable and disable a persisted aggregation, use the enablePersistedAggregation() and disablePersistedAggregation() mutations. To make changes to a persisted aggregation, use updatePersistedAggregation(). To delete one, use the deletePersistedAggregation() mutation. To get a list of all persisted aggregations accessible, use the persistedAggregations() query.

Stability Level Preview

Syntax

graphql
createPersistedAggregation(
      input: CreatePersistedAggregationInput!
   ): PersistedAggregation!

For the input, you'll have to provide the name of the view or repository, and a name for the persisted aggregation to create and whether to enable it, initially. You'll have to give details on the schedule, as well as the query used. See the Input Parameters section for more on this.

You can request several return parameters, but since you're creating the persisted aggregation, you will know all of the values except for the unique identifier, which you may need later. See the Returned Values section for details.

Example

Raw
graphql
mutation {
  createPersistedAggregation(
    input: { viewName: "humio", 
             name: "dont-stop",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: "@host=*something*"
     }
  ) { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createPersistedAggregation( ^
    input: { viewName: \"humio\",  ^
             name: \"dont-stop\", ^
             enabled: True, ^
             schedule: { backfillAmount: 7,  ^
                         backfillUnit: Days,  ^
                         interval: Weekly, ^
                         timestampType: EventTime }, ^
             queryOwnershipType: Organization, ^
             queryString: \"@host=*something*\" ^
     } ^
  ) { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createPersistedAggregation(
    input: { viewName: \"humio\", 
             name: \"dont-stop\",
             enabled: True,
             schedule: { backfillAmount: 7, 
                         backfillUnit: Days, 
                         interval: Weekly,
                         timestampType: EventTime },
             queryOwnershipType: Organization,
             queryString: \"@host=*something*\"
     }
  ) { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createPersistedAggregation": {
      "id": "123abc" 
    }
  }
}

Input Parameters

For the input datatype, you'll have to provide the name of the view or repository, and a name for the persisted aggregation to create and whether to enable it, initially. You'll have to give the query to use and details on the schedule through sub-parameters. The table below provides details on these parameters and a link to the sub-parameters:

Table: CreatePersistedAggregationInput

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Mar 30, 2026
descriptionstring  PreviewA description of what the persisted aggregation does.
enabledbooleanyes PreviewWhether the persisted aggregation should be enabled when created.
labels[string]  PreviewA list of labels to tag the persisted aggregation for organizing and filtering. Each label can be up to sixty-four characters long and may contain only alphanumeric characters, spaces, hyphens, and underscores.
namestringyes PreviewThe unique name for the persisted aggregation. It can be up to one-hundred twenty-eight characters long, must start with an alphanumeric character, and may contain only alphanumeric characters, spaces, hyphens, and underscores. The name must be unique within the organization.
queryOwnershipTypeQueryOwnershipTypeyes PreviewThe ownership type of the query (e.g., User or Organization). See QueryOwnershipType.
queryStringstringyes PreviewThe LogScale query string that defines the aggregation logic. This must be a valid query.
schedulePersistedAggregationScheduleInputyes PreviewThe schedule configuration defining when and how often the aggregation runs. See PersistedAggregationScheduleInput.
viewNamestringyes PreviewThe LogScale repository or saved search set to query against. This must be non-empty, and reference an existing repository to which the requester has access.

Returned Values

For the returned datatype, since you'll provide the details of the persisted aggregation to be created, the only data that you probably won't know is the value of the id parameter.

Table: PersistedAggregation

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: May 12, 2026
createdInfoPersistedAggregationCommitMetadatayes PreviewMetadata related to the creation of the persisted aggregation. See PersistedAggregationCommitMetadata.
descriptionstring  PreviewThe description of the persisted aggregation.
enabledbooleanyes PreviewWhether the persisted aggregation is enabled.
healthInfoPersistedAggregationHealthInfo  PreviewDerived health status information for the persisted aggregation. See PersistedAggregationHealthInfo.
idstringyes PreviewThe unique identifier of the persisted aggregation.
labels[string]yes PreviewThe labels associated with the aggregation.
modifiedInfoPersistedAggregationCommitMetadata  PreviewMetadata related to the last modification of the persisted. See PersistedAggregationCommitMetadata.
namestringyes PreviewThe name of the persisted aggregation.
queryOwnershipTypestringyes PreviewThe ownership type of the query.
queryStringstringyes PreviewThe query string for the aggregation.
schedulePersistedAggregationScheduleyes PreviewThe schedule configuration for the aggregation. See PersistedAggregationSchedule.
tagstringyes PreviewThe unique tag identifier for the persisted aggregation. Immutable after creation.
viewNamestringyes PreviewThe name of the view to which the persisted aggregation belongs.