๐Ÿ”’Security Requirements and Controls
๐ŸŽฏAPI Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Available: Action type:S3 v1.221.0

Action type:S3 is available from version 1.221.0.

Summary

The createS3Action() mutation creates an Amazon S3 action in a LogScale repository or view. Use this mutation to configure an action that forwards alert output to an S3 bucket. After creation, attach the action to an alert to trigger uploads when the alert fires.

Syntax

graphql
createS3Action(
      input: CreateS3Action!
   ): S3Action!

The mutation requires one argument, input, of type CreateS3Action!. Provide the view name, IAM role ARN, bucket configuration, output format, and file name. See the Input Parameters section for the full list of fields.

The mutation returns an S3Action! object. The return type is non-null, so a successful call always returns the created action. See the Returned Values section for available fields.

Example

Raw
graphql
mutation {
  createS3Action(
    input: { 
    viewName: "humio",
    roleArn: "arn:aws_iam::1234:user/admin"
    name: "act-one",
    awsRegion: "us-west-2",
    bucketName: "pale-1",
    fileName: "file-1",
    outputFormat: "CSV",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    name: \"act-one\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    name: \"act-one\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createS3Action( ^
    input: {  ^
    viewName: \"humio\", ^
    roleArn: \"arn:aws_iam::1234:user/admin\" ^
    name: \"act-one\", ^
    awsRegion: \"us-west-2\", ^
    bucketName: \"pale-1\", ^
    fileName: \"file-1\", ^
    outputFormat: \"CSV\", ^
    outputMetadata: True, ^
    useProxy: False ^
    } ^
  ) { id, isAllowedToRun } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    name: \"act-one\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    name: \"act-one\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    name: \"act-one\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    name: \"act-one\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createS3Action": {
      "id": "abc123",
      "isAllowedToRun": true
    }
  }
}

Input Parameters

Provide the input argument with the view name and S3 bucket details. The following table describes each field in the CreateS3Action input type:

Returned Values

The mutation returns the newly created S3Action object. The returned fields include the action ID, name, bucket and region configuration, output format, file name, and whether the action is allowed to run. The createdInfo and modifiedInfo fields return AssetCommitMetadata objects containing the creation and last-modification details.