🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The createSlackAction() mutation creates a Slack action in a LogScale repository or view. A Slack action sends an HTTP POST to a Slack incoming webhook URL when an alert triggers it. You define the message content by providing key-value fields that LogScale populates with alert context variables such as {events_str} and {query_time_interval} at trigger time. To modify an existing Slack action, use updateSlackAction() instead.

Syntax

graphql
createSlackAction(
      input: CreateSlackAction!
   ): SlackAction!

The input argument is required and takes a CreateSlackAction object. Provide the view or repository name, the Slack incoming webhook URL, an action name, and an optional list of message fields. Message fields are key-value pairs sent to Slack when the action fires; the value field supports LogScale alert context variables enclosed in braces (for example, {events_str}, {query_time_interval}) that LogScale substitutes at trigger time. See the Input Parameters section for the full list of fields.

The mutation returns a non-nullable SlackAction! object representing the newly created action. See the Returned Values section for the available fields.

Example

Raw
graphql
mutation {
  createSlackAction( input:
     { viewName: "humio",
       name: "my-slack-act",
       url: "https://slack.com/api/chat.postMessage",
      fields: [ {fieldName: "Events String", value: "{events_str}"},
                {fieldName: "Time Interval", value: "{query_time_interval}"} ],
      useProxy: false
    } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSlackAction( input:
     { viewName: \"humio\",
       name: \"my-slack-act\",
       url: \"https://slack.com/api/chat.postMessage\",
      fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
      useProxy: false
    } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSlackAction( input:
     { viewName: \"humio\",
       name: \"my-slack-act\",
       url: \"https://slack.com/api/chat.postMessage\",
      fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
      useProxy: false
    } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createSlackAction( input: ^
     { viewName: \"humio\", ^
       name: \"my-slack-act\", ^
       url: \"https://slack.com/api/chat.postMessage\", ^
      fields: [ {fieldName: \"Events String\", value: \"{events_str}\"}, ^
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ], ^
      useProxy: false ^
    } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createSlackAction( input:
     { viewName: \"humio\",
       name: \"my-slack-act\",
       url: \"https://slack.com/api/chat.postMessage\",
      fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
      useProxy: false
    } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createSlackAction( input:
     { viewName: \"humio\",
       name: \"my-slack-act\",
       url: \"https://slack.com/api/chat.postMessage\",
      fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
      useProxy: false
    } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createSlackAction( input:
     { viewName: \"humio\",
       name: \"my-slack-act\",
       url: \"https://slack.com/api/chat.postMessage\",
      fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
      useProxy: false
    } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createSlackAction( input:
     { viewName: \"humio\",
       name: \"my-slack-act\",
       url: \"https://slack.com/api/chat.postMessage\",
      fields: [ {fieldName: \"Events String\", value: \"{events_str}\"},
                {fieldName: \"Time Interval\", value: \"{query_time_interval}\"} ],
      useProxy: false
    } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createSlackAction": {
      "id": "abc123"
    }
  }
}

Input Parameters

Provide the view or repository name, the Slack incoming webhook URL, and an optional list of message fields. The viewName field scopes the action to a specific repository or view. The url field must be a Slack incoming webhook URL in the format https://hooks.slack.com/services/..., obtained from your Slack app configuration. The fields array defines message content as key-value pairs; the value field supports LogScale alert context variables enclosed in braces (for example, {events_str}, {query_time_interval}). Set useProxy to true to route the webhook request through the HTTP proxy configured for your LogScale deployment. The table following describes each field in the CreateSlackAction input type.

Table: CreateSlackAction Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
fieldsSlackFieldEntryInputyes Long-Term Fields to include within the Slack message. Can be templated with values from the result. See SlackFieldEntryInput.
labelsStringyes   Labels to categorize the action.
nameStringyes Long-Term Name of the action.
urlStringyes Long-Term Slack webhook URL to where request is to be sent.
useProxyBooleanyes Long-Term Defines whether the action should use the configured proxy to make web requests.
viewNameStringyes Long-Term Name of the view of the action.

Returned Values

The mutation returns a SlackAction! object with fields describing the created action, including its unique identifier, name, webhook URL, and the configured message fields. Include id in the return fields to retrieve the action identifier for use in subsequent mutations such as updateSlackAction() or testSlackAction().

Table: SlackAction Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
allowedActions[AssetAction]yes Short-Term A list of allowed asset actions. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the action. See AssetCommitMetadata.
displayNamestringyes Long-Term The display name of the action.
fields[SlackFieldEntry]yes Long-Term The fields to include within the Slack message. This can be templated with values from the result. See SlackFieldEntry.
idstringyes Long-Term The unique identifier of the action.
isAllowedToRunbooleanyes Long-Term False if this type of action is disabled because of a security policy, true otherwise.
labels[string]yes Preview The labels associated with the action.
modifiedInfoAssetCommitMetadata  Long-Term Metadata related to the latest modification of the action. See AssetCommitMetadata.
namestringyes Long-Term The name of the action.
packagePackageInstallation  Long-Term The package, if there is one, of which the action is part (see PackageInstallation Table).
packageIdVersionedPackageSpecifier  Long-Term The unique identifier of the package. VersionedPackageSpecifier is a scalar.
requiresOrganizationOwnedQueriesPermissionToEditbooleanyes Long-Term True if this action is used by triggers, where the query is run by the organization. If true, then the OrganizationOwnedQueries permission is required to edit the action.
resourcestringyes Short-Term The resource identifier for the action.
urlstringyes Long-Term The Slack webhook URL where to send the requests.
useProxybooleanyes Long-Term Whether the action should use the configured proxy to make web requests.
yamlTemplateYAMLyes Long-Term A template that can be used to recreate the action. YAML is a scalar.