The createSlackPostMessageAction() GraphQL mutation field may be used to create a post message, Slack action in LogScale.

For more information on creating a Slack action, see the Action Type: Slack documentation page. You may also want to look at the Actions page for related information.

Syntax

Below is the syntax for the createSlackPostMessageAction() mutation field:

graphql
createSlackPostMessageAction(
      input: CreatePostMessageSlackAction!
   ): SlackPostMessageAction!

Below is an example of how this mutation field might be used:

Raw
graphql
mutation {
  createSlackPostMessageAction( input:
     { viewName: "humio",
       name: "my-slack-post-act",
       apiToken: "AUamuZLYvOLGUeMablONDF37FbYIm7U",
       channels: ["#admin"]
       fields: [ {fieldName: "Events String", value: "{events_str}"} ],
       useProxy: false
    } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSlackPostMessageAction( input:
     { viewName: \"humio\",
       name: \"my-slack-post-act\",
       apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
       channels: [\"#admin\"]
       fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
       useProxy: false
    } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createSlackPostMessageAction( input:
     { viewName: \"humio\",
       name: \"my-slack-post-act\",
       apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
       channels: [\"#admin\"]
       fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
       useProxy: false
    } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createSlackPostMessageAction( input: ^
     { viewName: \"humio\", ^
       name: \"my-slack-post-act\", ^
       apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\", ^
       channels: [\"#admin\"] ^
       fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ], ^
       useProxy: false ^
    } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createSlackPostMessageAction( input:
     { viewName: \"humio\",
       name: \"my-slack-post-act\",
       apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
       channels: [\"#admin\"]
       fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
       useProxy: false
    } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  createSlackPostMessageAction( input:
     { viewName: \"humio\",
       name: \"my-slack-post-act\",
       apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
       channels: [\"#admin\"]
       fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
       useProxy: false
    } )
  { id }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createSlackPostMessageAction( input:
     { viewName: \"humio\",
       name: \"my-slack-post-act\",
       apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
       channels: [\"#admin\"]
       fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
       useProxy: false
    } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createSlackPostMessageAction( input:
     { viewName: \"humio\",
       name: \"my-slack-post-act\",
       apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
       channels: [\"#admin\"]
       fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
       useProxy: false
    } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createSlackPostMessageAction": {
      "id": "z6HrAfznuPHFOKVSVg4J9a4qsg9oIsoq"
    }
  }
}

Given Datatypes

For the given datatype, CreatePostMessageSlackAction, there are a few parameters. Below is a list of them along with descriptions of each:

Table: CreatePostMessageSlackAction

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 17, 2024
apiTokenstringyes  API token to authenticate with Slack.
channels[string]yes  List of Slack channels to message.
fields[SlackFieldEntryInput]yes  Fields to include within the Slack message. Can be templated with values from the result. See SlackFieldEntryInput.
namestringyes  Name of the action.
useProxybooleanyes  Defines whether the action should use the configured proxy to make web requests.
viewNamestringyes  Name of the view of the action.

Returned Datatypes

SlackPostMessageAction has several parameters. Below is a list of them:

Table: SlackPostMessageAction

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Oct 3, 2024
allowedActions[AssetAction]yes  A list of allowed asset actions. See AssetAction. This is a preview and subject to change.
apiTokenstringyes  An API token to authenticate with Slack.
channels[string]yes  A list of Slack channels to message.
displayNamestringyes  The display name of the action.
fields[SlackFieldEntry]yes  The fields to include within the Slack message. Can be templated with values from the result See SlackFieldEntry.
idstringyes  The unique identifier of the action.
isAllowedToRunbooleanyes  False if this type of action is disabled because of a security policy, true otherwise.
namestringyes  The name of the action.
packagePackageInstallationyes  The package, if any, of which the action is part (see PackageInstallation Table).
packageIdVersionedPackageSpecifieryes  The unique identifier of the package. VersionedPackageSpecifier is a scalar.
requiresOrganizationOwnedQueriesPermissionToEditbooleanyes  True if this action is used by triggers, where the query is run by the organization. If true, then the OrganizationOwnedQueries permission is required to edit the action.
useProxybooleanyes  Whether the action should use the configured proxy to make web requests.
yamlTemplateyamlyes  A template that can be used to recreate the action.