Summary

The createView() mutation creates a new view in LogScale. A view queries across one or more repositories and applies optional filters to each connection. Use this mutation to provision a view programmatically as part of a repository setup workflow. To update an existing view after creation, use updateView().

API Stability Long-Term

Syntax

graphql
createView(
      name: String!,
      description: String,
      connections: [ViewConnectionInput!],
      federatedViews: [String!],
      isFederated: Boolean
   ): View!

The name argument is required. All other arguments are optional. Provide connections to specify the repositories the view queries and the filters to apply to each. Set isFederated to true and supply federatedViews to create a federated view that spans multiple existing views. The mutation returns a non-null View object containing the full details of the created view.

For the returned values, request id to obtain the new view's unique identifier for use with updateView() and other mutations. The Returned Values section lists all available View fields.

Example

Raw
graphql
mutation {
  createView(
        name: "vh-view",
        description: "V-Host View",
        connections: [ { repositoryName: "humio", filter: "#vhost" } ]
       )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createView(
        name: \"vh-view\",
        description: \"V-Host View\",
        connections: [ { repositoryName: \"humio\", filter: \"#vhost\" } ]
       )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  createView(
        name: \"vh-view\",
        description: \"V-Host View\",
        connections: [ { repositoryName: \"humio\", filter: \"#vhost\" } ]
       )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  createView( ^
        name: \"vh-view\", ^
        description: \"V-Host View\", ^
        connections: [ { repositoryName: \"humio\", filter: \"#vhost\" } ] ^
       ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  createView(
        name: \"vh-view\",
        description: \"V-Host View\",
        connections: [ { repositoryName: \"humio\", filter: \"#vhost\" } ]
       )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  createView(
        name: \"vh-view\",
        description: \"V-Host View\",
        connections: [ { repositoryName: \"humio\", filter: \"#vhost\" } ]
       )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  createView(
        name: \"vh-view\",
        description: \"V-Host View\",
        connections: [ { repositoryName: \"humio\", filter: \"#vhost\" } ]
       )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  createView(
        name: \"vh-view\",
        description: \"V-Host View\",
        connections: [ { repositoryName: \"humio\", filter: \"#vhost\" } ]
       )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "createView": {
      "id": "abc123"
    }
  }
}

Input Parameters

Provide the name of the view to create. Optionally supply a description, specify the repository connections with their filters, and configure federation settings. The following table lists all input parameters:

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation. The connections parameter uses a special datatype; an additional table below describes its fields.
connections [ViewConnectionInput]     A list of repositories to connect to the view, each with an optional filter. Omitting this argument creates a view with no repository connections.
description string     A human-readable description of the view's purpose. Omitting this argument leaves the description empty.
federatedViews [string]     A list of existing view names to include in this federated view. Provide this argument when isFederated is true.
isFederated boolean   false When true, the view aggregates query results across the views listed in federatedViews.
name string yes   The unique name for the view. This name identifies the view throughout LogScale.

Each entry in connections specifies a repository name and an optional filter to restrict the data the view draws from that repository. The following table describes the ViewConnectionInput fields:

Table: ViewConnectionInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
filterStringyes Long-Term The filter applied to all results from the repository.
languageVersionLanguageVersionEnum  Long-Term The version of human language to use. See LanguageVersionEnum.
repositoryNameStringyes Long-Term The name of the connected repository.

Returned Values

The mutation returns a non-null View! object. Request id to obtain the unique identifier assigned to the new view. Use this identifier with updateView() and other mutations that reference an existing view.

Table: View Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Jun 22, 2026 
action(id: string): Actionmultipleyes Long-Term A saved action. The id is the unique identifier of the action. See Action.
actions(actionIds: [string]): [Action]multipleyes Long-Term A list of saved actions. See Action.
aggregateAlert(id: string): AggregateAlertmultipleyes Long-Term A saved aggregate alert. See AggregateAlert.
aggregateAlerts[AggregateAlert]yes Long-Term Saved aggregate alerts. See AggregateAlert.
alert(id: string): Alertmultipleyes Long-Term A saved alert. See Alert.
alerts[Alert]yes Long-Term Saved alerts. See Alert.
allowedViewActions[ViewAction]yes Long-Term Returns all actions the user is allowed to perform on the view. See ViewAction.
automaticSearchbooleanyes Long-Term Whether the search is executed automatically.
availablePackages(filter: string, tags: [PackageTag], categories: [string]): [PackageRegistrySearchResultItem]multiple  Long-Term Returns a list of available packages that can be installed. PackageTag is a scalar. See PackageRegistrySearchResultItem.
checkClusterConnections[ClusterConnectionStatus]  Short-Term Check all of this search domain's cluster connections. This is a preview and subject to change. See ClusterConnectionStatus.
clusterConnection(id: string): ClusterConnectionmultiple  Short-Term A specific cluster connection. See ClusterConnection.
clusterConnections[ClusterConnection]  Short-Term The search domain's cluster connections. See ClusterConnection.
connections[ViewConnection]yes Long-Term The connections for the view. This is a preview and subject to change. See ViewConnection.
crossOrgConnections[CrossOrgViewConnection]yes Short-Term The connections for the cross organization connections (see CrossOrgViewConnection Table).
dashboard(id: string): Dashboardmultipleyes Long-Term A saved dashboard. See Dashboard.
dashboards[Dashboard]yes Long-Term Saved dashboards. See Dashboard.
defaultQuerySavedQuery  Long-Term The default saved query. See SavedQuery.
deletedDatelong  Long-Term The point in time the search domain was marked for deletion.
descriptionstring  Long-Term A description of the view.
fileFieldSearch(fileName: string, fieldName: string, prefixFilter: string, valueFilters: [FileFieldFilterType], fieldsToInclude: [string], maxEntries: integer): [DictionaryEntryType]multipleyes Long-Term The fields to search in a given file. See FileFieldFilterType and DictionaryEntryType.
files[File]yes Long-Term A list of files used. See File.
filterAlert(id: string): FilterAlertmultipleyes Long-Term A saved filter alert. See FilterAlert.
filterAlerts[FilterAlert]yes Long-Term Saved filter alerts. See FilterAlert.
groups[Group]yes Long-Term Groups with assigned roles. See Group.
hasPackageInstalled(packageId: VersionedPackageSpecifier): booleanmultipleyes Long-Term Determines whether package has been installed. VersionedPackageSpecifier is a scalar.
idstringyes Long-Term The unique identifier of the view.
installedPackages[PackageInstallation]yes Long-Term List packages installed on a specific view or repository See PackageInstallation.
interactions[ViewInteraction]yes Long-Term All interactions defined for the view. See ViewInteraction.
isActionAllowed(action: ViewAction): booleanmultipleyes Long-Term Determines whether current user is allowed to perform the given action on the view. See ViewAction.
isFederatedbooleanyes Preview Whether the view is Federated. This is a preview and subject to change.
isStarredbooleanyes Long-Term Whether the view should be marked with a star.
nameRepoOrViewNameyes Long-Term The name of the repository or view. RepoOrViewName is a scalar.
packageV2(packageId: VersionedPackageSpecifier): Package2multiple  Long-Term Returns a specific version of a package given a package version. VersionedPackageSpecifier is a scalar. See Package2.
packageVersions(packageId: UnversionedPackageSpecifier): [RegistryPackageVersionInfo]multiple  Long-Term The available versions of a package. UnversionedPackageSpecifier is a scalar. See RegistryPackageVersionInfo.
permanentlyDeletedAtlong  Long-Term The point in time the search domain will not be restorable anymore.
persistedAggregations(sortBy: PersistedAggregationSortBy, orderBy: OrderBy, skip: integer, limit: integer): PersistedAggregationResultSetmultiple  Preview 

List of persisted aggregations for view, with sorting and pagination. See PersistedAggregationSortBy.

recentQueriesV2[RecentQuery]yes Long-Term List of recent queries. See RecentQuery.
redirectQueryAssetLookupToSearchDomain  Preview The redirected query asset lookup view used for asset resolution when set. Assets like saved queries and lookup files will be resolved from this view instead of the current view. See SearchDomain.
reposExcludedInSearchLimit[string]yes Long-Term Repositories not part of the search limitation.
resourcestringyes Short-Term The resource identifier for the search domain.
savedQueries[SavedQuery]yes Long-Term A list of saved queries. See SavedQuery.
savedQuery(id: string): SavedQuerymultipleyes Long-Term A saved query. See SavedQuery.
scheduledReport(id: string): ScheduledReportmultiple  Long-Term Saved scheduled report. See ScheduledReport.
scheduledReports[ScheduledReport]yes Long-Term Saved scheduled reports See ScheduledReport.
scheduledSearch(id: string): ScheduledSearchmultipleyes Long-Term A saved scheduled search. See ScheduledSearch.
scheduledSearches[ScheduledSearch]yes Long-Term Saved scheduled searches. See ScheduledSearch.
searchLimitedMslong  Long-Term Search limit in milliseconds, by which searches are limited.
starredFields[string]yes Long-Term Fields marked with a star.
tags[string]yes Long-Term All tags from all datasources.
users[User]yes Long-Term Users who have access. See User.
usersAndGroups(search: string, skip: integer, limit: integer): UsersAndGroupsSearchResultSetmultiple  Long-Term Users or groups who have access. See UsersAndGroupsSearchResultSet.
usersV2(search: string, permissionFilter: Permission, skip: integer, limit: integer): Usersmultiple  Short-Term Search users with a given permission. See Users.
viewerQueryPrefixstringyes Long-Term The query prefix prepended to each search in the domain.