๐ŸŽฏAPI Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The deleteAggregateAlertV2() mutation permanently removes an aggregate alert from a LogScale repository or view. It returns true if successful, false if the alert does not exist, and null with errors for other failures. To pause an alert without deleting it, use disableAggregateAlertV2() instead.

Syntax

graphql
deleteAggregateAlertV2(
      input: DeleteAggregateAlert!
   ): Boolean

The required input argument takes a DeleteAggregateAlert object. Provide the unique identifier of the aggregate alert to delete and the name of the associated repository or view. The mutation returns Boolean: true on success, false if the alert does not exist, or null with errors for other failures.

Example

Raw
graphql
mutation {
  deleteAggregateAlertV2(input:
     {viewName: "humio", 
      id: "abc123" } )
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  deleteAggregateAlertV2(input:
     {viewName: \"humio\", 
      id: \"abc123\" } )
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  deleteAggregateAlertV2(input:
     {viewName: \"humio\", 
      id: \"abc123\" } )
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  deleteAggregateAlertV2(input: ^
     {viewName: \"humio\",  ^
      id: \"abc123\" } ) ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  deleteAggregateAlertV2(input:
     {viewName: \"humio\", 
      id: \"abc123\" } )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  deleteAggregateAlertV2(input:
     {viewName: \"humio\", 
      id: \"abc123\" } )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  deleteAggregateAlertV2(input:
     {viewName: \"humio\", 
      id: \"abc123\" } )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  deleteAggregateAlertV2(input:
     {viewName: \"humio\", 
      id: \"abc123\" } )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "deleteAggregateAlertV2": true
  }
}

Input Parameters

Provide the unique identifier of the aggregate alert to delete and the name of the associated repository or view. Use the repositories() query in the preceding Related section to retrieve aggregate alert identifiers.