🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

FDR (Falcon Data Replicator) feeds replicate event data from CrowdStrike Falcon into a LogScale repository using S3-compatible storage. Each feed has a unique identifier and separate feed control settings that govern replication behavior.

The deleteFdrFeed() mutation permanently removes an FDR feed from the specified repository. Deleting a feed stops data replication immediately and removes the feed configuration; this action cannot be undone. On success, the mutation returns true. On failure, the GraphQL errors array in the response body contains the error details.

To suspend a feed without removing its configuration, use updateFdrFeedControl() instead.

Syntax

graphql
deleteFdrFeed(
      input: DeleteFdrFeed!
   ): Boolean!

The input argument is required and takes a DeleteFdrFeed object. Provide the repository name and the unique feed identifier. Use the expandable query in the Related section to retrieve the feed ID from a repository.

The mutation returns a non-null Boolean: true on success. If the feed does not exist or the request is not authorized, the mutation throws a GraphQL error.

Example

Raw
graphql
mutation {
  deleteFdrFeed( input: {
         repositoryName: "humio",
         id: "fdr123"
  } )
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  deleteFdrFeed( input: {
         repositoryName: \"humio\",
         id: \"fdr123\"
  } )
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  deleteFdrFeed( input: {
         repositoryName: \"humio\",
         id: \"fdr123\"
  } )
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  deleteFdrFeed( input: { ^
         repositoryName: \"humio\", ^
         id: \"fdr123\" ^
  } ) ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  deleteFdrFeed( input: {
         repositoryName: \"humio\",
         id: \"fdr123\"
  } )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  deleteFdrFeed( input: {
         repositoryName: \"humio\",
         id: \"fdr123\"
  } )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  deleteFdrFeed( input: {
         repositoryName: \"humio\",
         id: \"fdr123\"
  } )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  deleteFdrFeed( input: {
         repositoryName: \"humio\",
         id: \"fdr123\"
  } )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "deleteFdrFeed": true
  }
}

Input Parameters

Provide the name of the repository that owns the feed and the unique identifier of the feed to delete. The feed identifier is the id field returned by fdrFeed on the repository() query. The Related section contains an expandable query for retrieving this value.

Table: DeleteFdrFeed Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
idStringyes Long-Term The unique identifier of the FDR feed.
repositoryNameStringyes Long-Term The name of the repository of the FDR feed.