Security Requirements and Controls

Summary

The deleteFilterAlert() mutation permanently deletes a filter alert from a LogScale view or repository. Filter alerts have no time window and fire on every matching ingested event.

This mutation is deprecated. Use deleteFilterAlertV2() instead. The V2 variant returns a nullable Boolean that distinguishes between successful deletion, a missing alert, and other failure conditions. LogScale will remove deleteFilterAlert() no earlier than version 1.267.

Stability Level Deprecated

Syntax

graphql
deleteFilterAlert(
      input: DeleteFilterAlert!
   ): Boolean!

The input argument is required and accepts a DeleteFilterAlert input object. Provide the unique identifier of the filter alert to delete and the name of the associated view or repository. Use the Show Filter Alerts Query in the preceding Related section to retrieve the filter alert identifier.

The mutation returns a non-null Boolean!. A value of true confirms successful deletion. This mutation does not distinguish between a missing alert and other failure conditions; use deleteFilterAlertV2() for that behavior.

Example

Raw
graphql
mutation {
  deleteFilterAlert(input: 
       {viewName: "humio", 
        id: "abc123"}
  )
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  deleteFilterAlert(input: 
       {viewName: \"humio\", 
        id: \"abc123\"}
  )
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  deleteFilterAlert(input: 
       {viewName: \"humio\", 
        id: \"abc123\"}
  )
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  deleteFilterAlert(input:  ^
       {viewName: \"humio\",  ^
        id: \"abc123\"} ^
  ) ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  deleteFilterAlert(input: 
       {viewName: \"humio\", 
        id: \"abc123\"}
  )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  deleteFilterAlert(input: 
       {viewName: \"humio\", 
        id: \"abc123\"}
  )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  deleteFilterAlert(input: 
       {viewName: \"humio\", 
        id: \"abc123\"}
  )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  deleteFilterAlert(input: 
       {viewName: \"humio\", 
        id: \"abc123\"}
  )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "deleteFilterAlert": true
  }
}

Input Parameters

The required input argument accepts a DeleteFilterAlert object. Provide the unique identifier of the filter alert to delete and the name of the associated view or repository. Use the Show Filter Alerts Query in the Related section to retrieve the filter alert identifier.

Table: DeleteFilterAlert Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
idStringyes Long-Term The unique identifier of the filter alert to delete.
viewNameRepoOrViewNameyes Long-Term Name of the view of the filter alert. RepoOrViewName is a scalar.