disableFilterAlertV2()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The disableFilterAlertV2() mutation disables an active filter alert in a LogScale repository or view. Filter alerts fire on every matching ingested event; disabling an alert stops it from triggering actions and generating notifications while preserving its configuration. To re-enable the alert, use enableFilterAlertV2().

To re-enable a disabled filter alert, use enableFilterAlertV2(). To create a filter alert, use createFilterAlert(). To update a filter alert's configuration, use updateFilterAlertV2(). To delete a filter alert, use deleteFilterAlertV2().

Hide Query Example

Show Filter Alerts Query

To retrieve filter alerts for a repository, use the repository() query. The following example returns alert IDs and names:

graphql

query {
     repository( name: "humio" )
      { filterAlerts { id, name } } 
   }

For more information on filter alerts, see the Filter Alerts documentation page.

Syntax

graphql

disableFilterAlertV2(
      input: DisableFilterAlert!
   ): FilterAlert

The required input argument accepts a DisableFilterAlert! object. Provide the repository or view name in viewName and the filter alert identifier in id.

The mutation returns a nullable FilterAlert object with enabled set to false. A null return indicates the specified alert was not found. Retrieve filter alert identifiers with the repository() query before calling this mutation.

Example

Raw

graphql

mutation {
  disableFilterAlertV2( input:  
    { viewName: "humio",
      id: "abc123" 
    } )
  { id, enabled }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  disableFilterAlertV2( input:  
    { viewName: \"humio\",
      id: \"abc123\" 
    } )
  { id, enabled }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  disableFilterAlertV2( input:  
    { viewName: \"humio\",
      id: \"abc123\" 
    } )
  { id, enabled }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  disableFilterAlertV2( input:   ^
    { viewName: \"humio\", ^
      id: \"abc123\"  ^
    } ) ^
  { id, enabled } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  disableFilterAlertV2( input:  
    { viewName: \"humio\",
      id: \"abc123\" 
    } )
  { id, enabled }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  disableFilterAlertV2( input:  
    { viewName: \"humio\",
      id: \"abc123\" 
    } )
  { id, enabled }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  disableFilterAlertV2( input:  
    { viewName: \"humio\",
      id: \"abc123\" 
    } )
  { id, enabled }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  disableFilterAlertV2( input:  
    { viewName: \"humio\",
      id: \"abc123\" 
    } )
  { id, enabled }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "disableFilterAlertV2": {
      "id": "abc123",
      "enabled": false
    }
  }
}

Input Parameters

The input argument requires the filter alert identifier in id and the repository or view name in viewName. Retrieve filter alert identifiers with the repository() query.

Returned Values

The mutation returns a nullable FilterAlert object. The returned object reflects the alert with enabled set to false. A null return indicates the specified alert was not found. You can inspect the query string the alert monitors, the actions it triggers, and any errors or warnings from its last execution. All available fields are described in the FilterAlert datatype.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes