๐ŸŽฏAPI Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The enableFilterAlertV2() mutation enables a filter alert in a specified view or repository. Filter alerts have no time window; LogScale evaluates them against every matching ingested event. Use this mutation to restore evaluation after disabling a filter alert with disableFilterAlertV2(). The mutation returns the updated FilterAlert object, confirming the new alert state in the same call.

Syntax

graphql
enableFilterAlertV2(
      input: EnableFilterAlert!
   ): FilterAlert

The mutation takes a single required input argument of type EnableFilterAlert!. Provide the viewName of the view or repository that contains the alert, and the id of the filter alert to enable. The mutation returns a nullable FilterAlert object. A null return indicates that no filter alert with the specified id exists in the given view or repository.

The returned FilterAlert object includes the alert's query string, associated actions, and any errors or warnings from the last execution. See the Returned Values section for the full list of available fields.

Example

Raw
graphql
mutation {
  enableFilterAlertV2( input:
    { viewName: "humio",
      id: "abc123" } )
  { id, enabled }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  enableFilterAlertV2( input:
    { viewName: \"humio\",
      id: \"abc123\" } )
  { id, enabled }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  enableFilterAlertV2( input:
    { viewName: \"humio\",
      id: \"abc123\" } )
  { id, enabled }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  enableFilterAlertV2( input: ^
    { viewName: \"humio\", ^
      id: \"abc123\" } ) ^
  { id, enabled } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  enableFilterAlertV2( input:
    { viewName: \"humio\",
      id: \"abc123\" } )
  { id, enabled }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  enableFilterAlertV2( input:
    { viewName: \"humio\",
      id: \"abc123\" } )
  { id, enabled }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  enableFilterAlertV2( input:
    { viewName: \"humio\",
      id: \"abc123\" } )
  { id, enabled }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  enableFilterAlertV2( input:
    { viewName: \"humio\",
      id: \"abc123\" } )
  { id, enabled }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "enableFilterAlertV2": {
      "id": "abc123",
      "enabled": true
    }
  }
}

Input Parameters

Provide the id of the filter alert to enable and the viewName of the view or repository that contains it. To retrieve an alert's identifier, use the Show Filter Alerts Query in the Related section.

Returned Values

The mutation returns a nullable FilterAlert object. A null return indicates the specified alert does not exist in the given view or repository. When the object is present, check the enabled field to confirm the alert is now active. The object also includes the alert's query string, its associated actions, and any errors or warnings captured during the most recent execution. The following table lists all available fields.