🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The installPackageFromRegistryV2() mutation installs a package from the registry into a specific view or repository. Provide the target view name and the versioned package identifier in scope/name@version format, for example crowdstrike/logscale-slack@1.0.0. The optional queryOwnershipType argument controls whether scheduled searches and saved queries instantiated from the package's templates are owned by the organization or by the installing user. To upgrade an already-installed package, use updatePackageFromRegistryV2(). To remove an installed package, use uninstallPackage().

Syntax

graphql
installPackageFromRegistryV2(
      InstallPackageFromRegistryInput: InstallPackageFromRegistryInput!
   ): InstallPackageFromRegistryResult!

The mutation takes a single required argument, InstallPackageFromRegistryInput, an input object with two required fields — viewName and packageId — and one optional field, queryOwnershipType. Setting queryOwnershipType to Organization makes scheduled searches and saved queries from the package's templates visible to all users with access to the repository. Setting it to User assigns ownership to the installing user. If omitted, LogScale applies the system default.

The mutation returns an InstallPackageFromRegistryResult object. This object is non-nullable — the mutation always returns a result on success. Request package.id to confirm the installed package identifier. See the Returned Values section for details on all available fields.

Example

Raw
graphql
mutation {
  installPackageFromRegistryV2 (
    InstallPackageFromRegistryInput: {
        viewName: "humio",
        packageId: "crowdstrike/logscale-slack@1.0.0",
        queryOwnershipType: User }
  )
  { package {id} }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  installPackageFromRegistryV2 (
    InstallPackageFromRegistryInput: {
        viewName: \"humio\",
        packageId: \"crowdstrike/logscale-slack@1.0.0\",
        queryOwnershipType: User }
  )
  { package {id} }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  installPackageFromRegistryV2 (
    InstallPackageFromRegistryInput: {
        viewName: \"humio\",
        packageId: \"crowdstrike/logscale-slack@1.0.0\",
        queryOwnershipType: User }
  )
  { package {id} }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  installPackageFromRegistryV2 ( ^
    InstallPackageFromRegistryInput: { ^
        viewName: \"humio\", ^
        packageId: \"crowdstrike/logscale-slack@1.0.0\", ^
        queryOwnershipType: User } ^
  ) ^
  { package {id} } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  installPackageFromRegistryV2 (
    InstallPackageFromRegistryInput: {
        viewName: \"humio\",
        packageId: \"crowdstrike/logscale-slack@1.0.0\",
        queryOwnershipType: User }
  )
  { package {id} }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  installPackageFromRegistryV2 (
    InstallPackageFromRegistryInput: {
        viewName: \"humio\",
        packageId: \"crowdstrike/logscale-slack@1.0.0\",
        queryOwnershipType: User }
  )
  { package {id} }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  installPackageFromRegistryV2 (
    InstallPackageFromRegistryInput: {
        viewName: \"humio\",
        packageId: \"crowdstrike/logscale-slack@1.0.0\",
        queryOwnershipType: User }
  )
  { package {id} }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  installPackageFromRegistryV2 (
    InstallPackageFromRegistryInput: {
        viewName: \"humio\",
        packageId: \"crowdstrike/logscale-slack@1.0.0\",
        queryOwnershipType: User }
  )
  { package {id} }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "installPackageFromRegistryV2": {
      "package": {
         "id": "crowdstrike/logscale-slack@1.0.0"
      }
    }
  }
}

Input Parameters

The input type requires the name of the target view or repository and the versioned package identifier. The packageId field accepts a VersionedPackageSpecifier scalar in scope/name@version format. The viewName field identifies the repository or view into which the package is installed. The optional queryOwnershipType field, available since version 1.100, determines ownership of scheduled searches and saved queries created from the package's templates. The following table lists the parameters:

Table: InstallPackageFromRegistryInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
packageIdVersionedPackageSpecifieryes Long-Term The unique identifier of the package. VersionedPackageSpecifier. is a scalar value.
queryOwnershipTypeQueryOwnershipType  Long-Term The query ownership type. See QueryOwnershipType.
viewNameRepoOrViewNameyes Long-Term The name of the view. RepoOrViewName. is a scalar value.

Returned Values

The returned object provides access to the installed package through its package field, which returns the full Package2 type. Request package.id to confirm the installed package identifier. The Package2 type exposes all template categories bundled in the package — including dashboards, parsers, alerts, aggregate alerts, filter alerts, scheduled searches, saved queries, actions, and lookup files — along with metadata fields such as name, version, description, author, minHumioVersion, and licenseUrl. The following table links to the sub-parameters for the returned type:

Table: InstallPackageFromRegistryResult Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
packagePackage2yes Long-Term The package from which to install. See Package2.