Security Requirements and Controls

Summary

The killQuery() mutation terminates a running query in LogScale. Use it to stop a long-running or resource-intensive query before it completes. Call runningQueries() first to list active queries and retrieve the pattern value required by this mutation.

API Stability Short-Term

Syntax

graphql
killQuery(
      viewName: String!, pattern: String!
   ): BooleanResultType!

Both viewName and pattern are required. Provide the name of the view or repository that owns the query, and a pattern string that identifies the query to terminate. The mutation returns a BooleanResultType indicating whether the termination succeeded.

Example

Raw
graphql
mutation {
  killQuery (
    viewName: "humio",
    pattern: "localhost"
  )
  { result }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  killQuery (
    viewName: \"humio\",
    pattern: \"localhost\"
  )
  { result }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  killQuery (
    viewName: \"humio\",
    pattern: \"localhost\"
  )
  { result }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  killQuery ( ^
    viewName: \"humio\", ^
    pattern: \"localhost\" ^
  ) ^
  { result } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  killQuery (
    viewName: \"humio\",
    pattern: \"localhost\"
  )
  { result }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  killQuery (
    viewName: \"humio\",
    pattern: \"localhost\"
  )
  { result }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  killQuery (
    viewName: \"humio\",
    pattern: \"localhost\"
  )
  { result }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  killQuery (
    viewName: \"humio\",
    pattern: \"localhost\"
  )
  { result }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "killQuery": {
      "result": true
    }
  }
}

Input Parameters

Both parameters are required. Supply the view or repository name and a pattern that matches the query you want to terminate.

Table: Input Parameters and Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
pattern string yes   A string pattern that identifies the running query to terminate. Obtain this value from the runningQueries() response before calling this mutation.
viewName string yes   The name of the view or repository in which the target query is running.

Returned Values

The mutation returns a BooleanResultType indicating whether the query was successfully terminated. A true result confirms termination; false indicates the query was not found or could not be stopped.

Table: BooleanResultType Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
resultBooleanyes Long-Term Whether the mutation was performed successfully.