removeAggregateAlertLabel()

Summary

The removeAggregateAlertLabel() mutation removes a single label from an aggregate alert in a specified view or repository. This mutation is deprecated. Use removeAggregateAlertLabels() instead, which supports removing multiple labels in a single call and returns the updated aggregate alert object.

This mutation returns only a boolean confirming success or failure. LogScale will remove this mutation no earlier than version 1.273.

To remove multiple labels at once, use removeAggregateAlertLabels(), which returns the updated aggregate alert object. To add labels to an aggregate alert, use addAggregateAlertLabels().

Hide Query Example

Show Aggregate Alert Labels Query

To get a list of aggregate alert labels, execute the repository() query like this:

graphql

query {
     repository ( name: "humio" )
      { aggregateAlerts { labels } }
   }

For more information on saved queries, see the Aggregate alerts documentation page. To manage labels through the UI, see the Manage Triggers page of the main documentation.

Stability Level Deprecated

Syntax

graphql

removeAggregateAlertLabel(
      input: RemoveAggregateAlertLabel!
   ): Boolean!

The mutation takes a single required input argument of type RemoveAggregateAlertLabel. Provide the repository or view name, the aggregate alert ID, and the label to remove. Use the query in the following collapsed example to retrieve aggregate alert IDs before calling this mutation.

The return type Boolean! is non-nullable: the mutation returns true on success and false on failure. To receive the updated aggregate alert object with its current label list after removal, use removeAggregateAlertLabels() instead.

Hide Query Example

Show Aggregate Alert Identifiers Query

To get a list of all aggregate alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { aggregateAlerts { name, id } }
   }

Use an aggregate alert's unique identifier as the value for the id argument.

Example

Raw

graphql

mutation {
  removeAggregateAlertLabel(
    input: { 
      viewName: "humio",
      id: "abc123",
      label: "aggie-alert-1"  }
  )
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeAggregateAlertLabel( ^
    input: {  ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      label: \"aggie-alert-1\"  } ^
  ) ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeAggregateAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"aggie-alert-1\"  }
  )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeAggregateAlertLabel": true
  }
}

Input Parameters

Provide the repository or view name, the unique identifier of the target aggregate alert, and the label to remove. To retrieve aggregate alert identifiers, use the query in the collapsed example in the Syntax section.

Table: RemoveAggregateAlertLabel Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 14, 2026
id	String	yes	`Long-Term`	The unique identifier of the aggregate alert.
label	String	yes	`Long-Term`	The label to remove from the aggregate alert.
viewName	RepoOrViewName	yes	`Long-Term`	The name of the view of the aggregate alert. RepoOrViewName is a scalar.

Returned Values

This mutation returns Boolean!. A value of true indicates the label was removed successfully. A value of false indicates the operation failed. To confirm the updated label set, query repository() after the mutation completes.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes