removeAggregateAlertLabels()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The removeAggregateAlertLabels() mutation removes one or more labels from an existing aggregate alert in a repository or view. You can remove up to 100 labels per call. Each aggregate alert supports at most ten labels, so remove unused labels to free capacity before adding new ones with addAggregateAlertLabels().

On success, the mutation returns the updated AggregateAlert object. On failure, it returns null with error details.

No mutation exists for renaming or replacing labels directly. To change a label, use removeAggregateAlertLabels() to remove the existing label, then use addAggregateAlertLabels() to add the new one.

Hide Query Example

Show Aggregate Alert Labels Query

To retrieve a list of aggregate alert labels, execute the repository() query like this:

graphql

query {
     repository ( name: "humio" )
      { aggregateAlerts { labels } }
   }

For more information on aggregate alerts, see the Aggregate alerts documentation page. To manage labels through the UI, see the Triggers and Manage Triggers pages of the main documentation.

Syntax

graphql

removeAggregateAlertLabels(
      input: RemoveAggregateAlertLabels!
   ): AggregateAlert

The mutation takes a single required input argument of type RemoveAggregateAlertLabels. Provide the repository or view name, the aggregate alert ID, and the list of labels to remove. The return type AggregateAlert is nullable: the mutation returns the updated alert on success and null on failure. A null result indicates the alert was not found or the labels could not be removed.

Use the query in the following collapsed example to retrieve aggregate alert IDs before calling this mutation.

Hide Query Example

Show Aggregate Alert Identifiers Query

To get a list of all aggregate alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { aggregateAlerts { name, id } }
   }

Use an aggregate alert's unique identifier from these results to remove labels from it.

Example

Raw

graphql

mutation {
  removeAggregateAlertLabels(
    input: { 
      viewName: "humio",
      id: "abc123",
      labels: [ "night-shift" ] }
  )
  {enabled, labels }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"night-shift\" ] }
  )
  {enabled, labels }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"night-shift\" ] }
  )
  {enabled, labels }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeAggregateAlertLabels( ^
    input: {  ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      labels: [ \"night-shift\" ] } ^
  ) ^
  {enabled, labels } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"night-shift\" ] }
  )
  {enabled, labels }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"night-shift\" ] }
  )
  {enabled, labels }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"night-shift\" ] }
  )
  {enabled, labels }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeAggregateAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"night-shift\" ] }
  )
  {enabled, labels }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeAggregateAlertLabels": {
      "enabled": true,
      "labels": [ "aggie-alert",
                "admin-focus" ]
    }
  }
}

Input Parameters

Provide the repository or view name, the unique identifier of the target aggregate alert, and the list of labels to remove. You can remove up to 100 labels per call. To retrieve aggregate alert identifiers, use the query in the collapsed example in the preceding Syntax section.

Returned Values

The mutation returns the updated AggregateAlert object. Include labels in your return fields to confirm which labels remain after the removal. You can also retrieve the query string, triggered actions, and trigger mode from the returned object.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes