removeAlertLabelV2()

Summary

You can include labels with alerts, but you may have only ten labels for each alert. Therefore, you may want to delete some labels as you go along. You can use the removeAlertLabelV2() GraphQL mutation to remove a label. However, this mutation is deprecated since it doesn't support multiple labels. It will be removed at the earliest in version 1.273. Use instead removeLegacyAlertLabels().

There is no mutation for changing labels. Instead, you'll have to use this mutation or the new one, and then use addLegacyAlertLabels() to add new labels.

Hide Query Example

Show Alert Labels Query

To get a list of alert labels for a repository, you could execute the repository() query like this:

graphql

query {
     repository ( name: "humio" )
      { alerts { id, name, labels } }
   }

For more information on alerts, see the Triggers documentation page. To manage labels through the UI, see the Manage Triggers page of the main documentation.

API Stability Deprecated

Syntax

graphql

removeAlertLabelV2(
     input: RemoveAlertLabel!
   ): Alert!

For the input, you have to give the name of the view or repository, and the unique identifier of the alert from which you want to remove a label (click on Show Query below). And, you'll have to provide the label to remove. See the Input Parameters section for details.

For the return datatype for this mutation, you can get details on the alert, including a list of labels for it. See the Returned Values section farther down this page.

Hide Query Example

Show Alert Identifiers Query

To get a list of all alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { alerts { name, id } }
   }

With these results you can use an alert's unique identifier to remove a label from it.

Example

Raw

graphql

mutation {
  removeAlertLabelV2( input:
    { viewName: "humio",
      id: "abc123",
      label: "late" 
    }
  )
  { labels }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeAlertLabelV2( input: ^
    { viewName: \"humio\", ^
      id: \"abc123\", ^
      label: \"late\"  ^
    } ^
  ) ^
  { labels } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeAlertLabelV2": {
      "labels": [
        "humioator"
      ]
    }
  }
}

Input Parameters

For the input, you'll have to give the unique identifier of the alert, the name of the related view or repository, and the label you want to remove from the alert. Click on the Show Query link under the Syntax section above for an example of how to get the alert identifiers.

Table: RemoveAlertLabel Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 19, 2024
id	string	yes	`Long-Term`	The unique identifier of the alert.
label	string	yes	`Long-Term`	The label for the alert.
viewName	string	yes	`Long-Term`	Name of the view of the alert.

Returned Values

You can get the query string used by the alert, what actions are triggered, and any error messages when it was last executed. Be sure to include labels so you can see the results of your removal, in case there are others you want to eliminate or some you want to add.

Table: Alert Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 29, 2025
actions	string	yes	`Long-Term`	List of identifiers for actions to fire on query result.
actionsV2	[Action]	yes	`Long-Term`	List of unique identifiers for actions to fire on query result. See Action.
allowedActions	[AssetAction]	yes	`Short-Term`	List of allowed actions. See AssetAction .
createdInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the creation of the alert. See AssetCommitMetadata.
description	string		`Long-Term`	Description of alert.
displayName	string	yes	`Long-Term`	Name of the alert.
enabled	boolean	yes	`Long-Term`	Flag indicating whether the alert is enabled.
id	string	yes	`Long-Term`	The identifier of the alert.
labels	[string]	yes	`Long-Term`	Labels attached to the alert.
lastError	string		`Long-Term`	Last error encountered while running the alert.
lastWarnings	[string]	yes	`Long-Term`	Last warnings encountered while running the alert.
name	string	yes	`Long-Term`	The name of the alert.
package	PackageInstallation		`Long-Term`	A package installation. See PackageInstallation.
packageId	VersionedPackageSpecifier		`Long-Term`	The unique identifier of the package installed, if one was used. VersionedPackageSpecifier is a scalar.
queryOwnership	QueryOwnership	yes	`Long-Term`	Ownership of the query run by the alert. See QueryOwnership.
queryStart	string	yes	`Long-Term`	Start of the relative time interval for the query.
queryString	string	yes	`Long-Term`	LogScale query to execute.
resource	string	yes	`Short-Term`	The resource identifier for the alert.
runAsUser	User		`Long-Term`	Identifier of user by which the alert is run. See User.
throttleField	string		`Long-Term`	Field on which to throttle alert.
throttleTimeMillis	long	yes	`Long-Term`	Throttle time in milliseconds.
timeOfLastTrigger	long		`Long-Term`	UNIX timestamp for when the alert was last triggered.
yamlTemplate	string	yes	`Long-Term`	The yaml formatted text that describes the alert.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes