Summary

removeAlertLabelV2() removes a single label from a legacy alert in a specified repository or view. Labels organize alerts in the alert management UI and support filtering the alerts list. This mutation is deprecated because it accepts only one label per call. Use removeLegacyAlertLabels() instead, which accepts a list of labels in a single call. LogScale will remove removeAlertLabelV2() at the earliest in version 1.273.

Syntax

graphql
removeAlertLabelV2(
      input: RemoveAlertLabel!
   ): Alert!

Provide the repository or view name, the unique identifier of the target alert, and the label to remove. Select Show Alert Identifiers Query to retrieve alert identifiers. The mutation returns the updated Alert object, which reflects the alert state after label removal.

Hide Query Example

Show Alert Identifiers Query

Example

Raw
graphql
mutation {
  removeAlertLabelV2( input:
    { viewName: "humio",
      id: "abc123",
      label: "late" 
    }
  )
  { labels }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeAlertLabelV2( input: ^
    { viewName: \"humio\", ^
      id: \"abc123\", ^
      label: \"late\"  ^
    } ^
  ) ^
  { labels } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeAlertLabelV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      label: \"late\" 
    }
  )
  { labels }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "removeAlertLabelV2": {
      "labels": [
        "humioator"
      ]
    }
  }
}

Input Parameters

The input argument requires the repository or view name, the unique identifier of the target alert, and the label to remove. To find alert identifiers, use the repository() query shown in the Syntax section.

Table: RemoveAlertLabel Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
idStringyes Long-Term The unique identifier of the alert.
labelStringyes Long-Term The label for the alert.
viewNameStringyes Long-Term Name of the view of the alert.

Returned Values

The mutation returns the updated Alert object. Include labels in your return fields to confirm the removal and review remaining labels. The queryString field contains the LogScale query that triggers the alert. throttleTimeMillis specifies the suppression window in milliseconds; a null value indicates no throttle is active. lastError reports the most recent execution error from the alert.

Table: Alert Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsStringyes Long-Term List of identifiers for actions to fire on query result.
actionsV2Actionyes Long-Term List of unique identifiers for actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term List of allowed actions. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the alert. See AssetCommitMetadata.
descriptionString  Long-Term Description of alert.
displayNameStringyes Long-Term Name of the alert.
enabledBooleanyes Long-Term Flag indicating whether the alert is enabled.
idStringyes Long-Term The identifier of the alert.
labelsStringyes Long-Term Labels attached to the alert.
lastErrorString  Long-Term Last error encountered while running the alert.
lastWarningsStringyes Long-Term Last warnings encountered while running the alert.
nameStringyes Long-Term The name of the alert.
packagePackageInstallation  Long-Term A package installation. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The id of the package that the alert was installed as part of. Stability: Long-term
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this alert Stability: Long-term
queryStartStringyes Long-Term Start of the relative time interval for the query. Stability: Long-term
queryStringStringyes Long-Term LogScale query to execute. Stability: Long-term
resourceStringyes Short-Term The resource identifier for the alert.
runAsUserUser  Long-Term Id of user which the alert is running as. Stability: Long-term
throttleFieldString  Long-Term Field to throttle on. Stability: Long-term
throttleTimeMillisLongyes Long-Term Throttle time in milliseconds. Stability: Long-term
timeOfLastTriggerLong  Long-Term Unix timestamp for when the alert was last triggered. Stability: Long-term
yamlTemplateStringyes Long-Term A YAML formatted string that describes the alert. Stability: Long-term