removeFilterAlertLabel()

Summary

The removeFilterAlertLabel() mutation removes a single label from an existing filter alert in a LogScale view or repository.

This mutation is deprecated. It supports only one label per call. Use removeFilterAlertLabels() instead, which supports up to 100 labels per call and returns the updated FilterAlert object. LogScale will remove this mutation no earlier than version 1.273.

To remove multiple labels in a single call, use removeFilterAlertLabels(), which supports up to 100 labels and returns the updated filter alert. To add labels, use addFilterAlertLabels().

Hide Query Example

Show Filter Alert Labels Query

Use the repository() query to list filter alert labels:

graphql

query {
     repository ( name: "humio" )
      { filterAlerts { labels } }
   }

For more information on filter alerts, see the Filter alerts documentation page. To manage labels through the UI, see the Manage Triggers page of the main documentation.

Stability Level Deprecated

Syntax

graphql

removeFilterAlertLabel(
      input: RemoveFilterAlertLabel!
   ): Boolean!

The required input argument accepts a RemoveFilterAlertLabel input object. Provide the view or repository name in viewName, the unique identifier of the target filter alert in id, and the label to remove in label. Use the repository() query to retrieve filter alert identifiers before calling this mutation.

This mutation returns Boolean! — true on success. Use removeFilterAlertLabels() instead to receive the updated FilterAlert object, including the current label set.

Hide Query Example

Show Filter Alert Identifiers Query

To get a list of all filter alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { filterAlerts { name, id } }
   }

Use a filter alert's unique identifier as the id value when removing a label.

Example

Raw

graphql

mutation {
  removeFilterAlertLabel(
    input: { 
      viewName: "humio",
      id: "abc123",
      label: "alert-1"  }
  )
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeFilterAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"alert-1\"  }
  )
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeFilterAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"alert-1\"  }
  )
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeFilterAlertLabel( ^
    input: {  ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      label: \"alert-1\"  } ^
  ) ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeFilterAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"alert-1\"  }
  )
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeFilterAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"alert-1\"  }
  )
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeFilterAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"alert-1\"  }
  )
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeFilterAlertLabel(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      label: \"alert-1\"  }
  )
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeFilterAlertLabel": true
  }
}

Input Parameters

Provide the view or repository name in viewName, the unique identifier of the target filter alert in id, and the label to remove in label. Use the Show Filter Alert Identifiers Query in the Syntax section to retrieve filter alert identifiers.

Table: RemoveFilterAlertLabel Input Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 14, 2026
id	String	yes	`Long-Term`	The unique identifier of the filter alert.
label	String	yes	`Long-Term`	The label to remove from the filter alert.
viewName	RepoOrViewName	yes	`Long-Term`	The name of the view of the filter alert. RepoOrViewName is a scalar.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes