removeFilterAlertLabels()

🎯API Stability

Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The removeFilterAlertLabels() mutation removes one or more labels from an existing filter alert in a LogScale view or repository. Each call accepts up to 100 labels for removal; each filter alert supports at most ten.

This mutation is the recommended replacement for the deprecated removeFilterAlertLabel(), which supports only one label per call. On success, the mutation returns the updated FilterAlert object. On failure, it returns null with errors.

To rename or replace a label, remove the unwanted label with removeFilterAlertLabels(), then add the replacement with addFilterAlertLabels(). No mutation renames a label directly.

Hide Query Example

Show Filter Alert Labels Query

To get the current labels for filter alerts, execute the repository() query like this:

graphql

query {
     repository ( name: "humio" )
      { filterAlerts { labels } }
   }

For more information on filter alerts, see Filter alerts. To manage labels through the UI, see Manage Triggers.

Syntax

graphql

removeFilterAlertLabels(
      input: RemoveFilterAlertLabels!
   ): FilterAlert

The required input argument takes a RemoveFilterAlertLabels object. Provide the view or repository name, the unique identifier of the target filter alert, and the list of labels to remove. See the Input parameters section for details on each field.

Hide Query Example

Show Filter Alert Identifiers Query

To get a list of all filter alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { filterAlerts { name, id } }
   }

Use the filter alert's unique identifier as the id value in the mutation input.

Input parameters

Provide the view or repository name in viewName, the unique identifier of the target filter alert in id, and the labels to remove in labels. The mutation removes only the specified labels; all other labels remain unchanged. Use the repository() query to retrieve filter alert identifiers.

Example

Raw

graphql

mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: "humio",
      id: "abc123",
      labels: [ "key-alerts" ]
  )
  {enabled, labels }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeFilterAlertLabels( ^
    input: {  ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      labels: [ \"key-alerts\" ] ^
  ) ^
  {enabled, labels } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeFilterAlertLabels": {
      "enabled": true,
      "labels": [ "manager-alerts",
                  "admin-focus" ]
    }
  }
}

Returned values

The mutation returns the updated FilterAlert object on success. Use labels to confirm which labels remain on the alert after removal — this field reflects the current label set, not the labels that were removed. To identify labels to add, use addFilterAlertLabels(). The object also includes the alert query string, configured actions, and any errors or warnings from the last execution.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL Queries

GraphQL Datatypes