removeFilterAlertLabels()

Stability Level

Long-Term

You can include labels with filter alerts, but you may have only ten labels for each. Therefore, you may want to delete some labels, eventually. Use the removeFilterAlertLabels() GraphQL mutation to remove labels from a filter alert — at most one-hundred at a time. This mutation will return information on the updated filter alert if successful — null with errors, if not.

There is no mutation for changing labels. Instead, you'll have to use this mutation to delete ones you don't want, and then use addFilterAlertLabels() to add new labels.

Hide Query Example

Show Filter Alert Labels Query

To get lists of filter alert labels, you could execute the repositories() query like this:

graphql

query {
     repositories
      { id, name, 
        alerts { labels } }
   }

For more information on filter alerts, see the Filter alerts documentation page. To manage labels through the UI, see the Manage Triggers page of the main documentation.

Syntax

graphql

removeFilterAlertLabels(
      input: RemoveFilterAlertLabels!
   ): FilterAlert

For the input, you have to give the name of the view or repository, and the unique identifier of the filter alert from which you want to remove labels (click on Show Query below). You'll also need to provide within brackets, a comma-separated list of labels to add.

For the return datatype, you can get details on the filter alert, including a list of labels for it. See the Returned Datatype section farther down this page.

Hide Query Example

Show Filter Alert Identifiers Query

To get a list of all filter alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { filterAlerts { name, id } }
   }

With these results you can use a filter alert's unique identifier to add labels to it.

Example

Raw

graphql

mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: "humio",
      id: "abc123",
      labels: [ "key-alerts" ]
  )
  {enabled, labels }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeFilterAlertLabels( ^
    input: {  ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      labels: [ \"key-alerts\" ] ^
  ) ^
  {enabled, labels } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeFilterAlertLabels(
    input: { 
      viewName: \"humio\",
      id: \"abc123\",
      labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeFilterAlertLabels": {
      "enabled": true,
      "labels": [ "manager-alerts",
                  "admin-focus" ]
    }
  }
}

Given Datatype

For this input datatype, you'll have to give the unique identifier of the filter alert, the name of the related view or repository, and the labels you want to remove from the filter alert. Click on the Show Query link under the Syntax section above for an example of how to get the filter alert identifiers.

Table: RemoveFilterAlertLabels

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Nov 14, 2025
id	string	yes	`Long-Term`	The unique identifier of the filter alert.
labels	[string]	yes	`Long-Term`	Labels to remove from the filter alert, at most one-hundred at a time.
viewName	RepoOrViewName	yes	`Long-Term`	The name of the view of the filter alert. RepoOrViewName is a scalar.

Returned Datatype

You can get the query string used by the alert, what actions are triggered, and any errors or warnings when it was last executed. Related more specifically to this mutation, you can use the labels parameter to get a list of labels associated with the filter alert, in case you want to add some or remove more. These and other parameters are listed in the table below, along with links to related datatype tables.

Table: FilterAlert

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Feb 10, 2026
actions	[Action]	yes	`Long-Term`	List of unique identifiers for actions to fire on query result. See Action.
allowedActions	[AssetAction]	yes	`Short-Term`	List of actions allowed on which to filter query results. See AssetAction .
createdInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the creation of the filter alert. See AssetCommitMetadata.
description	string		`Long-Term`	Description of the filter alert.
enabled	boolean	yes	`Long-Term`	Whether the filter alert is enabled.
id	string	yes	`Long-Term`	The unique identifier of the filter alert.
labels	[string]	yes	`Long-Term`	Labels attached to the filter alert.
lastError	string		`Long-Term`	Last error encountered while running the filter alert.
lastErrorTime	long		`Long-Term`	Unix timestamp for last error.
lastSuccessfulPoll	long		`Long-Term`	Unix timestamp for last successful poll of the filter alert query. If this is not quite recent, then the alert might be having problems.
lastTriggered	long		`Long-Term`	Unix timestamp for last execution of trigger.
lastWarnings	[string]	yes	`Long-Term`	Last warnings encountered while running the filter alert.
modifiedInfo	ModifiedInfo		`Long-Term`	User or token used to modify the asset. See ModifiedInfo. This is a preview and subject to change.
name	string	yes	`Long-Term`	The name of the filter alert.
package	PackageInstallation		`Long-Term`	The package of which the alert was installed. See PackageInstallation.
packageId	VersionedPackageSpecifier		`Long-Term`	The unique identifier of the package of which the alert was installed. VersionedPackageSpecifier is a scalar.
queryOwnership	QueryOwnership	yes	`Long-Term`	Ownership of the query run by this alert. See QueryOwnership.
queryString	string	yes	`Long-Term`	The LogScale query to execute.
resource	string	yes	`Short-Term`	The resource identifier for this filter alert.
throttleField	string		`Deprecated`	The field on which to throttle. This can be set only if throttleTimeSeconds is set. Filter alerts now support multiple throttle fields. This field will be removed at the earliest in version 1.279. Use instead the throttleFields field.
throttleFields	[string]		`Long-Term`	The fields on which to throttle. This can be set only if throttleTimeSeconds is set.
throttleTimeSeconds	long		`Long-Term`	The throttle time in seconds.
yamlTemplate	YAML	yes	`Long-Term`	The yaml specification of the filter alert. YAML is a scalar.

Versions of this Page

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes