removeLegacyAlertLabels()

Stability Level

Long-Term

You can include labels with alerts, but you may have only ten labels for each alert. Therefore, you may want to delete some labels as you go along. You can use the removeLegacyAlertLabels() GraphQL mutation to remove labels from an alert, up to one-hundred at a time. This mutation field will return the updated legacy alert, if successful — null with errors, if not.

There's no mutation for changing labels. Instead, you'll have to use this mutation, and then use addLegacyAlertLabels() to add new labels.

Hide Query Example

Show Legacy Alert Labels Query.

To get a list of alert labels, you could execute the repository() query like this:

graphql

query {
     repository ( name: "humio")
      { alerts { labels } }
   }

For more information on legacyy alerts, see the Legacy alerts documentation page. To manage labels through the UI, see the Manage Triggers page of the main documentation.

Syntax

graphql

removeLegacyAlertLabels(
      input: RemoveLegacyAlertLabels!
   ): Alert!

For the input, you have to give the name of the view or repository, and the unique identifier of the alert from which you want to remove a label (click on Show Query below). And, you'll have to provide, within square-brackets, a comma-separated list of labels to remove.

For the return datatype, you can get details on the alert, including a list of labels for it. See the Returned Datatype section farther down this page.

Hide Query Example

Show Alert Identifiers Query

To get a list of all alerts for a repository, use the repository() query like this:

graphql

query {
     repository(name: "humio")
        { alerts { name, id } }
   }

With these results you can use an alert's unique identifier to remove labels from it.

Example

Raw

graphql

mutation {
  removeLegacyAlertLabels(input: {
    viewName: "humio",
    id: "abc123", 
    labels: [ "key-alerts" ]
  )
  {enabled, labels }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  removeLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  removeLegacyAlertLabels(input: { ^
    viewName: \"humio\", ^
    id: \"abc123\",  ^
    labels: [ \"key-alerts\" ] ^
  ) ^
  {enabled, labels } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  removeLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  removeLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  removeLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  removeLegacyAlertLabels(input: {
    viewName: \"humio\",
    id: \"abc123\", 
    labels: [ \"key-alerts\" ]
  )
  {enabled, labels }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "removeLegacyAlertLabels": {
      "enabled": true,
      "labels": [ "night-shift",
                  "admin-focus" ]
    }
  }
}

Given Datatype

For this input datatype, you'll have to give the unique identifier of the legacy alert, the name of the related view or repository, and the labels you want to remove from the legacy alert. Click on the Show Query link under the Syntax section above for an example of how to get the alert identifiers.

Table: RemoveLegacyAlertLabels

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Nov 14, 2025
id	string	yes	`Long-Term`	The unique identifier of the legacy alert.
labels	[string]	yes	`Long-Term`	Labels to remove from the legacy alert, at most one-hundred at a time.
viewName	RepoOrViewName	yes	`Long-Term`	The name of the view of the legacy alert. RepoOrViewName is a scalar.

Returned Datatype

You can get the query string used by the alert, what actions are triggered, and any error messages when it was last executed. These and other parameters are listed in the table below, along with links to related datatype tables. Include the labels parameter so you can see the results of your removal, in case there are others you want to eliminate or some you want to add.

Table: Alert

Parameter	Type	Required	Stability	Description
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 29, 2025
actions	string	yes	`Long-Term`	List of identifiers for actions to fire on query result.
actionsV2	[Action]	yes	`Long-Term`	List of unique identifiers for actions to fire on query result. See Action.
allowedActions	[AssetAction]	yes	`Short-Term`	List of allowed actions. See AssetAction .
createdInfo	AssetCommitMetadata		`Long-Term`	Metadata related to the creation of the alert. See AssetCommitMetadata.
description	string		`Long-Term`	Description of alert.
displayName	string	yes	`Long-Term`	Name of the alert.
enabled	boolean	yes	`Long-Term`	Flag indicating whether the alert is enabled.
id	string	yes	`Long-Term`	The identifier of the alert.
labels	[string]	yes	`Long-Term`	Labels attached to the alert.
lastError	string		`Long-Term`	Last error encountered while running the alert.
lastWarnings	[string]	yes	`Long-Term`	Last warnings encountered while running the alert.
name	string	yes	`Long-Term`	The name of the alert.
package	PackageInstallation		`Long-Term`	A package installation. See PackageInstallation.
packageId	VersionedPackageSpecifier		`Long-Term`	The unique identifier of the package installed, if one was used. VersionedPackageSpecifier is a scalar.
queryOwnership	QueryOwnership	yes	`Long-Term`	Ownership of the query run by the alert. See QueryOwnership.
queryStart	string	yes	`Long-Term`	Start of the relative time interval for the query.
queryString	string	yes	`Long-Term`	LogScale query to execute.
resource	string	yes	`Short-Term`	The resource identifier for the alert.
runAsUser	User		`Long-Term`	Identifier of user by which the alert is run. See User.
throttleField	string		`Long-Term`	Field on which to throttle alert.
throttleTimeMillis	long	yes	`Long-Term`	Throttle time in milliseconds.
timeOfLastTrigger	long		`Long-Term`	UNIX timestamp for when the alert was last triggered.
yamlTemplate	string	yes	`Long-Term`	The yaml formatted text that describes the alert.

Versions of this Page

GraphQL Mutations

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes