🎯API Stability
Short-TermThis API may change in future versions. Use with caution in production environments.

Summary

The restoreDeletedSearchDomain() mutation restores a previously deleted repository or view, returning it to an active state. Deleted search domains remain restorable until LogScale permanently purges them; after that point, the domain and its data are unrecoverable. Supply the unique identifier of the deleted domain using the id field. If the ingest limit originally applied to the domain no longer exists — for example, because the limit was deleted or reconfigured — supply a fallbackLimitId to assign a replacement limit to the restored domain. If you omit fallbackLimitId and the original limit is unavailable, the domain is restored without an ingest limit applied.

Syntax

graphql
restoreDeletedSearchDomain(
      input: RestoreDeletedSearchDomainInput!
   ): SearchDomain!

The mutation accepts a single required input argument of type RestoreDeletedSearchDomainInput!. The id field within the input is required and must be the unique identifier of the deleted domain — not its name. The optional fallbackLimitId field accepts the identifier of an ingest limit to assign when the original limit no longer exists; omitting it when the original limit is unavailable restores the domain without an ingest limit applied. The mutation returns a non-null SearchDomain! object representing the restored domain.

Example

Raw
graphql
mutation {
  restoreDeletedSearchDomain( input: {
     id: "abc123"
  } )
   { name }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  restoreDeletedSearchDomain( input: {
     id: \"abc123\"
  } )
   { name }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  restoreDeletedSearchDomain( input: {
     id: \"abc123\"
  } )
   { name }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  restoreDeletedSearchDomain( input: { ^
     id: \"abc123\" ^
  } ) ^
   { name } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  restoreDeletedSearchDomain( input: {
     id: \"abc123\"
  } )
   { name }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  restoreDeletedSearchDomain( input: {
     id: \"abc123\"
  } )
   { name }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  restoreDeletedSearchDomain( input: {
     id: \"abc123\"
  } )
   { name }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  restoreDeletedSearchDomain( input: {
     id: \"abc123\"
  } )
   { name }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "restoreDeletedSearchDomain": {
      "name": "OurStuff"
    }
  }
}

Input Parameters

Provide the unique identifier of the deleted search domain to restore. If the ingest limit originally applied to the domain no longer exists, provide a fallback limit identifier to assign to the restored domain.

Table: Input Parameters and Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this mutation.
fallbackLimitId string     The unique identifier of an ingest limit to apply to the restored domain when the original limit no longer exists. Omit this field if the original limit is still available. If both this field and the original limit are absent, the domain is restored without an ingest limit applied.
id string yes   The unique identifier of the deleted search domain to restore. This is the domain's id value, not its name. Retrieve this value from prior API responses, audit logs, or the LogScale administration interface before calling this mutation.

Table: RestoreDeletedSearchDomainInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
fallbackLimitIdString  Preview The unique identifier of the limit to use for the search domain if the original limit no longer exists.
idStringyes Preview The unique identifier of the search domain.

Returned Values

The mutation returns a non-null SearchDomain! interface representing the restored domain. The returned object includes the domain's unique identifier, name, description, ingest configuration, installed packages, and associated resources such as actions, alerts, and scheduled searches. Use the name and id fields to confirm the identity of the restored domain.

Table: SearchDomain Interface Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionViewAction):Booleanyes Long-Term 

A saved action. See Action.

actionIdsString]):[Actionyes Long-Term The result will only include actions with the specified ids. Omit to find all actions.
aggregateAlertsAggregateAlertyes Long-Term A list of saved aggregate alerts. See AggregateAlert.
alert(id: String!)Alertyes Long-Term 

A saved alert. See Alert.

alertsAlertyes Long-Term Saved alerts. See Alert.
allowedViewActionsViewActionyes Long-Term Returns all actions the user is allowed to perform on the view. See ViewAction.
automaticSearchBooleanyes Long-Term Whether to execute automatically the default search query.
awsExternalIdStringyes Long-Term The AWS External ID used when assuming roles in AWS on behalf of this repository. Stability: Long-term
categoriesString]):[PackageRegistrySearchResultItemyes Long-Term Packages with any of these categories will be included.
dashboard(id: String!)Dashboardyes Long-Term 

The default or initial Dashboard to use. See Dashboard.

dashboardsDashboardyes Long-Term All dashboards available on the view. See Dashboard.
defaultQuerySavedQuery  Long-Term Stability: Long-term
deletedDateLong  Long-Term The point in time the search domain was marked for deletion.
descriptionString  Long-Term A description of the search domain.
fieldNameString,yes   Name of the field in the file to return entries from.
fieldsToIncludeString],yes   Names of the fields to include in the result.
fileNameString,yes   Name of the csv or json file to retrieve the field entries from.
filesFileyes Long-Term Files belonging to the search domain. See File.
filterString,    Filter input to limit the returned packages
filterAlertsFilterAlertyes Long-Term Saved filter alerts. See FilterAlert.
gcpExternalIdString  Long-Termadded in 1.259The value to set as the 'logscale-external-id' label on the GCS bucket. Stability: Long-term
gcsActionServiceAccountEmailString  Long-Termadded in 1.259The email of the GCP service account that LogScale uses to impersonate target service accounts for GCS actions. Stability: Long-term
groupsGroupyes Long-Term Groups with assigned roles. See Group.
hasPackageInstalled(packageId: VersionedPackageSpecifier!)Booleanyes Long-Term 

Whether there is an installed package. VersionedPackageSpecifier is a scalar.

idString):ScheduledReportyes Long-Term The unique identifier for the search domain.
installedPackagesPackageInstallationyes Long-Term List packages installed on a specific view or repository. See PackageInstallation.
interactionsViewInteractionyes Long-Term All interactions defined on the view. See ViewInteraction.
isStarredBooleanyes Long-Term Whether the search domain is highlighted with a star.
limitInt):PersistedAggregationResultSetyes Preview The amount of results to return.
maxEntriesInt):[[DictionaryEntryType]yes Long-Term Maximum number of values to retrieve from the file.
nameString):ScheduledSearchyes Long-Term The name of the search domain. RepoOrViewName is a scalar.
orderByOrderBy,    Choose the order in which the results are returned.
packageIdVersionedPackageSpecifier):Package2yes Long-Term The package id of the package to get.
packageVersions(packageId: UnversionedPackageSpecifier!)RegistryPackageVersionInfoyes Long-Term 

The available versions of a package.

UnversionedPackageSpecifier is a scalar. See RegistryPackageVersionInfo.

permanentlyDeletedAtLong  Long-Term The point in time the search domain will not be restorable anymore.
permissionFilterPermission,    Permission that the users must have on the search domain. Leave out to get users with any permission on the view
prefixFilterString,    Text to filter values by prefix on.
recentQueriesV2RecentQueryyes Long-Term All recent queries for the search domain. See RecentQuery.
redirectQueryAssetLookupToSearchDomain  Preview The redirected query asset lookup view used for asset resolution when set. Assets like saved queries and lookup files will be resolved from this view instead of the current view.
reposExcludedInSearchLimitStringyes Long-Term Repositories not part of the search limitation.
resourceStringyes Short-Term The resource identifier for the search domain.
s3ActionArnString  Long-Term The ARN of the AWS IAM identity that will write to S3 for S3 actions. Stability: Long-term
savedQueriesSavedQueryyes Long-Term The saved queries. See SavedQuery.
savedQuery(id: String!)SavedQueryyes Long-Term 

A saved query. See SavedQuery.

scheduledReportsScheduledReportyes Long-Term Saved scheduled reports. See ScheduledReport.
scheduledSearchesScheduledSearchyes Long-Term The scheduled searches to use with the search domain. See ScheduledSearch.
searchString,    Search for a user whose email or name matches this search string
searchLimitedMsLong  Long-Term Limit in milliseconds to which searches should are limited.
skipInt,    The number of results to skip or the offset to use. For instance if implementing pagination, set skip = limit * (page - 1)
sortByPersistedAggregationSortBy,    The field by which to sort persisted aggregations. Defaults to Name.
starredFieldsStringyes Long-Term All fields in the search domain to mark with a star.
tagsStringyes Long-Term All tags from all datasources.
usersUseryes Long-Term Users who have access to the search domain. See User.
valueFiltersFileFieldFilterType],yes   The exact values that given fields should have for an entry to be part of the result.
viewerQueryPrefixStringyes Long-Term The query prefix prepended to each search in this domain.