๐ŸŽฏAPI Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The updateAggregateAlertV2() mutation modifies an aggregate alert in a LogScale repository. After creating the alert, call this mutation to change its query, throttle fields, trigger conditions, or associated actions. To create an aggregate alert, call createAggregateAlert() instead.

Syntax

graphql
updateAggregateAlertV2(
      input: UpdateAggregateAlertV2!
   ): AggregateAlert!

The mutation accepts a single required input argument of type UpdateAggregateAlertV2!. This type contains the fields to update on the aggregate alert. The mutation returns a non-null AggregateAlert! object representing the updated alert state.

The returned object includes the query string, associated actions, trigger mode, and throttle configuration. Other alert properties are also available.

Input parameters

The input argument accepts an UpdateAggregateAlertV2! object. Provide the fields you want to change. For example, supply updated actions, a query string, or throttle fields.

Example

Raw
graphql
mutation {
  updateAggregateAlertV2( input:
    {
      viewName: "humio",
      id: "abc123",
      name: "our-aggregate-alert",
      queryString: "#kind=threaddumps | NOT \"(Native Method)\" | top(humioLine)",
      actionIdsOrNames: [ "act-one", "act-two" ],
      labels: [ "admin" ],
      enabled: false,
      throttleTimeSeconds: 100,
      searchIntervalSeconds: 10800,
      queryTimestampType: EventTimestamp,
      triggerMode: CompleteMode,
      queryOwnershipType: User
    }
  )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateAggregateAlertV2( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"our-aggregate-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      actionIdsOrNames: [ \"act-one\", \"act-two\" ],
      labels: [ \"admin\" ],
      enabled: false,
      throttleTimeSeconds: 100,
      searchIntervalSeconds: 10800,
      queryTimestampType: EventTimestamp,
      triggerMode: CompleteMode,
      queryOwnershipType: User
    }
  )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateAggregateAlertV2( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"our-aggregate-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      actionIdsOrNames: [ \"act-one\", \"act-two\" ],
      labels: [ \"admin\" ],
      enabled: false,
      throttleTimeSeconds: 100,
      searchIntervalSeconds: 10800,
      queryTimestampType: EventTimestamp,
      triggerMode: CompleteMode,
      queryOwnershipType: User
    }
  )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateAggregateAlertV2( input: ^
    { ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      name: \"our-aggregate-alert\", ^
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\", ^
      actionIdsOrNames: [ \"act-one\", \"act-two\" ], ^
      labels: [ \"admin\" ], ^
      enabled: false, ^
      throttleTimeSeconds: 100, ^
      searchIntervalSeconds: 10800, ^
      queryTimestampType: EventTimestamp, ^
      triggerMode: CompleteMode, ^
      queryOwnershipType: User ^
    } ^
  ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateAggregateAlertV2( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"our-aggregate-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      actionIdsOrNames: [ \"act-one\", \"act-two\" ],
      labels: [ \"admin\" ],
      enabled: false,
      throttleTimeSeconds: 100,
      searchIntervalSeconds: 10800,
      queryTimestampType: EventTimestamp,
      triggerMode: CompleteMode,
      queryOwnershipType: User
    }
  )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateAggregateAlertV2( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"our-aggregate-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      actionIdsOrNames: [ \"act-one\", \"act-two\" ],
      labels: [ \"admin\" ],
      enabled: false,
      throttleTimeSeconds: 100,
      searchIntervalSeconds: 10800,
      queryTimestampType: EventTimestamp,
      triggerMode: CompleteMode,
      queryOwnershipType: User
    }
  )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateAggregateAlertV2( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"our-aggregate-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      actionIdsOrNames: [ \"act-one\", \"act-two\" ],
      labels: [ \"admin\" ],
      enabled: false,
      throttleTimeSeconds: 100,
      searchIntervalSeconds: 10800,
      queryTimestampType: EventTimestamp,
      triggerMode: CompleteMode,
      queryOwnershipType: User
    }
  )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateAggregateAlertV2( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"our-aggregate-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      actionIdsOrNames: [ \"act-one\", \"act-two\" ],
      labels: [ \"admin\" ],
      enabled: false,
      throttleTimeSeconds: 100,
      searchIntervalSeconds: 10800,
      queryTimestampType: EventTimestamp,
      triggerMode: CompleteMode,
      queryOwnershipType: User
    }
  )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "updateAggregateAlertV2": {
    "id": "abc123"
    }
  }
}

Returned values

The mutation returns the updated AggregateAlert! object. Returned fields include the query string, associated actions, the last triggered timestamp, throttle configuration, trigger mode, and enabled state.