🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The updateAlert() mutation updates a legacy alert. Provide all required fields, including fields you are not changing.

Syntax

graphql
updateAlert(
      input: UpdateAlert!
   ): Alert!

The required input argument accepts an UpdateAlert! object. Provide the view name and alert identifier. Include all required fields, even those you are not changing.

The mutation returns a non-null Alert! object reflecting the updated alert configuration.

Input parameters

Supply all required fields, including fields you are not changing.

Table: UpdateAlert Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsStringyes Long-Term List of unique identifiers for actions to fire on query result.
descriptionString  Long-Term A description of the alert.
enabledBooleanyes Long-Term A flag indicating whether the alert is enabled.
idStringyes Long-Term The unique identifier of the alert.
labelsStringyes Long-Term Labels attached to the alert.
nameStringyes Long-Term The name of the alert.
queryOwnershipTypeQueryOwnershipType  Long-Term The ownership of the query run by this alert. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStartStringyes Long-Term The start of the relative time interval for the query.
queryStringStringyes Long-Term The LogScale query to execute.
runAsUserIdString  Long-Term The alert will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the alert will run with the permissions of the calling user. It requires the ChangeTriggersToRunAsOtherUsers permission to set this field to a user identifier different from the calling user.
throttleFieldString  Long-Term The field on which to throttle.
throttleTimeMillisLongyes Long-Term Throttle time in milliseconds.
viewNameStringyes Long-Term The name of the view of the alert.

Example

Raw
graphql
mutation {
  updateAlert( input:
    {
      viewName: "humio",
      id: "abc123",
      name: "my-alert",
      queryString: "#kind=threaddumps | NOT \"(Native Method)\" | top(humioLine)",
      queryStart: "1day",
      throttleTimeMillis: 1000,
      actions: [ "wCU3ut8sXgVK7fW4wKkSwtdfHWlfkt0s" ],
      labels: [ "admin" ],
      enabled: false,
      queryOwnershipType: User
    }
  )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateAlert( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"my-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      queryStart: \"1day\",
      throttleTimeMillis: 1000,
      actions: [ \"wCU3ut8sXgVK7fW4wKkSwtdfHWlfkt0s\" ],
      labels: [ \"admin\" ],
      enabled: false,
      queryOwnershipType: User
    }
  )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateAlert( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"my-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      queryStart: \"1day\",
      throttleTimeMillis: 1000,
      actions: [ \"wCU3ut8sXgVK7fW4wKkSwtdfHWlfkt0s\" ],
      labels: [ \"admin\" ],
      enabled: false,
      queryOwnershipType: User
    }
  )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateAlert( input: ^
    { ^
      viewName: \"humio\", ^
      id: \"abc123\", ^
      name: \"my-alert\", ^
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\", ^
      queryStart: \"1day\", ^
      throttleTimeMillis: 1000, ^
      actions: [ \"wCU3ut8sXgVK7fW4wKkSwtdfHWlfkt0s\" ], ^
      labels: [ \"admin\" ], ^
      enabled: false, ^
      queryOwnershipType: User ^
    } ^
  ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateAlert( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"my-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      queryStart: \"1day\",
      throttleTimeMillis: 1000,
      actions: [ \"wCU3ut8sXgVK7fW4wKkSwtdfHWlfkt0s\" ],
      labels: [ \"admin\" ],
      enabled: false,
      queryOwnershipType: User
    }
  )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateAlert( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"my-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      queryStart: \"1day\",
      throttleTimeMillis: 1000,
      actions: [ \"wCU3ut8sXgVK7fW4wKkSwtdfHWlfkt0s\" ],
      labels: [ \"admin\" ],
      enabled: false,
      queryOwnershipType: User
    }
  )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateAlert( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"my-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      queryStart: \"1day\",
      throttleTimeMillis: 1000,
      actions: [ \"wCU3ut8sXgVK7fW4wKkSwtdfHWlfkt0s\" ],
      labels: [ \"admin\" ],
      enabled: false,
      queryOwnershipType: User
    }
  )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateAlert( input:
    {
      viewName: \"humio\",
      id: \"abc123\",
      name: \"my-alert\",
      queryString: \"#kind=threaddumps | NOT \\"(Native Method)\\" | top(humioLine)\",
      queryStart: \"1day\",
      throttleTimeMillis: 1000,
      actions: [ \"wCU3ut8sXgVK7fW4wKkSwtdfHWlfkt0s\" ],
      labels: [ \"admin\" ],
      enabled: false,
      queryOwnershipType: User
    }
  )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "updateAlert": {
    "id": "abc123"
    }
  }
}

Returned values

The mutation returns a non-null Alert! object reflecting the updated state of the alert. Use the returned data to confirm the query string, configured actions, and enabled state.

Table: Alert Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsStringyes Long-Term List of identifiers for actions to fire on query result.
actionsV2Actionyes Long-Term List of unique identifiers for actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term List of allowed actions. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the alert. See AssetCommitMetadata.
descriptionString  Long-Term Description of alert.
displayNameStringyes Long-Term Name of the alert.
enabledBooleanyes Long-Term Flag indicating whether the alert is enabled.
idStringyes Long-Term The identifier of the alert.
labelsStringyes Long-Term Labels attached to the alert.
lastErrorString  Long-Term Last error encountered while running the alert.
lastWarningsStringyes Long-Term Last warnings encountered while running the alert.
nameStringyes Long-Term The name of the alert.
packagePackageInstallation  Long-Term A package installation. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The id of the package that the alert was installed as part of.
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this alert
queryStartStringyes Long-Term Start of the relative time interval for the query.
queryStringStringyes Long-Term LogScale query to execute.
resourceStringyes Short-Term The resource identifier for the alert.
runAsUserUser  Long-Term Id of user which the alert is running as.
throttleFieldString  Long-Term Field to throttle on.
throttleTimeMillisLongyes Long-Term Throttle time in milliseconds.
timeOfLastTriggerLong  Long-Term Unix timestamp for when the alert was last triggered.
yamlTemplateStringyes Long-Term A YAML formatted string that describes the alert.