🎯API Stability
Short-TermThis API may change in future versions. Use with caution in production environments.

Summary

The updateCrossOrgViewConnectionFilters() mutation modifies the filter expressions on existing connections within a cross-organization view. Each connection filter is a LogScale query expression that restricts which events from a remote organization's repository appear in the view. This mutation changes filters only — it does not add or remove connections. To add or remove connections, use updateCrossOrgViewConnections() instead.

Syntax

graphql
updateCrossOrgViewConnectionFilters(
      input: UpdateCrossOrganizationViewConnectionFiltersInput!
   ): View!

The mutation takes a single required input argument of type UpdateCrossOrganizationViewConnectionFiltersInput. The input requires the view name and a list of connections to update. Each connection entry specifies the remote repository name, organization ID, and the replacement filter expression. See the Input Parameters section for details.

The mutation returns the updated View object. See the Returned Values section for available fields.

Example

Raw
graphql
mutation {
  updateCrossOrgViewConnectionFilters( input:
    {
      name: "main-connection-filter",
      connectionsToUpdate: [{ repoName: "humio", 
                              organizationId: "SINGLE_ORGANIZATION_ID",
                              filter: "something" }]
    }
  )
  { crossOrgConnections { id } }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateCrossOrgViewConnectionFilters( input:
    {
      name: \"main-connection-filter\",
      connectionsToUpdate: [{ repoName: \"humio\", 
                              organizationId: \"SINGLE_ORGANIZATION_ID\",
                              filter: \"something\" }]
    }
  )
  { crossOrgConnections { id } }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateCrossOrgViewConnectionFilters( input:
    {
      name: \"main-connection-filter\",
      connectionsToUpdate: [{ repoName: \"humio\", 
                              organizationId: \"SINGLE_ORGANIZATION_ID\",
                              filter: \"something\" }]
    }
  )
  { crossOrgConnections { id } }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateCrossOrgViewConnectionFilters( input: ^
    { ^
      name: \"main-connection-filter\", ^
      connectionsToUpdate: [{ repoName: \"humio\",  ^
                              organizationId: \"SINGLE_ORGANIZATION_ID\", ^
                              filter: \"something\" }] ^
    } ^
  ) ^
  { crossOrgConnections { id } } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateCrossOrgViewConnectionFilters( input:
    {
      name: \"main-connection-filter\",
      connectionsToUpdate: [{ repoName: \"humio\", 
                              organizationId: \"SINGLE_ORGANIZATION_ID\",
                              filter: \"something\" }]
    }
  )
  { crossOrgConnections { id } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateCrossOrgViewConnectionFilters( input:
    {
      name: \"main-connection-filter\",
      connectionsToUpdate: [{ repoName: \"humio\", 
                              organizationId: \"SINGLE_ORGANIZATION_ID\",
                              filter: \"something\" }]
    }
  )
  { crossOrgConnections { id } }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateCrossOrgViewConnectionFilters( input:
    {
      name: \"main-connection-filter\",
      connectionsToUpdate: [{ repoName: \"humio\", 
                              organizationId: \"SINGLE_ORGANIZATION_ID\",
                              filter: \"something\" }]
    }
  )
  { crossOrgConnections { id } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateCrossOrgViewConnectionFilters( input:
    {
      name: \"main-connection-filter\",
      connectionsToUpdate: [{ repoName: \"humio\", 
                              organizationId: \"SINGLE_ORGANIZATION_ID\",
                              filter: \"something\" }]
    }
  )
  { crossOrgConnections { id } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "updateCrossOrgViewConnectionFilters": {
    "id": "abc123"
    }
  }
}

Input Parameters

The input requires the name of the cross-organization view and a list of connections to update. Each connection entry in connectionsToUpdate identifies a remote repository by name and organization ID, and specifies the replacement filter expression for that connection. The filter expression is a LogScale query that restricts which events from the remote repository appear in the view. All three fields in each connection entry are required.

Table: UpdateCrossOrganizationViewConnectionFiltersInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
connectionsToUpdateCrossOrganizationViewConnectionInputModelyes Preview The list of connections to update. See CrossOrganizationViewConnectionInputModel.
nameStringyes Preview The name of the connection filter to update.

Returned Values

The mutation returns the updated View object. Query crossOrgConnections on the returned view to confirm the applied filter expressions. The returned fields also include the view name, installed packages, and other view metadata.

Table: View Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
action(id: string): Actionmultipleyes Long-Term A saved action. The id is the unique identifier of the action. See Action.
actions(actionIds: [string]): [Action]multipleyes Long-Term A list of saved actions. See Action.
aggregateAlert(id: string): AggregateAlertmultipleyes Long-Term A saved aggregate alert. See AggregateAlert.
aggregateAlerts[AggregateAlert]yes Long-Term Saved aggregate alerts. See AggregateAlert.
alert(id: string): Alertmultipleyes Long-Term A saved alert. See Alert.
alerts[Alert]yes Long-Term Saved alerts. See Alert.
allowedViewActions[ViewAction]yes Long-Term Returns all actions the user is allowed to perform on the view. See ViewAction.
automaticSearchbooleanyes Long-Term Whether the search is executed automatically.
availablePackages(filter: string, tags: [PackageTag], categories: [string]): [PackageRegistrySearchResultItem]multiple  Long-Term Returns a list of available packages that can be installed. PackageTag is a scalar. See PackageRegistrySearchResultItem.
checkClusterConnections[ClusterConnectionStatus]  Short-Term Check all of this search domain's cluster connections. This is a preview and subject to change. See ClusterConnectionStatus.
clusterConnection(id: string): ClusterConnectionmultiple  Short-Term A specific cluster connection. See ClusterConnection.
clusterConnections[ClusterConnection]  Short-Term The search domain's cluster connections. See ClusterConnection.
connections[ViewConnection]yes Long-Term The connections for the view. This is a preview and subject to change. See ViewConnection.
crossOrgConnections[CrossOrgViewConnection]yes Short-Term The connections for the cross organization connections (see CrossOrgViewConnection Table).
dashboard(id: string): Dashboardmultipleyes Long-Term A saved dashboard. See Dashboard.
dashboards[Dashboard]yes Long-Term Saved dashboards. See Dashboard.
defaultQuerySavedQuery  Long-Term The default saved query. See SavedQuery.
deletedDatelong  Long-Term The point in time the search domain was marked for deletion.
descriptionstring  Long-Term A description of the view.
fileFieldSearch(fileName: string, fieldName: string, prefixFilter: string, valueFilters: [FileFieldFilterType], fieldsToInclude: [string], maxEntries: integer): [DictionaryEntryType]multipleyes Long-Term The fields to search in a given file. See FileFieldFilterType and DictionaryEntryType.
files[File]yes Long-Term A list of files used. See File.
filterAlert(id: string): FilterAlertmultipleyes Long-Term A saved filter alert. See FilterAlert.
filterAlerts[FilterAlert]yes Long-Term Saved filter alerts. See FilterAlert.
groups[Group]yes Long-Term Groups with assigned roles. See Group.
hasPackageInstalled(packageId: VersionedPackageSpecifier): booleanmultipleyes Long-Term Determines whether package has been installed. VersionedPackageSpecifier is a scalar.
idstringyes Long-Term The unique identifier of the view.
installedPackages[PackageInstallation]yes Long-Term List packages installed on a specific view or repository See PackageInstallation.
interactions[ViewInteraction]yes Long-Term All interactions defined for the view. See ViewInteraction.
isActionAllowed(action: ViewAction): booleanmultipleyes Long-Term Determines whether current user is allowed to perform the given action on the view. See ViewAction.
isFederatedbooleanyes Preview Whether the view is Federated. This is a preview and subject to change.
isStarredbooleanyes Long-Term Whether the view should be marked with a star.
nameRepoOrViewNameyes Long-Term The name of the repository or view. RepoOrViewName is a scalar.
packageV2(packageId: VersionedPackageSpecifier): Package2multiple  Long-Term Returns a specific version of a package given a package version. VersionedPackageSpecifier is a scalar. See Package2.
packageVersions(packageId: UnversionedPackageSpecifier): [RegistryPackageVersionInfo]multiple  Long-Term The available versions of a package. UnversionedPackageSpecifier is a scalar. See RegistryPackageVersionInfo.
permanentlyDeletedAtlong  Long-Term The point in time the search domain will not be restorable anymore.
persistedAggregations(sortBy: PersistedAggregationSortBy, orderBy: OrderBy, skip: integer, limit: integer): PersistedAggregationResultSetmultiple  Preview 

List of persisted aggregations for view, with sorting and pagination. See PersistedAggregationSortBy.

recentQueriesV2[RecentQuery]yes Long-Term List of recent queries. See RecentQuery.
redirectQueryAssetLookupToSearchDomain  Preview The redirected query asset lookup view used for asset resolution when set. Assets like saved queries and lookup files will be resolved from this view instead of the current view. See SearchDomain.
reposExcludedInSearchLimit[string]yes Long-Term Repositories not part of the search limitation.
resourcestringyes Short-Term The resource identifier for the search domain.
savedQueries[SavedQuery]yes Long-Term A list of saved queries. See SavedQuery.
savedQuery(id: string): SavedQuerymultipleyes Long-Term A saved query. See SavedQuery.
scheduledReport(id: string): ScheduledReportmultiple  Long-Term Saved scheduled report. See ScheduledReport.
scheduledReports[ScheduledReport]yes Long-Term Saved scheduled reports See ScheduledReport.
scheduledSearch(id: string): ScheduledSearchmultipleyes Long-Term A saved scheduled search. See ScheduledSearch.
scheduledSearches[ScheduledSearch]yes Long-Term Saved scheduled searches. See ScheduledSearch.
searchLimitedMslong  Long-Term Search limit in milliseconds, by which searches are limited.
starredFields[string]yes Long-Term Fields marked with a star.
tags[string]yes Long-Term All tags from all datasources.
users[User]yes Long-Term Users who have access. See User.
usersAndGroups(search: string, skip: integer, limit: integer): UsersAndGroupsSearchResultSetmultiple  Long-Term Users or groups who have access. See UsersAndGroupsSearchResultSet.
usersV2(search: string, permissionFilter: Permission, skip: integer, limit: integer): Usersmultiple  Short-Term Search users with a given permission. See Users.
viewerQueryPrefixstringyes Long-Term The query prefix prepended to each search in the domain.