updateEventForwardingRule()

Summary

The updateEventForwardingRule() GraphQL mutation is used to update an event forwarding rule on a repository in LogScale and return it.

To create an event forwarding rule, you can use the createEventForwardingRule() mutation. You can use deleteEventForwardingRule() to delete one.

Hide Query Example

Show Event Forwarding Rules Query

To get a list of event forwarding rules for a repository, you can use the repository() query:

graphql

query {
     repository( name: "humio" )
      { eventForwardingRules 
           { id, eventForwarderId, queryString } 
        } 
   }

For more information on event forwarding rules, see the Event Forwarding Rules documentation page. You may also want to look at the Event Forwarding and the Events page for related information.

API Stability Long-Term

Syntax

graphql

updateEventForwardingRule(
     input: UpdateEventForwardingRule!
   ): EventForwardingRule!

For the input, you'll have to give the name of the repository, the identifier of the event forwarding rule, the query string for filtering and mapping events, and whatever else you want to update. Click on Show Query above to find the identifier.

For the results, you can get details for the event forwarding rule as configuration. See the Returned Values section for what will be available.

Example

Raw

graphql

mutation {
  updateEventForwardingRule( input:
     { repoName: "humio",
       id: "abc123"
       queryString: "@host=localhost",
       eventForwarderId: "def456",
       languageVersion: legacy
    } 
  )
  { id }
}

Mac OS or Linux (curl)

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateEventForwardingRule( input:
     { repoName: \"humio\",
       id: \"abc123\"
       queryString: \"@host=localhost\",
       eventForwarderId: \"def456\",
       languageVersion: legacy
    } 
  )
  { id }
}"
}
EOF

Mac OS or Linux (curl) One-line

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateEventForwardingRule( input:
     { repoName: \"humio\",
       id: \"abc123\"
       queryString: \"@host=localhost\",
       eventForwarderId: \"def456\",
       languageVersion: legacy
    } 
  )
  { id }
}"
}
EOF

Windows Cmd and curl

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateEventForwardingRule( input: ^
     { repoName: \"humio\", ^
       id: \"abc123\" ^
       queryString: \"@host=localhost\", ^
       eventForwarderId: \"def456\", ^
       languageVersion: legacy ^
    }  ^
  ) ^
  { id } ^
}" ^
} '

Windows Powershell and curl

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateEventForwardingRule( input:
     { repoName: \"humio\",
       id: \"abc123\"
       queryString: \"@host=localhost\",
       eventForwarderId: \"def456\",
       languageVersion: legacy
    } 
  )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

Perl

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateEventForwardingRule( input:
     { repoName: \"humio\",
       id: \"abc123\"
       queryString: \"@host=localhost\",
       eventForwarderId: \"def456\",
       languageVersion: legacy
    } 
  )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

Python

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateEventForwardingRule( input:
     { repoName: \"humio\",
       id: \"abc123\"
       queryString: \"@host=localhost\",
       eventForwarderId: \"def456\",
       languageVersion: legacy
    } 
  )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

Node.js

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateEventForwardingRule( input:
     { repoName: \"humio\",
       id: \"abc123\"
       queryString: \"@host=localhost\",
       eventForwarderId: \"def456\",
       languageVersion: legacy
    } 
  )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Success (HTTP Response Code 200 OK)

json

{
  "data": {
    "updateEventForwardingRule": {
      "id": "abc123"
    }
  }
}

Input Parameters

For the input, you'll have to give the name of the repository and the unique identifier of the event forwarding rule, the query string for filtering and mapping events, and whatever else you want to update. Click on the Show Query link above the Syntax section for an example of how to find the identifier.

Table: UpdateEventForwardingRule Input Datatype

Security Requirements and Controls

EventForwarding API permission

Parameter	Type	Required	Default	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Mar 28, 2025
eventForwarderId	string	yes		`Long-Term`	The unique identifier of the event forwarder.
id	string	yes		`Long-Term`	The unique identifier for the event forwarding rule.
languageVersion	LanguageVersionEnum		legacy	`Long-Term`	The version of Human language to use. If non-null, it will be a version known by the current LogScale installation. See LanguageVersionEnum.
queryString	string	yes		`Long-Term`	The query string for filtering and mapping the events to forward.
repoName	string	yes		`Long-Term`	The name of the repository associated with the event forwarding rule.

Returned Values

For the results, you can get the unique identifier for the event forwarding rule, the query string for filtering and mapping events to forward, and other details.

Table: EventForwardingRule Datatype

Parameter	Type	Required	Stability	Description
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Mar 26, 2025
createdAt	long		`Long-Term`	The UNIX timestamp of when the event forwarder was created.
eventForwarderId	string	yes	`Long-Term`	The unique identifier of the event forwarder.
id	string	yes	`Long-Term`	The unique identifier for the event forwarding rule.
languageVersion	LanguageVersion	yes	`Long-Term`	The version of the LogScale query language to use. See LanguageVersion.
queryString	string	yes	`Long-Term`	The query string for filtering and mapping the events to forward.

Versions of this Page

GraphQL Mutations

GraphQL API

GraphQL API Stability

GraphQL Queries

GraphQL Datatypes