Summary

The updateFilterAlert() mutation is deprecated. Use updateFilterAlertV2() instead. LogScale will remove this mutation no earlier than version 1.282. This mutation updates an existing filter alert in a LogScale view but does not support multiple throttle fields, which is why it was deprecated. Filter alerts fire on every ingested event that matches the query string. They have no time window. Throttle configuration controls how frequently the associated actions trigger.

Syntax

graphql
updateFilterAlert(
      input: UpdateFilterAlert!
   ): FilterAlert!

The required input argument accepts an UpdateFilterAlert! object. Supply the viewName, the filter alert id, the queryString to execute, and any other fields to update. To retrieve a filter alert's ID, use the repository() query in the Related section.

The mutation returns a non-null FilterAlert! object. Use the returned data to confirm the updated alert configuration, including any errors or warnings from the last execution.

Input parameters

Supply the viewName and id of the filter alert to update, along with all required fields. Pass the queryString to execute and a list of action IDs or names as actionIdsOrNames. To retrieve a filter alert's ID before updating, use the repository() query in the Related section. The following table describes each field in the UpdateFilterAlert! input type.

Table: UpdateFilterAlert Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionIdsOrNamesStringyes Long-Term List of unique identifiers or names for actions to fire on query result. Actions in packages can be referred to as packagescope/packagename:actionname.
descriptionString  Long-Term The description of the filter alert.
enabledBooleanyes Long-Term Whether the filter alert is enabled.
idStringyes Long-Term The unique identifier of the filter alert.
labelsStringyes Long-Term Labels attached to the filter alert.
nameStringyes Long-Term The name of the filter alert.
queryOwnershipTypeQueryOwnershipTypeyes Long-Term Ownership of the query run by this filter alert. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStringStringyes Long-Term LogScale query to execute.
runAsUserIdString  Long-Term The filter alert will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the filter alert will run with the permissions of the calling user. It requires the ChangeTriggersToRunAsOtherUsers permission to set this field to a user id different from the calling user.
throttleFieldString  Long-Term A field to throttle on. Can only be set if throttleTimeSeconds is set.
throttleTimeSecondsLong  Long-Term The throttle time in seconds.
viewNameRepoOrViewNameyes Long-Term The name of the view of the filter alert. RepoOrViewName is a scalar.

Example

Raw
graphql
mutation {
  updateFilterAlert( input:
    {
       viewName: "humio",
       name: "Intruder",
       id: "abc123",
       queryString: "host=12.127.*",
       actionIdsOrNames: [ "WakeUp" ],
       labels: [],
       enabled: true,
       queryOwnershipType: Organization
    }
  )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateFilterAlert( input:
    {
       viewName: \"humio\",
       name: \"Intruder\",
       id: \"abc123\",
       queryString: \"host=12.127.*\",
       actionIdsOrNames: [ \"WakeUp\" ],
       labels: [],
       enabled: true,
       queryOwnershipType: Organization
    }
  )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateFilterAlert( input:
    {
       viewName: \"humio\",
       name: \"Intruder\",
       id: \"abc123\",
       queryString: \"host=12.127.*\",
       actionIdsOrNames: [ \"WakeUp\" ],
       labels: [],
       enabled: true,
       queryOwnershipType: Organization
    }
  )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateFilterAlert( input: ^
    { ^
       viewName: \"humio\", ^
       name: \"Intruder\", ^
       id: \"abc123\", ^
       queryString: \"host=12.127.*\", ^
       actionIdsOrNames: [ \"WakeUp\" ], ^
       labels: [], ^
       enabled: true, ^
       queryOwnershipType: Organization ^
    } ^
  ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateFilterAlert( input:
    {
       viewName: \"humio\",
       name: \"Intruder\",
       id: \"abc123\",
       queryString: \"host=12.127.*\",
       actionIdsOrNames: [ \"WakeUp\" ],
       labels: [],
       enabled: true,
       queryOwnershipType: Organization
    }
  )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateFilterAlert( input:
    {
       viewName: \"humio\",
       name: \"Intruder\",
       id: \"abc123\",
       queryString: \"host=12.127.*\",
       actionIdsOrNames: [ \"WakeUp\" ],
       labels: [],
       enabled: true,
       queryOwnershipType: Organization
    }
  )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateFilterAlert( input:
    {
       viewName: \"humio\",
       name: \"Intruder\",
       id: \"abc123\",
       queryString: \"host=12.127.*\",
       actionIdsOrNames: [ \"WakeUp\" ],
       labels: [],
       enabled: true,
       queryOwnershipType: Organization
    }
  )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateFilterAlert( input:
    {
       viewName: \"humio\",
       name: \"Intruder\",
       id: \"abc123\",
       queryString: \"host=12.127.*\",
       actionIdsOrNames: [ \"WakeUp\" ],
       labels: [],
       enabled: true,
       queryOwnershipType: Organization
    }
  )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateFilterAlert": {
      "id": "abc123"
    }
  }
}

Returned values

The mutation returns a non-null FilterAlert! object representing the updated alert. The returned object includes the LogScale query string, the list of associated actions, throttle configuration, labels, enabled state, and ownership details. Use these values to confirm the update was applied as expected.

Table: FilterAlert Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsActionyes Long-Term List of unique identifiers for actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term List of actions allowed on which to filter query results. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the filter alert. See AssetCommitMetadata.
descriptionString  Long-Term Description of the filter alert.
enabledBooleanyes Long-Term Whether the filter alert is enabled.
idStringyes Long-Term The unique identifier of the filter alert.
labelsStringyes Long-Term Labels attached to the filter alert.
lastErrorString  Long-Term Last error encountered while running the filter alert.
lastErrorTimeLong  Long-Term Unix timestamp for last error.
lastSuccessfulPollLong  Long-Term Unix timestamp for last successful poll of the filter alert query. If this is not quite recent, then the alert might be having problems.
lastTriggeredLong  Long-Term Unix timestamp for last execution of trigger.
lastWarningsStringyes Long-Term Last warnings encountered while running the filter alert.
modifiedInfoModifiedInfoyes Long-Term User or token used to modify the asset. See ModifiedInfo. This is a preview and subject to change.
nameStringyes Long-Term The name of the filter alert.
packagePackageInstallation  Long-Term The package of which the alert was installed. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The unique identifier of the package of which the alert was installed. VersionedPackageSpecifier is a scalar.
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this alert. See QueryOwnership.
queryStringStringyes Long-Term The LogScale query to execute.
resourceStringyes Short-Term The resource identifier for this filter alert.
throttleFieldString  Deprecateddeprecated in 1.282The field on which to throttle. This can be set only if throttleTimeSeconds is set. Filter alerts now support multiple throttle fields. This field will be removed at the earliest in version 1.279. Use instead the throttleFields field.
throttleFieldsStringyes Long-Term The fields on which to throttle. This can be set only if throttleTimeSeconds is set.
throttleTimeSecondsLong  Long-Term The throttle time in seconds.
yamlTemplateYAMLyes Long-Term The yaml specification of the filter alert. YAML is a scalar.