The updateParser() GraphQL mutation is used to update a parser in LogScale. This is deprecated and will be removed in version 1.142. Use instead updateParserV2().

For more information on parsers, see the Parsing Data documentation page.

Syntax

Below is the syntax for the updateParser() mutation field:

graphql
updateParser(
     input: UpdateParserInput!
   ): UpdateParserMutation!

Given Datatypes

For the given datatype, UpdateParserInput, there are several parameters that may be given. Below is a list of them along with their datatypes and a description of each:

Table: UpdateParserInput

ParameterTypeRequired[a]DefaultDescription
repositoryNamestring  The repository where the parser lives.
idstring  The unique identifier of the parser to update.
namestring  The name to use for the parser.
testData[string]yes Test events that can be parsed by the parser.
testCases[TestCaseInput]yes Allows parser to have more extensive test cases than the `testData` field allows. If both `testCases` and `testData` are passed in, then `testCases` is the one that is used.
sourceCodestring  The parser script that is executed for every incoming event.
tagFields[string]yes Any fields which the parser should convert to tags after an event is parsed.
fieldsToBeRemovedBeforeParsing[string]yes A list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
languageVersionLanguageVersionEnumyes The version of the LogScale query language to use. The datatype, LanguageVersionEnum is an enumerated list: legacy, xdr1, or xdrdetects1.

[a] Some arguments may be required, as indicated in this column. For some fields, this column indicates that a result will always be returned for it.


Returned Datatypes

The returned datatype UpdateParserMutation has its own parameters. Below is a list of them along with their datatypes and a description of each:

Table: UpdateParserMutation

ParameterTypeRequired[a]DefaultDescription
parserParseryes The parser to update for the mutation (see Parser Table).

[a] Some arguments may be required, as indicated in this column. For some fields, this column indicates that a result will always be returned for it.