🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The updateParserV2() mutation updates a parser in the specified LogScale repository. Use this mutation to modify a parser's name, script, test cases, tag fields, or the list of fields removed before parsing.

Syntax

graphql
updateParserV2(
      input: UpdateParserInputV2!
   ): Parser!

The mutation takes a single required argument, input, of type UpdateParserInputV2!. Provide repositoryName and id to identify the target parser. The fields fieldsToBeRemovedBeforeParsing, fieldsToTag, and testCases are required; pass an empty array for any list field you do not want to change. The mutation returns a non-null Parser! object representing the updated parser.

Input parameters

The input argument accepts an UpdateParserInputV2! object. Provide repositoryName and id to identify the target parser. The fields fieldsToBeRemovedBeforeParsing, fieldsToTag, and testCases are required; pass an empty array for any list field you do not want to change. To find the parser identifier, use the repositories() query. The table below describes all available fields.

Table: UpdateParserInputV2 Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
fieldsToBeRemovedBeforeParsingStringyes Long-Term A list of fields that will be removed from the event before it's parsed. They won't be included when calculating usage.
fieldsToTagStringyes Long-Term The fields that are used as tags.
idStringyes Long-Term The unique identifier of the parser to update.
nameString  Long-Term The name to use for the parser.
repositoryNameRepoOrViewNameyes Long-Term The repository where the parser is located. RepoOrViewName is a scalar.
scriptUpdateParserScriptInput  Long-Term Input for updating the parser script. See UpdateParserScriptInput.
testCasesParserTestCaseInputyes Long-Term Test cases that can be used to help verify that the parser works as expected. See ParserTestCaseInput.

Example

Raw
graphql
mutation {
  updateParserV2( input:
      { repositoryName: "humio",
        id: "abc123",
        name: "my-parser",
        fieldsToBeRemovedBeforeParsing: [ "#vhost" ]
      }
  )
  { name }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateParserV2( input: ^
      { repositoryName: \"humio\", ^
        id: \"abc123\", ^
        name: \"my-parser\", ^
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ] ^
      } ^
  ) ^
  { name } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateParserV2": {
      "name": "my-parser"
    }
  }
}

Returned values

The mutation returns a non-null Parser! object representing the updated parser. The returned object includes the parser's script, name, tag fields, fields removed before parsing, test cases, and other metadata. The available fields are listed in the following table.

Table: Parser Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the parser. See AssetCommitMetadata.
descriptionString  Long-Term A description of the parser.
displayNameStringyes Long-Term The full name of the parser, including package information if part of an application.
fieldsToBeRemovedBeforeParsingStringyes Long-Term A list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
fieldsToTagStringyes Long-Term The fields that are used as tags.
idStringyes Long-Term The unique identifier of the parser.
isBuiltInBooleanyes Long-Term True if the parser is one of LogScale's built-in parsers.
isOverriddenBooleanyes Short-Term True if the parser is one of LogScale's built-in parsers, and it is overridden by a custom parser.
languageVersionLanguageVersionyes Long-Term The language version used by the parser. See LanguageVersion.
modifiedInfoAssetCommitMetadata  Long-Term Metadata related to the latest modification of the parser. See AssetCommitMetadata.
nameStringyes Long-Term The name of the parser.
originDisplayStringStringyes Short-Term The origin of a parser. Can either be "Built in", "Local" or a package.
overridesBuiltInParserBooleanyes Short-Term True if the parser is overrides one of LogScale's built-in parsers.
packagePackageInstallation  Long-Term The package associated with the parser, if any. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The identifier of the package used, if one. VersionedPackageSpecifier is a scalar.
scriptStringyes Long-Term The parser script that is executed for every incoming event.
testCasesParserTestCaseyes Long-Term Test cases that can be used to help verify that the parser works as expected. See ParserTestCase.
yamlTemplateYAMLyes Long-Term A template that can be used to recreate the parser. YAML is a scalar.