๐ŸŽฏAPI Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The updateS3Action() mutation modifies an Amazon S3 action in a LogScale repository or view. Use it to change the bucket name, region, IAM role ARN, file name pattern, output format, metadata output setting, proxy setting, or labels of an action that is already associated with alerts or scheduled searches. The mutation applies full-replace semantics: all fields must be supplied on every call, even when their values are unchanged.

The fileName field supports message template expressions such as {now:yyyy/MM/dd} for date-based object key partitioning or {field:hostname} to embed event field values. The outputFormat field accepts NDJSON or CSV; NDJSON preserves field types, while CSV produces a header row with comma-separated values. When outputMetadata is true, a separate JSON metadata file is written alongside the event file to support downstream processing pipelines.

Syntax

graphql
updateS3Action(
      input: UpdateS3Action!
   ): S3Action!

The mutation accepts a single required input argument of type UpdateS3Action. All fields in the input type are required on every call because the mutation uses full-replace semantics. Provide the existing action identifier, the view or repository name, the IAM role ARN, the AWS region, the bucket name, the file name pattern, the output format, the metadata output setting, the proxy setting, and the labels list.

The mutation returns a non-null S3Action! object reflecting the updated state of the action. Use the returned fields to confirm the update was applied correctly.

Input parameters

All fields in the UpdateS3Action input type are required because the mutation uses full-replace semantics. The id field identifies the action to modify; retrieve it using the repository() query. The viewName field specifies the repository or view that contains the action. The name field sets the action's display name and can be changed on update.

The roleArn field accepts an AWS IAM role ARN in the format arn:aws:iam::account-id:role/role-name; LogScale assumes this role using AWS STS to write to the S3 bucket, so the role must grant s3:PutObject on the target bucket. The awsRegion field accepts an AWS region identifier such as us-east-1 and must match the bucket's actual region; see the Amazon S3 documentation for the full list of valid region identifiers. The bucketName field specifies the S3 bucket where alert output is written.

The fileName field sets the object key pattern for uploaded files and supports message template expressions; use {now:yyyy/MM/dd} for date-based partitioning or {field:fieldname} to embed event field values. The outputFormat field accepts either NDJSON (newline-delimited JSON, which preserves field types) or CSV (a header row followed by comma-separated values). When outputMetadata is true, a separate JSON metadata file is written alongside the event file; set it to false to suppress the metadata file. Set useProxy to true to route S3 upload requests through the HTTP proxy configured for the LogScale instance. The labels field accepts a list of string labels used to organize and filter actions; an action can have at most 10 labels, each with a maximum length of 60 characters. Supply the complete desired label set on every call, as the mutation replaces the labels list. The following table describes each input field:

Example

Raw
graphql
mutation {
  updateS3Action(
    input: { 
    viewName: "humio",
    roleArn: "arn:aws_iam::1234:user/admin"
    id: "abc123",
    name: "act-one",
    labels: "[]",
    awsRegion: "us-west-2",
    bucketName: "pale-1",
    fileName: "file-1",
    outputFormat: "CSV",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    id: \"abc123\",
    name: \"act-one\",
    labels: \"[]\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    id: \"abc123\",
    name: \"act-one\",
    labels: \"[]\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateS3Action( ^
    input: {  ^
    viewName: \"humio\", ^
    roleArn: \"arn:aws_iam::1234:user/admin\" ^
    id: \"abc123\", ^
    name: \"act-one\", ^
    labels: \"[]\", ^
    awsRegion: \"us-west-2\", ^
    bucketName: \"pale-1\", ^
    fileName: \"file-1\", ^
    outputFormat: \"CSV\", ^
    outputMetadata: True, ^
    useProxy: False ^
    } ^
  ) { id, isAllowedToRun } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    id: \"abc123\",
    name: \"act-one\",
    labels: \"[]\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    id: \"abc123\",
    name: \"act-one\",
    labels: \"[]\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    id: \"abc123\",
    name: \"act-one\",
    labels: \"[]\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateS3Action(
    input: { 
    viewName: \"humio\",
    roleArn: \"arn:aws_iam::1234:user/admin\"
    id: \"abc123\",
    name: \"act-one\",
    labels: \"[]\",
    awsRegion: \"us-west-2\",
    bucketName: \"pale-1\",
    fileName: \"file-1\",
    outputFormat: \"CSV\",
    outputMetadata: True,
    useProxy: False
    }
  ) { id, isAllowedToRun }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateS3Action": {
      "id": "abc123",
      "isAllowedToRun": true
    }
  }
}

Returned values

The mutation returns a non-null S3Action! object reflecting the updated state of the action. The returned fields include the action identifier, name, IAM role ARN, AWS region, bucket name, file name pattern, output format, metadata output setting, proxy setting, and labels. The isAllowedToRun field is false if a security policy has disabled this action type for the instance, and true otherwise. The createdInfo and modifiedInfo fields return AssetCommitMetadata objects containing creation and last-modification details. The id field value is unchanged after an update and can be used to reference the action in subsequent calls such as deleteActionV2() or testS3Action().