🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

A Slack post-message action sends a formatted message to one or more Slack channels when triggered by an alert. The updateSlackPostMessageAction() mutation modifies a Slack post-message action in a LogScale repository without deleting and recreating it. You can update the target channels, the Slack API token, the message content fields, and the proxy setting. To create a new Slack post-message action, use createSlackPostMessageAction().

Syntax

graphql
updateSlackPostMessageAction(
      input: UpdatePostMessageSlackAction!
   ): SlackPostMessageAction!

The input argument is required and takes an UpdatePostMessageSlackAction object. Provide the view name, the unique identifier of the action, and all configuration fields, including those you are not changing. This mutation replaces the full action configuration; any omitted optional field reverts to its default value. Because the return type is non-null, a successful call always returns the updated action state; errors are reported in the GraphQL errors array.

Input parameters

The UpdatePostMessageSlackAction input requires the repository or view name and the unique identifier of the action to update. Provide all configuration fields, including those you are not changing: the action display name, the Slack Bot API token used to authenticate posts, the list of target Slack channels, the message content fields (key-value pairs where values support {event_field} substitution from ingested event data), and whether to route Slack API calls through the configured outbound proxy. Use the repository() query to retrieve the action identifier.

Table: UpdatePostMessageSlackAction Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
apiTokenStringyes Long-Term The API token to authenticate with Slack.
channelsStringyes Long-Term The list of Slack channels to message.
fieldsSlackFieldEntryInputyes Long-Term Fields to include within the Slack message. This can be templated with values from the result. See SlackFieldEntryInput.
idStringyes Long-Term The unique identifier of the action.
labelsStringyes   Labels to categorize the action.
nameStringyes Long-Term The name of the action.
useProxyBooleanyes Long-Term Defines whether the action should use the configured proxy to make web requests.
viewNameStringyes Long-Term The name of the view of the action.

Example

Raw
graphql
mutation {
  updateSlackPostMessageAction(input:
       { viewName: "humio",
         id: "abc123",
         name: "my-slack-act",
         apiToken: "AUamuZLYvOLGUeMablONDF37FbYIm7U",
         channels: ["#admin"],
         fields: [ {fieldName: "Events String", value: "{events_str}"} ],
         useProxy: false
      } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateSlackPostMessageAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
         channels: [\"#admin\"],
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
         useProxy: false
      } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateSlackPostMessageAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
         channels: [\"#admin\"],
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
         useProxy: false
      } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateSlackPostMessageAction(input: ^
       { viewName: \"humio\", ^
         id: \"abc123\", ^
         name: \"my-slack-act\", ^
         apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\", ^
         channels: [\"#admin\"], ^
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ], ^
         useProxy: false ^
      } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateSlackPostMessageAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
         channels: [\"#admin\"],
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
         useProxy: false
      } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateSlackPostMessageAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
         channels: [\"#admin\"],
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
         useProxy: false
      } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateSlackPostMessageAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
         channels: [\"#admin\"],
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
         useProxy: false
      } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateSlackPostMessageAction(input:
       { viewName: \"humio\",
         id: \"abc123\",
         name: \"my-slack-act\",
         apiToken: \"AUamuZLYvOLGUeMablONDF37FbYIm7U\",
         channels: [\"#admin\"],
         fields: [ {fieldName: \"Events String\", value: \"{events_str}\"} ],
         useProxy: false
      } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateSlackPostMessageAction": {
      "id": "abc123"
    }
  }
}

Returned values

The mutation returns a SlackPostMessageAction object reflecting the saved state of the action. The object includes the action name and unique identifier, the list of target Slack channels, the message content fields (key-value pairs where values support event field substitution), the proxy setting, and timestamps for creation and last modification with the associated user identifiers.

Table: SlackPostMessageAction Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
allowedActions[AssetAction]yes Short-Term A list of allowed asset actions. See AssetAction .
apiTokenstringyes Long-Term An API token to authenticate with Slack.
channels[string]yes Long-Term A list of Slack channels to message.
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the action. See AssetCommitMetadata.
displayNamestringyes Long-Term The display name of the action.
fields[SlackFieldEntry]yes Long-Term The fields to include within the Slack message. Can be templated with values from the result See SlackFieldEntry.
idstringyes Long-Term The unique identifier of the action.
isAllowedToRunbooleanyes Long-Term False if this type of action is disabled because of a security policy, true otherwise.
labels[string]yes Preview The labels associated with the action.
modifiedInfoAssetCommitMetadata  Long-Term Metadata related to the latest modification of the action. See AssetCommitMetadata.
namestringyes Long-Term The name of the action.
packagePackageInstallation  Long-Term The package, if any, of which the action is part (see PackageInstallation Table).
packageIdVersionedPackageSpecifier  Long-Term The unique identifier of the package. VersionedPackageSpecifier is a scalar.
requiresOrganizationOwnedQueriesPermissionToEditbooleanyes Long-Term True if this action is used by triggers, where the query is run by the organization. If true, then the OrganizationOwnedQueries permission is required to edit the action.
resourcestringyes Short-Term The resource identifier for the action.
useProxybooleanyes Long-Term Whether the action should use the configured proxy to make web requests.
yamlTemplateYAMLyes Long-Term A template that can be used to recreate the action. YAML is a scalar.