๐ŸŽฏAPI Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

Upload file actions enrich alert notifications by joining event fields with rows from a CSV file uploaded to a LogScale view. When an alert fires, LogScale matches event field values against the uploaded file and includes the corresponding rows in the action output.

The updateUploadFileActionV2() mutation updates an upload file action. Use it to rename the action, change the associated CSV file, or switch the update mode. When the update mode is Update, also provide the key columns that LogScale uses to match rows during enrichment. To create a new upload file action, use createUploadFileAction() instead.

Syntax

graphql
updateUploadFileActionV2(
      input: UpdateUploadFileActionV2!
   ): UploadFileAction!

The mutation accepts a single required input argument of type UpdateUploadFileActionV2!. Provide the view name, the action ID, the action name, the CSV file name, and the update mode. When updateMode is Update, also provide keyColumns and keyColumnsIgnoreCase to define how LogScale matches rows during enrichment. Use the repository() query to retrieve the action ID before calling this mutation.

The mutation returns a non-null UploadFileAction! object. Query the returned fields to confirm the updated configuration.

Input parameters

Provide the view name (viewName), the action ID (id), the action name (name), the CSV file name (fileName), and the update mode (updateMode). The Overwrite mode replaces all rows in the uploaded file on each invocation. The Update mode modifies only rows whose key columns match, leaving unmatched rows unchanged. When updateMode is Update, provide keyColumns to specify the CSV columns used as the join key, and keyColumnsIgnoreCase to control whether that comparison is case-sensitive.

Example

Raw
graphql
mutation {
  updateUploadFileActionV2( input:
    { viewName: "humio",
      id: "abc123",
      name: "file-act",
      fileName: "my-file.csv",
      updateMode: Overwrite
    } )
  { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateUploadFileActionV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"file-act\",
      fileName: \"my-file.csv\",
      updateMode: Overwrite
    } )
  { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateUploadFileActionV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"file-act\",
      fileName: \"my-file.csv\",
      updateMode: Overwrite
    } )
  { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateUploadFileActionV2( input: ^
    { viewName: \"humio\", ^
      id: \"abc123\", ^
      name: \"file-act\", ^
      fileName: \"my-file.csv\", ^
      updateMode: Overwrite ^
    } ) ^
  { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateUploadFileActionV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"file-act\",
      fileName: \"my-file.csv\",
      updateMode: Overwrite
    } )
  { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateUploadFileActionV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"file-act\",
      fileName: \"my-file.csv\",
      updateMode: Overwrite
    } )
  { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateUploadFileActionV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"file-act\",
      fileName: \"my-file.csv\",
      updateMode: Overwrite
    } )
  { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateUploadFileActionV2( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"file-act\",
      fileName: \"my-file.csv\",
      updateMode: Overwrite
    } )
  { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateUploadFileActionV2": {
      "id": "abc123"
    }
  }
}

Returned values

The mutation returns a non-null UploadFileAction! object. Request id and name to confirm the action identity, fileName and updateMode to verify the file and enrichment mode, and keyColumns and keyColumnsIgnoreCase when the update mode is Update. The returned object also includes creation and modification timestamps and the user who last modified the action.