Stability Level Short-Term

The entitiesPackages() GraphQL query is used to get a list of packages associated with specified assets — those that are available to the user running the query.

There are a few related query fields: entitiesSearch() for querying assets across views and repositories; entitiesPage() for getting the next and previous pages when querying assets; and entitiesLabels() for getting labels associated with assets.

You can find this information in the UI by opening a particular repository or view, then choosing Settings. On that page, you'd look for Installed under Packages in the left margin. From there you can see what's installed and piece together the details. It's much easier to use the GraphQL query, even if you execute it from the command-line with curl.

Syntax

graphql
entitiesPackages(
       input: EntitiesPackagesInputType!
    ) PackagesResult!

For the input, using the special datatype, you'll have to enter the type of asset (e.g., Dashboard, Action) for which you want to get packages. For the returned values, you can request the total number of packages and the package name with the specific version number (e.g., linux/system-logs@0.2.0).

Example

Below is an example of how this query field might be used:

Raw
graphql
query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  entitiesPackages( ^
    input: {  ^
       entityTypes: [Dashboard, SavedQuery], ^
       paths: [] } ^
  ) { packages, totalCount } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "entitiesPackages": {
      "packages": {
          "crowdstrike/logscale-slack@1.0.0",
          "linux/guards@1.2.0"
      }
      "totalCount": "2"
    }
  }
}

Given Datatype

With the input datatype, you can specify the asset type (e.g., Dashboard, Action) for which you want a list of packages installed. The parameters are described below:

Table: EntitiesPackagesInputType

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 30, 2025
entityTypesEntitySearchEntityTypeyes Short-TermThe types of entities. See EntitySearchEntityType .
paths[string]  Short-TermPath to search for packages.

Returned Datatype

With the returned datatype, you can get the scalar values for packages — the package name with the specific version number — which uses a given asset type. You can also get the total number of packages found.

Table: PackagesResult

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 30, 2025
packages[VersionedPackageSpecifier]yes Short-TermThe packages associated with the Entity Types provided. Returns a maximum of 1000 distinct packages. VersionedPackageSpecifier is a scalar.
totalCountintegeryes Short-TermThe total number of distinct packages that exist.