Summary

The entitiesPackages() GraphQL query is used to get a list of packages associated with specified assets — those that are available to the user running the query.

Stability Level Short-Term

Syntax

graphql
entitiesPackages(
       input: EntitiesPackagesInputType!
    ) PackagesResult!

For the input, using the special datatype, you'll have to enter the type of asset (e.g., Dashboard, Action) for which you want to get packages.

For the results, you can get the total number of packages and the package name with the specific version number (e.g., linux/system-logs@0.2.0).

Example

Raw
graphql
query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  entitiesPackages( ^
    input: {  ^
       entityTypes: [Dashboard, SavedQuery], ^
       paths: [] } ^
  ) { packages, totalCount } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  entitiesPackages(
    input: { 
       entityTypes: [Dashboard, SavedQuery],
       paths: [] }
  ) { packages, totalCount }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "entitiesPackages": {
      "packages": {
          "crowdstrike/logscale-slack@1.0.0",
          "linux/guards@1.2.0"
      }
      "totalCount": "2"
    }
  }
}

Input Parameters

With the input datatype, you can specify the asset type (e.g., Dashboard, Action) for which you want a list of packages installed. The parameters are described below:

Table: EntitiesPackagesInputType

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 30, 2025
entityTypesEntitySearchEntityTypeyes Short-TermThe types of entities. See EntitySearchEntityType .
paths[string]  Short-TermPath to search for packages.

The datatype above uses another datatype for an enumerated list of entity types. For your convenience, the table for that sub-datatype is included here:

Table: EntitySearchEntityType

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 30, 2025
Action   Short-TermIndicates the entity type on which to search are actions.
Dashboard   Short-TermUsed to indicate the entity type on which to search are a dashboards.
File   Short-TermIndicates the entity type on which to search are a files.
Interaction   Short-TermSet to search entities for interactions.
Parser   Short-TermSet to search entities for parsers.
SavedQuery   Short-TermSet to search entities for saved queries.

Returned Values

With the returned datatype, you can get the scalar values for packages — the package name with the specific version number — which uses a given asset type. You can also get the total number of packages found.

Table: PackagesResult

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 30, 2025
packages[VersionedPackageSpecifier]yes Short-TermThe packages associated with the Entity Types provided. Returns a maximum of 1000 distinct packages. VersionedPackageSpecifier is a scalar.
totalCountintegeryes Short-TermThe total number of distinct packages that exist.