Summary

The generateFilterAlertFromPackageTemplate() GraphQL query generates an unsaved, in-memory filter alert from a library package alert template. Filter alerts fire actions when any events match the query string as they are ingested, with no time window. Pass the result to createFilterAlert() to save it.

API Stability Long-Term

Syntax

graphql
generateFilterAlertFromPackageTemplate(
      input: GenerateFilterAlertFromPackageTemplateInput!
   ): UnsavedFilterAlert!

Provide the repository or view name as viewName, the versioned package identifier as packageId, and the alert template name as templateName. See Input Parameters and Returned Values for details.

Example

Raw
graphql
query {
  generateFilterAlertFromPackageTemplate(
    input: {viewName: "company-http", 
            packageId: "http-packers@1.23",
            templateName: "standard-filter-alert-template"}
  ) {
    name, 
    description,
    throttleField,
    actions {
      id, name, isAllowedToRun
    }    
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  generateFilterAlertFromPackageTemplate(
    input: {viewName: \"company-http\", 
            packageId: \"http-packers@1.23\",
            templateName: \"standard-filter-alert-template\"}
  ) {
    name, 
    description,
    throttleField,
    actions {
      id, name, isAllowedToRun
    }    
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  generateFilterAlertFromPackageTemplate(
    input: {viewName: \"company-http\", 
            packageId: \"http-packers@1.23\",
            templateName: \"standard-filter-alert-template\"}
  ) {
    name, 
    description,
    throttleField,
    actions {
      id, name, isAllowedToRun
    }    
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  generateFilterAlertFromPackageTemplate( ^
    input: {viewName: \"company-http\",  ^
            packageId: \"http-packers@1.23\", ^
            templateName: \"standard-filter-alert-template\"} ^
  ) { ^
    name,  ^
    description, ^
    throttleField, ^
    actions { ^
      id, name, isAllowedToRun ^
    }     ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  generateFilterAlertFromPackageTemplate(
    input: {viewName: \"company-http\", 
            packageId: \"http-packers@1.23\",
            templateName: \"standard-filter-alert-template\"}
  ) {
    name, 
    description,
    throttleField,
    actions {
      id, name, isAllowedToRun
    }    
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  generateFilterAlertFromPackageTemplate(
    input: {viewName: \"company-http\", 
            packageId: \"http-packers@1.23\",
            templateName: \"standard-filter-alert-template\"}
  ) {
    name, 
    description,
    throttleField,
    actions {
      id, name, isAllowedToRun
    }    
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  generateFilterAlertFromPackageTemplate(
    input: {viewName: \"company-http\", 
            packageId: \"http-packers@1.23\",
            templateName: \"standard-filter-alert-template\"}
  ) {
    name, 
    description,
    throttleField,
    actions {
      id, name, isAllowedToRun
    }    
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  generateFilterAlertFromPackageTemplate(
    input: {viewName: \"company-http\", 
            packageId: \"http-packers@1.23\",
            templateName: \"standard-filter-alert-template\"}
  ) {
    name, 
    description,
    throttleField,
    actions {
      id, name, isAllowedToRun
    }    
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Input Parameters

Provide the repository or view name as viewName, the versioned package identifier as packageId, and the template name within the package as templateName. All three are required.

Table: GenerateFilterAlertFromPackageTemplateInput Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
packageIdVersionedPackageSpecifieryes Long-Term The unique identifier of the package of the filter alert template. VersionedPackageSpecifier is a scalar.
templateNameStringyes Long-Term The name of the filter alert template in the package.
viewNameRepoOrViewNameyes Long-Term The name of the view of the filter alert. RepoOrViewName is a scalar.

Returned Values

The result is a non-nullable UnsavedFilterAlert object. Fields include name, queryString, actions (a list of Action objects to fire on match), labels, enabled, and throttleTimeSeconds (nullable — if null, no throttle is applied). Use throttleFields (plural, non-nullable list) to throttle on specific fields; throttleField (singular) is deprecated in favor of throttleFields and will be removed at the earliest in version 1.282. Both throttle fields can only be set when throttleTimeSeconds is also set. The available fields are listed here:

Table: UnsavedFilterAlert Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results. 
Table last updated: Oct 14, 2026 
actionsActionyes Long-Term List of unique identifiers for actions to fire on query result. See Action.
descriptionString  Long-Term The description of the filter alert.
enabledBooleanyes Long-Term Whether the filter alert is enabled.
labelsStringyes Long-Term Labels attached to the filter alert.
nameStringyes Long-Term The name of the filter alert.
queryStringStringyes Long-Term The LogScale query to execute.
throttleFieldString  Deprecateddeprecated in 1.282The field on which to throttle. This can be set only if throttleTimeSeconds is set. Filter alerts now support multiple throttle fields. This field will be removed at the earliest in version 1.279. Use instead the throttleFields field.
throttleFieldsStringyes Long-Term The fields on which to throttle. This can be set only if throttleTimeSeconds is set.
throttleTimeSecondsLong  Long-Term The throttle time in seconds.