The queryAnalysis()
Below is the syntax for the queryAnalysis()
queryAnalysis(
queryString : string! ,
languageVersion : LanguageVersionEnum! ,
isLive : boolean! , viewName : string
) : queryAnalysis!
For the input, the only special datatype is for
languageVersion . See the
LanguageVersionEnumlegacy ). For the return
parameters, see the Returned Datatype section here. Below is an
example of how this query field might be used:
Show:
Raw Mac OS or Linux (curl) Mac OS or Linux (curl) One-line Windows Cmd and curl Windows Powershell and curl Perl Python Node.js
Raw query {
queryAnalysis(
queryString : "host:localhost" ,
languageVersion : legacy,
isLive : true ,
viewName : "humio" )
{ filterPart, isAggregate, isSinglePhase}
} Mac OS or Linux (curl) curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d @- << EOF
{"query" : "query {
queryAnalysis(
queryString: \"host:localhost\",
languageVersion: legacy,
isLive: true,
viewName:\"humio\")
{filterPart, isAggregate, isSinglePhase}
}"
}
EOFMac OS or Linux (curl) One-line curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d @- << EOF
{"query" : "query {
queryAnalysis(
queryString: \"host:localhost\",
languageVersion: legacy,
isLive: true,
viewName:\"humio\")
{filterPart, isAggregate, isSinglePhase}
}"
}
EOFWindows Cmd and curl curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
-H "Authorization: Bearer $TOKEN" ^
-H "Content-Type: application/json" ^
-d @'{"query" : "query { ^
queryAnalysis( ^
queryString: \"host:localhost\", ^
languageVersion: legacy, ^
isLive: true, ^
viewName:\"humio\") ^
{filterPart, isAggregate, isSinglePhase} ^
}" ^
} 'Windows Powershell and curl curl.exe -X POST
-H "Authorization: Bearer $TOKEN "
-H "Content-Type: application/json"
-d '{"query" : "query {
queryAnalysis(
queryString: \"host:localhost\",
languageVersion: legacy,
isLive: true,
viewName:\"humio\")
{filterPart, isAggregate, isSinglePhase}
}"
}'
"$YOUR_LOGSCALE_URL /graphql" Perl
use HTTP::Request;
use LWP;
my $INGEST_TOKEN = "TOKEN" ;
my $uri = '$YOUR_LOGSCALE_URL/graphql' ;
my $json = '{"query" : "query {
queryAnalysis(
queryString: \"host:localhost\",
languageVersion: legacy,
isLive: true,
viewName:\"humio\")
{filterPart, isAggregate, isSinglePhase}
}"
}' ;
my $req = HTTP::Request->new("POST" , $uri );
$req->header("Authorization" => "Bearer $TOKEN" );
$req->header("Content-Type" => "application/json" );
$req->content( $json );
my $lwp = LWP::UserAgent->new;
my $result = $lwp->request( $req );
print $result->{"_content" },"\n" ;Python
import requests
url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
queryAnalysis(
queryString: \"host:localhost\",
languageVersion: legacy,
isLive: true,
viewName:\"humio\")
{filterPart, isAggregate, isSinglePhase}
}"
}'''
resp = requests.post(url,
data = mydata,
headers = {
"Authorization" : "Bearer $TOKEN" ,
"Content-Type" : "application/json"
}
)
print (resp.text)Node.js const https = require ('https' );
const data = JSON .stringify (
{"query" : "query {
queryAnalysis(
queryString: \"host:localhost\",
languageVersion: legacy,
isLive: true,
viewName:\"humio\")
{filterPart, isAggregate, isSinglePhase}
}"
}
);
const options = {
hostname : '$YOUR_LOGSCALE_URL/graphql' ,
path : '/graphql' ,
port : 443 ,
method : 'POST' ,
headers : {
'Content-Type' : 'application/json' ,
'Content-Length' : data.length ,
Authorization : 'BEARER ' + process.env .TOKEN ,
'User-Agent' : 'Node' ,
},
};
const req = https.request (options, (res ) => {
let data = '' ;
console .log (`statusCode: ${res.statusCode} ` );
res.on ('data' , (d ) => {
data += d;
});
res.on ('end' , () => {
console .log (JSON .parse (data).data );
});
});
req.on ('error' , (error ) => {
console .error (error);
});
req.write (data);
req.end ();Example Responses Show:
Success (HTTP Response Code 200 OK)
Success (HTTP Response Code 200 OK) {
"data" : {
"queryAnalysis" : {
"filterPart" : "host:localhost" ,
"isAggregate" : false ,
"isSinglePhase" : true }
}
}
For queryAnalysis
Table: queryAnalysis
Parameter Type Required Default Stability Description Some arguments may be required, as indicated in the Required Table last updated: Mar 18, 2025 filterPartstring yes PreviewThe query string up to the first aggregator. drilldownsdrilldowns yes PreviewThe number associated with the type of page. See drilldowns isAggregateboolean yes PreviewWhether the query contains an aggregator. isSinglePhaseboolean yes PreviewWhether the query doesn't contain a join-like function. isValidFilterAlertQueryboolean yes Preview Checks if a query is fit for use for a filter alert.
This is deprecated and is no longer used internally. It will be removed in version 1.207. Use instead analyzeQuery suggestedAlertType
