The searchFleet() GraphQL query is used to query the list of fleet-configured hosts.

Syntax

Below is the syntax for the searchFleet() query field:

graphql
searchFleet(
     changeFilter: Changes, 
     configurationFilter: ConfigurationFilter, 
     queryState: string, 
     inactiveFilter: boolean, 
     statusFilter: SearchFleetStatusFilter, 
     testConfigIdFilter: string, 
     configIdFilter: string,
     searchFilter: string, 
     sortBy: Fleet__SortBy = Hostname,
     orderBy: OrderBy,
     skip: integer,
     limit: integer
   ): SearchFleetUnion!

Given Datatypes

Several of the given datatypes are standard types (e.g., string, integer). However, there are a few with special datatypes.

The data type, Changes is enumerated with three possible values: Removed, Added or NoChange.

The data type, SearchFleetStatusFilter filters the output based on whether the host is in the Error or OK state.

For the given input type, ConfigurationFilter(), there are a couple of parameters, each accepting a string: oldQuery (value not required); and newQuery

For sorting, you can se the values enumerated for Fleet__SortBy below:

Table: Fleet__SortBy

ParameterTypeRequiredDefaultDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 13, 2024
Changebooleanyes Whether to sort by change.
ConfigNamebooleanyes Whether to sort by the configuration name.
CpuAverage5Minbooleanyes Whether to sort by CPU five-minute average.
DiskMax5Minbooleanyes Whether to sort by the disk usage five-minute maximum.
Hostnamebooleanyes Whether to sort by the host name.
Ingestbooleanyes Whether to sort by ingest source.
LastActivitybooleanyes Whether to sort by activity, the last first.
MemoryMax5Minbooleanyes Whether to sort by memory five-minute maximum.
Systembooleanyes Whether to sort by system.
Versionbooleanyes Whether to sort by version.

Returned Datatypes

The returned datatype SearchFleetUnion is a union: SearchFleetUnion = SearchFleetResultSet | SearchFleetInProgress.

searchFleet() Examples

The main call to searchFleet() specifies the basic search filter, sort, order and length of the result set.

Results start at zero:

graphql
searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
)

To paginate over multiple results, set the skip to the first result. For example, if the limit argument is 10, then the next set of results is available by setting skip to 11.

To get more specific information, use a query that filters and lists the fields that you want o view.

Listing Active Configurations

To obtain a list of active configurations in use by hosts, filter the returned results with the configurations blocks.

Raw
graphql
query {
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        configurations { ^
          assignment: assignment ^
          name: name ^
          id: id ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'
"$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ]
        }
      ]
    }
  }
}

Note that this only outputs the list of configurations in use, not all of the available configurations.

Listing Log Sources Across Hosts

To obtain a list of the log sources and parsers used across all hosts, filter the returned results with the logSources block:

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName ^
        logSources { ^
          parser: parser ^
          repository: repository ^
          sourceType: sourceType ^
          sourceName: sourceName ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}'
"$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ]
        }
      ]
    }
  }
}

Finding Hosts in Error State

To get a list of the hosts that are in an OK state, add the statusFilter argument with a value of OK.

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
    statusFilter: OK ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName ^
        hostname ^
        machineId ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}'
"$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
        }
      ]
    }
  }
}

For hosts in the error state, use Error.

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
    statusFilter: OK ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName ^
        hostname ^
        machineId ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}'
"$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "hostname": "ReacherGilt",
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2"
        }
      ]
    }
  }
}

Getting Full Fleet Host Details

Raw
graphql
query {
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        change: change ^
        configurations { ^
          assignment: assignment ^
          name: name ^
          id: id ^
        } ^
        diskMax5Min: diskMax5Min ^
        memoryMax5Min: memoryMax5Min ^
        cpuAverage5Min: cpuAverage5Min ^
        cfgTestId: cfgTestId ^
        errors: errors ^
        configId: configId ^
        configName: configName ^
        logSources { ^
          parser: parser ^
          repository: repository ^
          sourceType: sourceType ^
          sourceName: sourceName ^
        } ^
        ipAddress: ipAddress ^
        lastActivity: lastActivity ^
        ingestLast24H: ingestLast24H ^
        version: version ^
        system: system ^
        hostname: hostname ^
        machineId: machineId ^
        id: id ^
      } ^
      totalResults: totalResults ^
    } ^
    ...on SearchFleetInProgress { ^
      queryState: queryState ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'
"$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "lastActivity": "2024-03-01T04:31:09Z",
          "errors": [],
          "version": "1.6.2",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2",
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ],
          "cpuAverage5Min": 0.10625,
          "hostname": "ReacherGilt",
          "system": "macOS 14.3.1 (arm64)",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ],
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "change": null,
          "id": "J7v8VPxQpsisowLiL68F83NvAaBF3wiW",
          "ingestLast24H": 2076167,
          "configId": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ",
          "memoryMax5Min": 541310976,
          "diskMax5Min": 53.68,
          "cfgTestId": null
        }
      ],
      "totalResults": 1
    }
  }
}