Summary

The searchFleet() GraphQL query is used to get a list of Fleet configured hosts — with paginated results.

API Stability Short-Term

Syntax

graphql
searchFleet(
     isLiveFilter: boolean, 
     versionFilter: SearchFleetVersionFilter, 
     osFilter: SearchFleetOsFilter, 
     groupIdsFilter: [string], 
     groupFilter: GroupFilter,
     changeFilter: Changes, 
     queryState: string, 
     inactiveFilter: boolean, 
     statusFilter: SearchFleetStatusFilter, 
     testConfigIdFilter: string, 
     configIdFilter: string,
     searchFilter: string, 
     sortBy: Fleet__SortBy,
     orderBy: OrderBy,
     skip: integer,
     limit: integer
   ): SearchFleetUnion!

There are several input parameters for this query. See the Input Parameters section for descriptions of each.

To see many examples of how to use this query field, scroll down this page, after the Given and the Returned Values sections.

Input Parameters

There are quite a few input parameters for this query. The table below lists them, with brief descriptions. The tables that follow are for more details on the special datatypes used.

Table: Input Parameters & Datatypes

Parameter Type Required Default Description
This table contains all input parameters for this query. Since some of the parameters use special datatypes, additional tables for them are included below.
changeFilter Changes     Filter based on type of change. See table below.
configIdFilter string     Configuration identifier filter.
groupFilter GroupFilter     Filter based on old or new queries. See table below.
groupIdsFilter [string]     Group identifiers filter.
inactiveFilter boolean     Whether to include inactive filters.
isGroupPreviewQuery boolean   false Whether to include group preview queries.
isLiveFilter boolean   true Whether to include live filters.
limit integer   50 The maximum number of results to return.
orderBy OrderBy   ASC How to order results. See table below.
osFilter SearchFleetOsFilter     The type of operating system on which to filter results.
queryState string     A query state to include.
searchFilter string     Any text on which to filter results.
skip integer   0 The number of results to skip, or offset to use.
sortBy Fleet__SortBy     How to sort results based on key factors. See table below.
statusFilter SearchFleetStatusFilter     Filter on fleet status. See table below.
testConfigIdFilter string     A test configuration identifier filter.
versionFilter SearchFleetVersionFilter     The Fleet version and whether it needs updating. See table below.

The first special datatypes is used to limit Fleets to ones added or not. The choices for this are listed in the table here:

Table: Changes Enum Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: May 8, 2025
Added   Short-TermSet to this option if the change is an addition.
NoChange   Short-TermThis is choice is used if the result is no change.
Removed   Short-TermThis indicates that the change is a removal.

The second special datatype is used to sort results by key factors (e.g., version, host name). The choices for this are listed in the table below:

Table: Fleet__SortBy Enum Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: May 28, 2025
Change   Short-TermUsed to sort by change.
ConfigName   Short-TermUsed to sort by the configuration name.
CpuAverage5Min   Short-TermSet to sort by CPU five-minute average.
DiskMax5Min   Short-TermSet to sort by the disk usage five-minute maximum.
Hostname  ✓Short-TermMakes sorting by the host name.
Ingest   Short-TermSet to sort by ingest source.
Labels   Short-TermSet to sort by labels.
LastActivity   Short-TermSet to sort by activity, the last first.
MemoryMax5Min   Short-TermChoose this option to sort memory by a maximum of five-minutes.
System   Short-TermSet to sort by system.
Version   Short-TermUsed to set sorting by version.

The next special datatype is used to group results by old and new queries. The table below lists and describes these parameters:

Table: GroupFilter Input Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Sep 18, 2024
newQuerystringyes Short-TermThe new or replacement query for a group filter.
oldQuerystring  Short-TermThe old query to be replaced for a group filter.

You can return results based on a particular operating system. The table below lists the choices:

Table: SearchFleetOsFilter Enum Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 3, 2025
Linux   Short-TermLimit Fleet search to servers using the Linux operating system.
MacOS   Short-TermLimit searches to servers using the Macintosh operating system.
Unknown   Short-TermFilter on servers using an unknown operating systems.
Windows   Short-TermResults should be limited to servers using Microsoft Windows.

This special datatype is used to filter based the Fleet status. The choices for this are listed in the table here:

Table: SearchFleetStatusFilter Enum Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: May 9, 2025
Error   Short-TermThe search Fleet status is an error.
OK   Short-TermThe search Fleet status is successful.

The next given datatype is used to filter based on the Fleet version and if it needs updating. The choices for this are listed in the table here:

Table: SearchFleetVersionFilter Input Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Aug 18, 2025
needsUpdateboolean  Short-TermWhether to search for versions that need updating.
versionstring  Short-TermThe version to use.

Returned Values

The returned datatype is a union of two other datatypes. The first is used for Fleet searches that have not yet finished. For it you can get the total results thus far, the operating system for the installation and other relevant factors. See the table below and click on links to the datatypes it uses for more results that may be returned:

Table: SearchFleetInProgress Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Oct 3, 2024
aggregationsSearchFleetAggregations  Short-TermThe aggregations of the result set. See SearchFleetAggregations.
queryStatestringyes Short-TermThe fleet search hasn't finished yet.
results[LogCollector]yes Short-TermThe paginated results set. See LogCollector.
totalResultsintegeryes Short-TermThe total number of matching results.
totalResultsInfoSearchFleetTotalResultInfoyes Short-TermInformation on the total results set. See SearchFleetTotalResultInfo.

The second returned datatype used for Fleet searches that are finished. With it, there are the same parameters. See the table below and click on links to the datatypes it uses:

Table: SearchFleetResultSet Datatype

ParameterTypeRequiredDefaultStabilityDescription
Some input parameters may be required, as indicated in the Required column. For return values, this indicates that you are assured a value if the field is requested for the results.
Table last updated: Mar 19, 2025
aggregationsSearchFleetAggregations  Short-TermThe aggregations of the result set. See SearchFleetAggregations.
queryStatestringyes Short-TermThe query state.
results[LogCollector]yes Short-TermThe paginated result set. See LogCollector.
totalResultsintegeryes Short-TermThe total number of matching results.
totalResultsInfoSearchFleetTotalResultInfoyes Short-TermInformation on a fleet search result set. See SearchFleetTotalResultInfo .

Examples

The main call to searchFleet() specifies the basic search filter, sort, order and length of the result set. Results start at zero:

graphql
searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
)

To paginate over multiple results, set the skip to the first result. For example, if the limit argument is 10, then the next set of results is available by setting skip to 11.

To get more specific information, use a query that filters and lists the fields that you want to view.

Listing Active Configurations

To obtain a list of active configurations in use by hosts, filter the returned results with the configuration blocks.

Raw
graphql
query {
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        configurations { ^
          assignment: assignment ^
          name: name ^
          id: id ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ]
        }
      ]
    }
  }
}

Notice that this only returns a list of configurations in use, not all that are available.

Listing Log Sources Across Hosts

To obtain a list of the log sources and parsers used by all hosts, filter the returned results with the logSources block:

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10 ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName, ^
        logSources { ^
          parser: parser, ^
          repository: repository, ^
          sourceType: sourceType, ^
          sourceName: sourceName ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ]
        }
      ]
    }
  }
}

Finding Hosts in Error State

To get a list of the hosts that are in an OK state, add the statusFilter argument with a value of OK.

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10, ^
    statusFilter: OK ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName, ^
        hostname, ^
        machineId, ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
        }
      ]
    }
  }
}

For hosts in the error state, use Error for the statusFilter value like so:

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10, ^
    statusFilter: Error ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName, ^
        hostname, ^
        machineId, ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "hostname": "ReacherGilt",
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2"
        }
      ]
    }
  }
}

Getting Full Fleet Host Details

To get the host details for the Fleet, enter the following query:

Raw
graphql
query {
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        change: change, ^
        configurations { ^
          assignment: assignment, ^
          name: name, ^
          id: id ^
        } ^
        diskMax5Min: diskMax5Min, ^
        memoryMax5Min: memoryMax5Min, ^
        cpuAverage5Min: cpuAverage5Min, ^
        cfgTestId: cfgTestId, ^
        errors: errors, ^
        configId: configId, ^
        configName: configName, ^
        logSources { ^
          parser: parser, ^
          repository: repository, ^
          sourceType: sourceType, ^
          sourceName: sourceName ^
        } ^
        ipAddress: ipAddress, ^
        lastActivity: lastActivity, ^
        ingestLast24H: ingestLast24H, ^
        version: version, ^
        system: system, ^
        hostname: hostname, ^
        machineId: machineId, ^
        id: id ^
      } ^
      totalResults: totalResults ^
    } ^
    ...on SearchFleetInProgress { ^
      queryState: queryState ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "lastActivity": "2024-03-01T04:31:09Z",
          "errors": [],
          "version": "1.6.2",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2",
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ],
          "cpuAverage5Min": 0.10625,
          "hostname": "ReacherGilt",
          "system": "macOS 14.3.1 (arm64)",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ],
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "change": null,
          "id": "J7v8VPxQpsisowLiL68F83NvAaBF3wiW",
          "ingestLast24H": 2076167,
          "configId": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ",
          "memoryMax5Min": 541310976,
          "diskMax5Min": 53.68,
          "cfgTestId": null
        }
      ],
      "totalResults": 1
    }
  }
}