API Stability Short-Term

The searchFleet() GraphQL query is used to query the list of Fleet Configured hosts -- with paginated results.

Syntax

Below is the syntax for the searchFleet() query field:

graphql
searchFleet(
     isLiveFilter: boolean, 
     versionFilter: SearchFleetVersionFilter, 
     osFilter: SearchFleetOsFilter, 
     groupIdsFilter: [string], 
     groupFilter: GroupFilter,
     changeFilter: Changes, 
     queryState: string, 
     inactiveFilter: boolean, 
     statusFilter: SearchFleetStatusFilter, 
     testConfigIdFilter: string, 
     configIdFilter: string,
     searchFilter: string, 
     sortBy: Fleet__SortBy,
     orderBy: OrderBy,
     skip: integer,
     limit: integer
   ): SearchFleetUnion!

For the input, there are several parameters. Some have default values: isLiveFilter is true; Fleet__SortBy is Hostname; OrderBy is ASC; skip is 0; and limit is 50. There are also defaults for the special datatypes. They're described in the Given Datatypes section below.

To see examples of how to use this query field, scroll farther down this page.

Given Datatypes

Several of the given datatypes are standard types (e.g., string, integer). However, there are a few with special datatypes.

Table: Changes

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: May 8, 2025
Added   Short-TermSet to this option if the change is an addition.
NoChange   Short-TermThis is choice is used if the result is no change.
Removed   Short-TermThis indicates that the change is a removal.

Table: Fleet__SortBy

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: May 28, 2025
Change   Short-TermUsed to sort by change.
ConfigName   Short-TermUsed to sort by the configuration name.
CpuAverage5Min   Short-TermSet to sort by CPU five-minute average.
DiskMax5Min   Short-TermSet to sort by the disk usage five-minute maximum.
Hostname   Short-TermMakes sorting by the host name.
Ingest   Short-TermSet to sort by ingest source.
Labels   Short-TermSet to sort by labels.
LastActivity   Short-TermSet to sort by activity, the last first.
MemoryMax5Min   Short-TermChoose this option to sort memory by a maximum of five-minutes.
System   Short-TermSet to sort by system.
Version   Short-TermUsed to set sorting by version.

Table: GroupFilter

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 18, 2024
newQuerystringyes Short-TermThe new or replacement query for a group filter.
oldQuerystring  Short-TermThe old query to be replaced for a group filter.

Table: SearchFleetOsFilter

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 3, 2025
Linux   Short-TermLimit Fleet search to servers using the Linux operating system.
MacOS   Short-TermLimit searches to servers using the Macintosh operating system.
Unknown   Short-TermFilter on servers using an unknown operating systems.
Windows   Short-TermResults should be limited to servers using Microsoft Windows.

Table: SearchFleetVersionFilter

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Aug 18, 2025
needsUpdateboolean  Short-TermWhether to search for versions that need updating.
versionstring  Short-TermThe version to use.

Returned Datatypes

The returned datatype, SearchFleetUnion is a union of SearchFleetInProgress and SearchFleetResultSet. See the tables below for their parameters:

Table: SearchFleetInProgress

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 3, 2024
aggregationsSearchFleetAggregations  Short-TermThe aggregations of the result set. See SearchFleetAggregations.
queryStatestringyes Short-TermThe fleet search hasn't finished yet.
results[LogCollector]yes Short-TermThe paginated results set. See LogCollector.
totalResultsintegeryes Short-TermThe total number of matching results.
totalResultsInfoSearchFleetTotalResultInfoyes Short-TermInformation on the total results set. See SearchFleetTotalResultInfo.

Table: SearchFleetResultSet

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Mar 19, 2025
aggregationsSearchFleetAggregations  Short-TermThe aggregations of the result set. See SearchFleetAggregations.
queryStatestringyes Short-TermThe query state.
results[LogCollector]yes Short-TermThe paginated result set. See LogCollector.
totalResultsintegeryes Short-TermThe total number of matching results.
totalResultsInfoSearchFleetTotalResultInfoyes Short-TermInformation on a fleet search result set. See SearchFleetTotalResultInfo .

searchFleet() Examples

The main call to searchFleet() specifies the basic search filter, sort, order and length of the result set. Results start at zero:

graphql
searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
)

To paginate over multiple results, set the skip to the first result. For example, if the limit argument is 10, then the next set of results is available by setting skip to 11.

To get more specific information, use a query that filters and lists the fields that you want to view.

Listing Active Configurations

To obtain a list of active configurations in use by hosts, filter the returned results with the configuration blocks.

Raw
graphql
query {
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        configurations { ^
          assignment: assignment ^
          name: name ^
          id: id ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ]
        }
      ]
    }
  }
}

Notice that this only returns a list of configurations in use, not all that are available.

Listing Log Sources Across Hosts

To obtain a list of the log sources and parsers used by all hosts, filter the returned results with the logSources block:

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10 ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName, ^
        logSources { ^
          parser: parser, ^
          repository: repository, ^
          sourceType: sourceType, ^
          sourceName: sourceName ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ]
        }
      ]
    }
  }
}

Finding Hosts in Error State

To get a list of the hosts that are in an OK state, add the statusFilter argument with a value of OK.

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10, ^
    statusFilter: OK ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName, ^
        hostname, ^
        machineId, ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
        }
      ]
    }
  }
}

For hosts in the error state, use Error for the statusFilter value like so:

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10, ^
    statusFilter: Error ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName, ^
        hostname, ^
        machineId, ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "hostname": "ReacherGilt",
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2"
        }
      ]
    }
  }
}

Getting Full Fleet Host Details

Toget the host details for the Fleet, enter the following query:

Raw
graphql
query {
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        change: change, ^
        configurations { ^
          assignment: assignment, ^
          name: name, ^
          id: id ^
        } ^
        diskMax5Min: diskMax5Min, ^
        memoryMax5Min: memoryMax5Min, ^
        cpuAverage5Min: cpuAverage5Min, ^
        cfgTestId: cfgTestId, ^
        errors: errors, ^
        configId: configId, ^
        configName: configName, ^
        logSources { ^
          parser: parser, ^
          repository: repository, ^
          sourceType: sourceType, ^
          sourceName: sourceName ^
        } ^
        ipAddress: ipAddress, ^
        lastActivity: lastActivity, ^
        ingestLast24H: ingestLast24H, ^
        version: version, ^
        system: system, ^
        hostname: hostname, ^
        machineId: machineId, ^
        id: id ^
      } ^
      totalResults: totalResults ^
    } ^
    ...on SearchFleetInProgress { ^
      queryState: queryState ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "lastActivity": "2024-03-01T04:31:09Z",
          "errors": [],
          "version": "1.6.2",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2",
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ],
          "cpuAverage5Min": 0.10625,
          "hostname": "ReacherGilt",
          "system": "macOS 14.3.1 (arm64)",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ],
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "change": null,
          "id": "J7v8VPxQpsisowLiL68F83NvAaBF3wiW",
          "ingestLast24H": 2076167,
          "configId": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ",
          "memoryMax5Min": 541310976,
          "diskMax5Min": 53.68,
          "cfgTestId": null
        }
      ],
      "totalResults": 1
    }
  }
}