searchFleet()

API Stability	`Sjprt-Term`

The searchFleet() GraphQL query is used to query the list of fleet-configured hosts.

Syntax

Below is the syntax for the searchFleet() query field:

graphql

searchFleet(
     changeFilter: Changes, 
     configurationFilter: ConfigurationFilter, 
     queryState: string, 
     inactiveFilter: boolean, 
     statusFilter: SearchFleetStatusFilter, 
     testConfigIdFilter: string, 
     configIdFilter: string,
     searchFilter: string, 
     sortBy: Fleet__SortBy = Hostname,
     orderBy: OrderBy,
     skip: integer,
     limit: integer
   ): SearchFleetUnion!

Given Datatypes

Several of the given datatypes are standard types (e.g., string, integer). However, there are a few with special datatypes.

The data type, Changes is enumerated with three possible values: Removed, Added or NoChange.

The data type, SearchFleetStatusFilter filters the output based on whether the host is in the Error or OK state.

For the given input type, ConfigurationFilter(), there are a couple of parameters, each accepting a string: oldQuery (value not required); and newQuery

For sorting, you can se the values enumerated for Fleet__SortBy below:

Table: Fleet__SortBy

Parameter	Type	Stability	Description
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 13, 2024
`Change`	boolean	`Short-Term`	Whether to sort by change.
`ConfigName`	boolean	`Short-Term`	Whether to sort by the configuration name.
`CpuAverage5Min`	boolean	`Short-Term`	Whether to sort by CPU five-minute average.
`DiskMax5Min`	boolean	`Short-Term`	Whether to sort by the disk usage five-minute maximum.
`Hostname`	boolean	`Short-Term`	Whether to sort by the host name.
`Ingest`	boolean	`Short-Term`	Whether to sort by ingest source.
`LastActivity`	boolean	`Short-Term`	Whether to sort by activity, the last first.
`MemoryMax5Min`	boolean	`Short-Term`	Whether to sort by memory five-minute maximum.
`System`	boolean	`Short-Term`	Whether to sort by system.
`Version`	boolean	`Short-Term`	Whether to sort by version.

Returned Datatypes

The returned datatype SearchFleetUnion() is a union: SearchFleetUnion = SearchFleetResultSet | SearchFleetInProgress.

searchFleet() Examples

The main call to searchFleet() specifies the basic search filter, sort, order and length of the result set.

Results start at zero:

graphql

searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
)

To paginate over multiple results, set the skip to the first result. For example, if the limit argument is 10, then the next set of results is available by setting skip to 11.

To get more specific information, use a query that filters and lists the fields that you want o view.

Listing Active Configurations

To obtain a list of active configurations in use by hosts, filter the returned results with the configurations blocks.

Show:

graphql

query {
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        configurations { ^
          assignment: assignment ^
          name: name ^
          id: id ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ]
        }
      ]
    }
  }
}

Note that this only outputs the list of configurations in use, not all of the available configurations.

Listing Log Sources Across Hosts

To obtain a list of the log sources and parsers used across all hosts, filter the returned results with the logSources block:

Show:

graphql

{
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName ^
        logSources { ^
          parser: parser ^
          repository: repository ^
          sourceType: sourceType ^
          sourceName: sourceName ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ]
        }
      ]
    }
  }
}

Finding Hosts in Error State

To get a list of the hosts that are in an OK state, add the statusFilter argument with a value of OK.

Show:

graphql

{
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
    statusFilter: OK ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName ^
        hostname ^
        machineId ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
        }
      ]
    }
  }
}

For hosts in the error state, use Error.

Show:

graphql

{
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
    statusFilter: OK ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName ^
        hostname ^
        machineId ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName
        hostname
        machineId
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "hostname": "ReacherGilt",
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2"
        }
      ]
    }
  }
}

Getting Full Fleet Host Details

Show:

graphql

query {
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF

shell

curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        change: change ^
        configurations { ^
          assignment: assignment ^
          name: name ^
          id: id ^
        } ^
        diskMax5Min: diskMax5Min ^
        memoryMax5Min: memoryMax5Min ^
        cpuAverage5Min: cpuAverage5Min ^
        cfgTestId: cfgTestId ^
        errors: errors ^
        configId: configId ^
        configName: configName ^
        logSources { ^
          parser: parser ^
          repository: repository ^
          sourceType: sourceType ^
          sourceName: sourceName ^
        } ^
        ipAddress: ipAddress ^
        lastActivity: lastActivity ^
        ingestLast24H: ingestLast24H ^
        version: version ^
        system: system ^
        hostname: hostname ^
        machineId: machineId ^
        id: id ^
      } ^
      totalResults: totalResults ^
    } ^
    ...on SearchFleetInProgress { ^
      queryState: queryState ^
    } ^
  } ^
}" ^
} '

powershell

curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)

javascript

const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change
        configurations {
          assignment: assignment
          name: name
          id: id
        }
        diskMax5Min: diskMax5Min
        memoryMax5Min: memoryMax5Min
        cpuAverage5Min: cpuAverage5Min
        cfgTestId: cfgTestId
        errors: errors
        configId: configId
        configName: configName
        logSources {
          parser: parser
          repository: repository
          sourceType: sourceType
          sourceName: sourceName
        }
        ipAddress: ipAddress
        lastActivity: lastActivity
        ingestLast24H: ingestLast24H
        version: version
        system: system
        hostname: hostname
        machineId: machineId
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();

Example Responses

Show:

json

{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "lastActivity": "2024-03-01T04:31:09Z",
          "errors": [],
          "version": "1.6.2",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2",
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ],
          "cpuAverage5Min": 0.10625,
          "hostname": "ReacherGilt",
          "system": "macOS 14.3.1 (arm64)",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ],
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "change": null,
          "id": "J7v8VPxQpsisowLiL68F83NvAaBF3wiW",
          "ingestLast24H": 2076167,
          "configId": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ",
          "memoryMax5Min": 541310976,
          "diskMax5Min": 53.68,
          "cfgTestId": null
        }
      ],
      "totalResults": 1
    }
  }
}

GraphQL Queries

GraphQL API Stability

GraphQL Mutations

GraphQL Datatypes

searchFleet()

Syntax

Given Datatypes

Returned Datatypes

searchFleet() Examples

Listing Active Configurations

Listing Log Sources Across Hosts

Finding Hosts in Error State

Getting Full Fleet Host Details

Enter search term