API Stability Short-Term

The searchFleet() GraphQL query is used to get a list of Fleet configured hosts — with paginated results.

Related to this query, there are also the queries, searchFleetInstallationTokens() to get a list of Fleet installation tokens, getFleetManagementUrl() to get the URL endpoint for Fleet management, and fleetInstallationTokens() to get a list of Fleet installation tokens and related information. Additionally, there are the createFleetInstallToken() and updateFleetInstallTokenConfigId() mutation fields for creating and updating Fleet installation tokens and configurations.

Syntax

graphql
searchFleet(
     isLiveFilter: boolean, 
     versionFilter: SearchFleetVersionFilter, 
     osFilter: SearchFleetOsFilter, 
     groupIdsFilter: [string], 
     groupFilter: GroupFilter,
     changeFilter: Changes, 
     queryState: string, 
     inactiveFilter: boolean, 
     statusFilter: SearchFleetStatusFilter, 
     testConfigIdFilter: string, 
     configIdFilter: string,
     searchFilter: string, 
     sortBy: Fleet__SortBy,
     orderBy: OrderBy,
     skip: integer,
     limit: integer
   ): SearchFleetUnion!

Some of these parameters have default values: isLiveFilter is true; skip is 0; and limit is 50. The defaults for the special datatypes are checked in their tables in the Given Datatypes section.

To see many examples of how to use this query field, scroll down this page, after the Given and the Returned Datatype sections.

Given Datatypes

There are a few given datatypes for this query. Tabes for these are presented alphabetically in this section. This first one is to limit Fleets to ones added or not. The choices for this are listed in the table here:

Table: Changes

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: May 8, 2025
Added   Short-TermSet to this option if the change is an addition.
NoChange   Short-TermThis is choice is used if the result is no change.
Removed   Short-TermThis indicates that the change is a removal.

The second given datatype is used to sort results by key factors (e.g., version, host name). The choices for this are listed in the table below:

Table: Fleet__SortBy

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: May 28, 2025
Change   Short-TermUsed to sort by change.
ConfigName   Short-TermUsed to sort by the configuration name.
CpuAverage5Min   Short-TermSet to sort by CPU five-minute average.
DiskMax5Min   Short-TermSet to sort by the disk usage five-minute maximum.
Hostname  ✓Short-TermMakes sorting by the host name.
Ingest   Short-TermSet to sort by ingest source.
Labels   Short-TermSet to sort by labels.
LastActivity   Short-TermSet to sort by activity, the last first.
MemoryMax5Min   Short-TermChoose this option to sort memory by a maximum of five-minutes.
System   Short-TermSet to sort by system.
Version   Short-TermUsed to set sorting by version.

The next datatype is used to group results by old and new queries. The table below lists and describes these parameters:

Table: GroupFilter

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Sep 18, 2024
newQuerystringyes Short-TermThe new or replacement query for a group filter.
oldQuerystring  Short-TermThe old query to be replaced for a group filter.

You can return results based on a particular operating system. The table below lists the choices:

Table: SearchFleetOsFilter

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 3, 2025
Linux   Short-TermLimit Fleet search to servers using the Linux operating system.
MacOS   Short-TermLimit searches to servers using the Macintosh operating system.
Unknown   Short-TermFilter on servers using an unknown operating systems.
Windows   Short-TermResults should be limited to servers using Microsoft Windows.

The next given datatype is used to get the Fleet version and if it needs updating. The choices for this are listed in the table here:

Table: SearchFleetVersionFilter

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Aug 18, 2025
needsUpdateboolean  Short-TermWhether to search for versions that need updating.
versionstring  Short-TermThe version to use.

Returned Datatype

The returned datatype is a union of two other datatypes. The first is used for Fleet searches that have not yet finished. For it you can get the total results thus far, the operating system for the installation and other relevant factors. See the table below and click on links to the datatypes it uses for more results that may be returned:

Table: SearchFleetInProgress

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Oct 3, 2024
aggregationsSearchFleetAggregations  Short-TermThe aggregations of the result set. See SearchFleetAggregations.
queryStatestringyes Short-TermThe fleet search hasn't finished yet.
results[LogCollector]yes Short-TermThe paginated results set. See LogCollector.
totalResultsintegeryes Short-TermThe total number of matching results.
totalResultsInfoSearchFleetTotalResultInfoyes Short-TermInformation on the total results set. See SearchFleetTotalResultInfo.

The second returned datatype used for Fleet searches that are finished. With it, there are the same parameters. See the table below and click on links to the datatypes it uses:

Table: SearchFleetResultSet

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Mar 19, 2025
aggregationsSearchFleetAggregations  Short-TermThe aggregations of the result set. See SearchFleetAggregations.
queryStatestringyes Short-TermThe query state.
results[LogCollector]yes Short-TermThe paginated result set. See LogCollector.
totalResultsintegeryes Short-TermThe total number of matching results.
totalResultsInfoSearchFleetTotalResultInfoyes Short-TermInformation on a fleet search result set. See SearchFleetTotalResultInfo .

Examples

The main call to searchFleet() specifies the basic search filter, sort, order and length of the result set. Results start at zero:

graphql
searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
)

To paginate over multiple results, set the skip to the first result. For example, if the limit argument is 10, then the next set of results is available by setting skip to 11.

To get more specific information, use a query that filters and lists the fields that you want to view.

Listing Active Configurations

To obtain a list of active configurations in use by hosts, filter the returned results with the configuration blocks.

Raw
graphql
query {
  searchFleet: searchFleet(
    searchFilter: ""
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\" ^
    sortBy: Hostname ^
    orderBy: ASC ^
    skip: 0 ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        configurations { ^
          assignment: assignment ^
          name: name ^
          id: id ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\"
    sortBy: Hostname
    orderBy: ASC
    skip: 0
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        configurations {
          assignment: assignment
          name: name
          id: id
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ]
        }
      ]
    }
  }
}

Notice that this only returns a list of configurations in use, not all that are available.

Listing Log Sources Across Hosts

To obtain a list of the log sources and parsers used by all hosts, filter the returned results with the logSources block:

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10 ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName, ^
        logSources { ^
          parser: parser, ^
          repository: repository, ^
          sourceType: sourceType, ^
          sourceName: sourceName ^
        } ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ]
        }
      ]
    }
  }
}

Finding Hosts in Error State

To get a list of the hosts that are in an OK state, add the statusFilter argument with a value of OK.

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10, ^
    statusFilter: OK ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName, ^
        hostname, ^
        machineId, ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: OK
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
        }
      ]
    }
  }
}

For hosts in the error state, use Error for the statusFilter value like so:

Raw
graphql
{
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "{ ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10, ^
    statusFilter: Error ^
  ) { ^
    __typename ^
    ... on SearchFleetResultSet { ^
      results { ^
        configName: configName, ^
        hostname, ^
        machineId, ^
        ipAddress ^
      } ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "{
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10,
    statusFilter: Error
  ) {
    __typename
    ... on SearchFleetResultSet {
      results {
        configName: configName,
        hostname,
        machineId,
        ipAddress
      }
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "hostname": "ReacherGilt",
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2"
        }
      ]
    }
  }
}

Getting Full Fleet Host Details

To get the host details for the Fleet, enter the following query:

Raw
graphql
query {
  searchFleet: searchFleet(
    searchFilter: "",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "query { ^
  searchFleet: searchFleet( ^
    searchFilter: \"\", ^
    sortBy: Hostname, ^
    orderBy: ASC, ^
    skip: 0, ^
    limit: 10 ^
) { ^
    __typename ^
    ...on SearchFleetResultSet { ^
      results { ^
        change: change, ^
        configurations { ^
          assignment: assignment, ^
          name: name, ^
          id: id ^
        } ^
        diskMax5Min: diskMax5Min, ^
        memoryMax5Min: memoryMax5Min, ^
        cpuAverage5Min: cpuAverage5Min, ^
        cfgTestId: cfgTestId, ^
        errors: errors, ^
        configId: configId, ^
        configName: configName, ^
        logSources { ^
          parser: parser, ^
          repository: repository, ^
          sourceType: sourceType, ^
          sourceName: sourceName ^
        } ^
        ipAddress: ipAddress, ^
        lastActivity: lastActivity, ^
        ingestLast24H: ingestLast24H, ^
        version: version, ^
        system: system, ^
        hostname: hostname, ^
        machineId: machineId, ^
        id: id ^
      } ^
      totalResults: totalResults ^
    } ^
    ...on SearchFleetInProgress { ^
      queryState: queryState ^
    } ^
  } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "query {
  searchFleet: searchFleet(
    searchFilter: \"\",
    sortBy: Hostname,
    orderBy: ASC,
    skip: 0,
    limit: 10
) {
    __typename
    ...on SearchFleetResultSet {
      results {
        change: change,
        configurations {
          assignment: assignment,
          name: name,
          id: id
        }
        diskMax5Min: diskMax5Min,
        memoryMax5Min: memoryMax5Min,
        cpuAverage5Min: cpuAverage5Min,
        cfgTestId: cfgTestId,
        errors: errors,
        configId: configId,
        configName: configName,
        logSources {
          parser: parser,
          repository: repository,
          sourceType: sourceType,
          sourceName: sourceName
        }
        ipAddress: ipAddress,
        lastActivity: lastActivity,
        ingestLast24H: ingestLast24H,
        version: version,
        system: system,
        hostname: hostname,
        machineId: machineId,
        id: id
      }
      totalResults: totalResults
    }
    ...on SearchFleetInProgress {
      queryState: queryState
    }
  }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "searchFleet": {
      "__typename": "SearchFleetResultSet",
      "results": [
        {
          "configName": "base2",
          "lastActivity": "2024-03-01T04:31:09Z",
          "errors": [],
          "version": "1.6.2",
          "ipAddress": "fe80:0:0:0:468:a3fe:6479:8ba2",
          "configurations": [
            {
              "assignment": "Manual",
              "name": "base2",
              "id": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ"
            }
          ],
          "cpuAverage5Min": 0.10625,
          "hostname": "ReacherGilt",
          "system": "macOS 14.3.1 (arm64)",
          "logSources": [
            {
              "parser": "syslog",
              "repository": "systemlogs",
              "sourceType": "file",
              "sourceName": "var_log"
            }
          ],
          "machineId": "a0e76cc5-a974-4f6b-8ef0-a164d521d71c",
          "change": null,
          "id": "J7v8VPxQpsisowLiL68F83NvAaBF3wiW",
          "ingestLast24H": 2076167,
          "configId": "K9nrIRwxrmSNwBdvIfQkDh0Vfw0lDpFJ",
          "memoryMax5Min": 541310976,
          "diskMax5Min": 53.68,
          "cfgTestId": null
        }
      ],
      "totalResults": 1
    }
  }
}