API Stability Deprecated

The updateParser() GraphQL mutation is used to update a parser in LogScale. This is deprecated and will be removed in version 1.183. Continuing to use this mutation field may result in test information on parsers being lost. Use instead updateParserV2().

For more information on parsers, see the Parsing Data documentation page.

Syntax

Below is the syntax for the updateParser() mutation field:

graphql
updateParser(
     input: UpdateParserInput!
   ): UpdateParserMutation!

Below is an example of how this mutation field might be used:

Raw
graphql
mutation {
  updateParser( input:
      { repositoryName: "humio",
        id: "abc123",
        name: "my-parser",
        fieldsToBeRemovedBeforeParsing: [ "#vhost" ]
      }
  )
  { parser { name } }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateParser( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { parser { name } }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateParser( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { parser { name } }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateParser( input: ^
      { repositoryName: \"humio\", ^
        id: \"abc123\", ^
        name: \"my-parser\", ^
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ] ^
      } ^
  ) ^
  { parser { name } } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateParser( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { parser { name } }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  updateParser( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { parser { name } }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateParser( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { parser { name } }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateParser( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { parser { name } }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateParser": {
      "parser": {
        "name": "my-parser"
      }
    }
  }
}

Given Datatypes

UpdateParserInput has several parameters. Below is a list of them along with a description of each:

Table: UpdateParserInput

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 23, 2024
fieldsToBeRemovedBeforeParsing[string]yes DeprecatedA list of fields that will be removed from the event before it's parsed. They won't be included when calculating usage.
idstring  DeprecatedThe unique identifier of the parser to update.
languageVersionLanguageVersionEnum  DeprecatedThe version of the LogScale query language to use. See LanguageVersionEnum.
namestring  DeprecatedThe name to use for the parser.
repositoryNamestring  DeprecatedThe repository where the parser is located.
sourceCodestring  DeprecatedThe parser script that is executed for every incoming event.
tagFields[string]yes DeprecatedAny fields which the parser should convert to tags after an event is parsed.
testData[string]yes DeprecatedTest events that can be parsed by the parser.

Returned Datatypes

The returned datatype UpdateParserMutation has one parameter, and several sub-parameters. Click on the link below to the parameter to see a table with the sub-parameters:

Table: UpdateParserMutation

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Oct 4, 2024
parserParseryes Long-TermThe parser to update See Parser.