API Stability Long-Term

The updateParserV2() GraphQL mutation may be used to update a parser. Only the provided fields are updated on the parser. The fields that aren't provided are unchanged.

For more information on parsers, see the Parsing Data documentation page.

Syntax

Below is the syntax for the updateParserV2() mutation field:

graphql
updateParserV2(
     input: UpdateParserInputV2!
   ): Parser!

Below is an example of how this mutation field might be used:

Raw
graphql
mutation {
  updateParserV2( input:
      { repositoryName: "humio",
        id: "abc123",
        name: "my-parser",
        fieldsToBeRemovedBeforeParsing: [ "#vhost" ]
      }
  )
  { name }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateParserV2( input: ^
      { repositoryName: \"humio\", ^
        id: \"abc123\", ^
        name: \"my-parser\", ^
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ] ^
      } ^
  ) ^
  { name } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $json = '{"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}';
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateParserV2( input:
      { repositoryName: \"humio\",
        id: \"abc123\",
        name: \"my-parser\",
        fieldsToBeRemovedBeforeParsing: [ \"#vhost\" ]
      }
  )
  { name }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL/graphql',
  path: '/graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateParserV2": {
      "name": "my-parser"
    }
  }
}

Given Datatypes

For UpdateParserInputV2, there are several parameters. Below is a list of them along with a description of each:

Table: UpdateParserInputV2

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Sep 23, 2024
fieldsToBeRemovedBeforeParsing[string]yes Long-TermA list of fields that will be removed from the event before it's parsed. They won't be included when calculating usage.
fieldsToTag[string]yes Long-TermThe fields that are used as tags.
idstringyes Long-TermThe unique identifier of the parser to update.
namestring  Long-TermThe name to use for the parser.
repositoryNameRepoOrViewNameyes Long-TermThe repository where the parser is located. RepoOrViewName is a scalar.
scriptUpdateParserScriptInput  Long-TermInput for updating the parser script. See UpdateParserScriptInput.
testCases[ParserTestCaseInput]yes Long-TermTest cases that can be used to help verify that the parser works as expected. See ParserTestCaseInput.

Returned Datatypes

The returned datatype Parser has several parameters. Below is a list of them along with a description of each:

Table: Parser

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Mar 26, 2025
assetTypeAssetTypeyes Long-TermThe type of asset. See AssetType. This is deprecated and will be removed in LogScale 1.142.
descriptionstring  Long-TermA description of the parser.
displayNamestringyes Long-TermThe full name of the parser, including package information if part of an application.
fieldsToBeRemovedBeforeParsing[string]yes Long-TermA list of fields that will be removed from the event before it's parsed. These fields will not be included when calculating usage.
fieldsToTag[string]yes Long-TermThe fields that are used as tags.
idstringyes Long-TermThe unique identifier of the parser.
isBuiltInbooleanyes Long-TermTrue if the parser is one of LogScale's built-in parsers.
languageVersionLanguageVersionyes Long-TermThe language version used by the parser. See LanguageVersion.
namestringyes Long-TermThe name of the parser.
scriptstringyes Long-TermThe parser script that is executed for every incoming event.
sourceCodestringyes Long-TermThe source code of the parser. This is deprecated and will be replaced with script starting in version 1.142.
tagFields[string]yes Long-TermThe fields to use as tags. This is deprecated and will be replaced with fieldsToTag starting in version 1.142.
testCases[ParserTestCase]yes Long-TermTest cases that can be used to help verify that the parser works as expected. See ParserTestCase.
testData[string]yes Long-TermSaved test data (e.g., log lines) that you can use to test the parser. This is deprecated and will be replaced with testCases starting with version 1.142.
packagePackageInstallation  Long-TermThe package associated with the parser, if any. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-TermThe identifier of the package used, if one. VersionedPackageSpecifier is a scalar.
yamlTemplateYAMLyes Long-TermA template that can be used to recreate the parser.