Update configuration templates

You can update a configuration template or change its type. Updating a template does not automatically deploy the new configuration to NXLog Agent instances. See Sync agent configuration for instructions on syncing an agent’s configuration.

Prerequisites

Your NXLog Platform organization ID.
An NXLog Platform API Personal Access Token (PAT).

About updating templates

A PATCH request to the templates endpoint updates an existing configuration template. You can execute the request for all or selected templates by specifying a filter. The following template properties can be updated: name, parts, content, tags, and comment.

$ curl --verbose --request PATCH \
       --url "https://agents.example.com/api/{ORG_ID}/api/v1/templates/*/?filter=({QUERY})" \
       --header "Authorization: Bearer {TOKEN}" \
       --header "Content-Type: application/json" \
       --header "Accept: */*" \
       --data '{OBJECT}'

If matching templates exist, the command returns 200 OK with the following JSON body. Otherwise, it returns an empty JSON array.

[
  {
    "id": "{TEMPLATE_UUID}",
    "status": "success"
  }
]

Update a template by name

This example uses a filter to update a configuration template by its name. Template names are not unique. Therefore, if there is more than one template with the same name, the request updates all of them.

The template name is case-sensitive.

PATCH /templates/*/?filter=(name LIKE "Windows log sources")

PATCH /templates/*/?filter=(name LIKE "Windows log sources")
Entity type	`templates`
Entity UUID	`*`
Filter	`(name LIKE "Windows log sources")`
Request body	`{ "tags": ["input", "windows"], "comment": "Last updated by John Smith" }`

Entity type

templates

Entity UUID

*

Filter

(name LIKE "Windows log sources")

Request body

{
  "tags": ["input", "windows"],
  "comment": "Last updated by John Smith"
}

Try it

Execute the following curl command or Python script to update a template by its name.

curl

$ curl --verbose --request PATCH \
       --url "https://agents.example.com/api/{ORG_ID}/api/v1/templates/*/?filter=(name+LIKE+%22Windows+log+sources%22)" \(1)
       --header "Authorization: Bearer {TOKEN}" \(2)
       --header "Content-Type: application/json" \
       --header "Accept: */*" \
       --data '{"tags": ["input", "windows"], "comment": "Last updated by John Smith"}'

1	Replace `example.com` with the NXLog Platform domain you specified when installing NXLog Platform and `{ORG_ID}` with your organization ID.
2	Replace `{TOKEN}` with your API token. See Generating a token for instructions.

Python

'''
Requires Python 3.x
'''

import requests
import json

# Set these variables for your environment
api_token = '<API_TOKEN>' (1)
base_url = 'https://agents.<DOMAIN>/api' (2)
org = '<ORG_ID>' (3)
template_name = '<TEMPLATE_NAME>' (4)

endpoint = 'api/v1/templates'
url = '{}/{}/{}'.format(base_url, org, endpoint)
headers = {
    'Authorization': 'Bearer {}'.format(api_token),
    'Content-Type': 'application/json',
    'Accept': '*/*'
}

query = '*/?filter=(name LIKE "{}")'.format(template_name)
payload = {'tags': ['input', 'windows'], 'comment': 'Last updated by John Smith'}
r = requests.patch('{}/{}'.format(url, query), headers=headers, data=json.dumps(payload))

if r.status_code == 200:
    print('Status: {}'.format(r.status_code))
    print(json.dumps(r.json(), indent=2))
else:
    print('Error: {} {}'.format(r.status_code, r.text))

1	Replace `<API_TOKEN>` with your API token. See Generating a token for instructions.
2	Replace `<DOMAIN>` with the NXLog Platform domain you specified when installing NXLog Platform.
3	Replace `<ORG_ID>` with your organization ID.
4	Replace `<TEMPLATE_NAME>` with your configuration template name.

Example response

Status: 200
[
  {
    "id": "4bddf35e-99f4-11ef-800e-eae9743d8daa",
    "status": "success"
  }
]

Change the template type

You can update a template to either include other templates as parts or use a static configuration by specifying the corresponding field. The content and parts fields are mutually exclusive. Therefore, specifying one field in an update request overwrites the other field.

Specifying both the content and parts properties returns 400 Bad Request - Trying to set parts and contents at the same time.

This example changes a template consisting of other templates to static configuration.

PATCH /templates/*/?filter=(name LIKE "Windows events")

PATCH /templates/*/?filter=(name LIKE "Windows events")
Entity type	`templates`
Entity UUID	`*`
Filter	`(name LIKE "Windows events")`
Request body	`{ "content": "<Input windows_events>\nModule im_msvistalog\n</Input>\n" }`