Update configurations

You can update a configuration or change its type. Updating a configuration does not automatically deploy the changes to NXLog Agent instances. See Sync agent configuration for instructions on syncing an agent’s configuration.

Prerequisites

Your NXLog Platform organization ID.
An NXLog Platform API Personal Access Token (PAT).

About updating configurations

A PATCH request to the templates endpoint updates an existing configuration. You can execute the request for all or selected configurations by specifying a filter. The following configuration properties can be updated: name, parts, content, tags, and comment.

$ curl --verbose --request PATCH \
       --url "https://agents.example.com/api/{ORG_ID}/api/v1/templates/*/?filter=({QUERY})" \
       --header "Authorization: Bearer {TOKEN}" \
       --header "Content-Type: application/json" \
       --header "Accept: */*" \
       --data '{OBJECT}'

If matching configurations exist, the command returns 200 OK with the following JSON body. Otherwise, it returns an empty JSON array.

[
  {
    "id": "{CONFIG_UUID}",
    "status": "success"
  }
]

Update a configuration by name

This example uses a filter to update a configuration by its name. Configuration names are not unique. Therefore, if there is more than one configuration with the same name, the request updates all of them.

The configuration name is case-sensitive.

PATCH /templates/*/?filter=(name LIKE "Windows log sources")

PATCH /templates/*/?filter=(name LIKE "Windows log sources")
Entity type	`templates`
Entity UUID	`*`
Filter	`(name LIKE "Windows log sources")`
Request body	`{ "tags": ["input", "windows"], "comment": "Last updated by John Smith" }`

Entity type

templates

Entity UUID

*

Filter

(name LIKE "Windows log sources")

Request body

{
  "tags": ["input", "windows"],
  "comment": "Last updated by John Smith"
}

Try it

Execute the following curl command or Python script to update a configuration by its name.

curl

$ curl --verbose --request PATCH \
       --url "https://agents.example.com/api/{ORG_ID}/api/v1/templates/*/?filter=(name+LIKE+%22Windows+log+sources%22)" \(1)
       --header "Authorization: Bearer {TOKEN}" \(2)
       --header "Content-Type: application/json" \
       --header "Accept: */*" \
       --data '{"tags": ["input", "windows"], "comment": "Last updated by John Smith"}'

1	Replace `example.com` with the NXLog Platform domain you specified when installing NXLog Platform and `{ORG_ID}` with your organization ID.
2	Replace `{TOKEN}` with your API token. See Generating a token for instructions.

Python

'''
Requires Python 3.x
'''

import requests
import json

# Set these variables for your environment
api_token = '<API_TOKEN>' (1)
base_url = 'https://agents.<DOMAIN>/api' (2)
org = '<ORG_ID>' (3)
config_name = '<CONFIG_NAME>' (4)

endpoint = 'api/v1/templates'
url = '{}/{}/{}'.format(base_url, org, endpoint)
headers = {
    'Authorization': 'Bearer {}'.format(api_token),
    'Content-Type': 'application/json',
    'Accept': '*/*'
}

query = '*/?filter=(name LIKE "{}")'.format(config_name)
payload = {'tags': ['input', 'windows'], 'comment': 'Last updated by John Smith'}
r = requests.patch('{}/{}'.format(url, query), headers=headers, data=json.dumps(payload))

if r.status_code == 200:
    print('Status: {}'.format(r.status_code))
    print(json.dumps(r.json(), indent=2))
else:
    print('Error: {} {}'.format(r.status_code, r.text))

1	Replace `<API_TOKEN>` with your API token. See Generating a token for instructions.
2	Replace `<DOMAIN>` with the NXLog Platform domain you specified when installing NXLog Platform.
3	Replace `<ORG_ID>` with your organization ID.
4	Replace `<CONFIG_NAME>` with your configuration name.

Example response

Status: 200
[
  {
    "id": "4bddf35e-99f4-11ef-800e-eae9743d8daa",
    "status": "success"
  }
]

Change the configuration type

You can update a configuration to either include other configurations as parts or use a static configuration by specifying the corresponding field. The content and parts fields are mutually exclusive. Therefore, specifying one field in an update request overwrites the other field.

Specifying both the content and parts properties returns 400 Bad Request - Trying to set parts and contents at the same time.

This example changes a configuration consisting of other configurations to static configuration.

PATCH /templates/*/?filter=(name LIKE "Windows events")

PATCH /templates/*/?filter=(name LIKE "Windows events")
Entity type	`templates`
Entity UUID	`*`
Filter	`(name LIKE "Windows events")`
Request body	`{ "content": "<Input windows_events>\nModule im_msvistalog\n</Input>\n" }`