Full (full)

In full mode, the Falcon LogScale Collector participates fully in fleet management, and receives the configuration of sources and sinks centrally. In this mode, it's not possible to use the sources, sinks or settings fields in the local configuration file.

This mode is the default when using the enroll command without additional options. The enroll command writes the following snippet in the local configuration: 

fleetManagement:
  mode: full
  url: https://<logscale-cluster>

As of LogScale Collector 1.7.0, it's possible to enter an enrollment token in the configuration file. The LogScale Collector automatically uses this enrollment token to enroll in fleet management, if it isn't enrolled upon start-up. Using this feature along with mode localConfig is a direct replacement of the legacy fleet overview mode. This feature is useful when deploying the LogScale Collector automatically through a host management platform. Auto enrollment also allows specifying a timeout (ephemeral timeout), where if the LogScale Collector is offline for longer, it will be removed from fleet management. Example of using auto enrollment: 

fleetManagement:
  mode: full # or localConfig
  url: https://<logscale-cluster>
  autoEnrollment:
    enrollmentToken: eyJpWxsVG9rZW4iOiJ... # copy the enrollment token from the enroll command
    # ephemeralTimeoutHours: 3 # uncomment to automatically remove the Falcon LogScale Collector after being offline for i.e. 3 hours
ParameterTypeRequiredDefault ValueDescription
autoEnrollmentautoenrollmentoptional[a]   Specify an enrollment token to be used for autoenrollment.
labelsarray:labeloptional[a] [] Specifies the labels to associate with the Fleet Management configuration. Default value is an empty list [].
modefullrequired   In full mode, the LogScale Collector participates fully in fleet management, and receives the configuration of sources and sinks centrally. The enroll command writes the following snippet in the local configuration: 
fleetManagement: mode: full url: https://<logscale-cluster>
proxyproxyoptional[a] auto Controls which HTTP proxy is used to communicate with LogScale in the fleet management protocol. Use one of the configuration options or specify a proxy URL: enter a URL such as http://user:pass@proxyaddress to use a proxy.
tlstlsoptional[a] {} This object contains details on the PEM certificates. this section allows you to override the defaults. Only one of the options should be specified.
urlstringrequired   URL of the LogScale installation where the fleet management page is hosted.

[a] Optional parameters use their default value unless explicitly set.

AutoEnrollment

Table: AutoEnrollment

ParameterTypeRequiredDefault ValueDescription
enrollmentTokenstringrequired   The LogScale Collector automatically uses this enrollment token to enroll in fleet management, if it isn't enrolled upon start-up. Using this feature along with mode localConfig is a direct replacement of the legacy fleet overview mode.
ephemeralTimeoutHoursintegeroptional[a]   Automatically remove the LogScale Collector from fleet managment after being offline for an amount of hours.

[a] Optional parameters use their default value unless explicitly set.


TLS

ParameterTypeRequiredDefault ValueDescription
caCertstringoptional[a]   Use this key to specify a PEM certificate in the config file.
caFilestringoptional[a]   Specify this key to load the PEM certificate from an external file.
insecurebooleanoptional[a] false Set to true to skip certificate validation.

[a] Optional parameters use their default value unless explicitly set.