Create a Configuration - Remote

These steps explain how to configure the Falcon LogScale Collector for remote management using the Config overview page to ship data to LogScale. See Fleet and Group Management for information on remote configuration.

When you create a Config file you can either aim to create a complete configuration or snippets which can then be combined when you Create a Group.

  1. Click the Data ingest tab, then select Config overview on the left side:

    Data Ingest

    Figure 4. Data Ingest


  2. On the Config overview page, click + New Config to open the New config dialog:

    New Config

    Figure 5. New Config


  3. Type the name for your new configuration and click either:

    • Empty config - to create a new, empty configuration that you can manually configure.

    • From template - to browse and find an existing template (.yaml) file that was previously exported, or manually created.

  4. The Config Editor is displayed which allows you to make change to your configuration file.

    Config Editor

    Figure 6. Config Editor


  5. Edit the file and specify the fields, using this method you can only edit the sections: sources, sinks and settings, described in Configuration Examples.

    Additionally try out data ingestion using the Minimal Configuration Example.

    When creating configurations keep in mind that using Manage Groups to manage your instances you may want to create reusable configuration snippets which will later be combined, see Combine Configuration Snippets .

    The editor helps by underlining incorrectly positioned (incorrect level) or misspelled entities and by auto-completing entities when you are inserting new entities, additionally you can hover-over entities for useful tips and information.

  6. Optionally, click the settings cog to view the Basic Settings to manage additional settings, like description and name, or to assign instances to the configuration or manage a test draft, see Manage Configurations for more information.

  7. You can now:

    • Click Save as draft to save the changes without publishing.

    • Click Start test to test a draft on a set of instance which you can select in the next step, see Editing and Publishing a Test Configuration

    • Click Publish config to save the changes and publish them to all the instances which are assigned to this configuration.