Manage Remote Configurations

Remote configuration are configurations which have been created or imported using the Config Editor to be associated with one or more Falcon Log Collector instance using the Enroll command and token.

The Config Overview page provides information on the Falcon Log Collector configuration files you have created for remote centralized use, how they are being used, and details on all the enrolled instances of Falcon Log Collector.

This page also allows you to delete configuration files directly or create and edit files through the Config Editor.

Note

Note that if you want to switch the configuration assigned to an enrolled instance see Extending Remote Configurations.

To access the Config Overview page go the Data ingest tab.
Click Config overview and the page is displayed.

Create a Remote Configuration

You can create a new configuration from this page which can then be assigned to multiple Falcon Log Collector instances and managed centrally.

Go to Config overview and click + New Config.
Figure 22. Config Overview
Type the name for your new configuration and click either:
- Create New - creates a new configuration from scratch
- Create from template and browse for a previously exported or manually created configuration file (.yaml).
  Figure 23. Create New Configuration
The Draft Editor is displayed, configure the file to meet your needs, note that you can only edit the sections: sources, sinks and settings, see Sources & Examples for more information.
The editor helps by underlining misspelled or incorrectly positioned entities (incorrect level) and by auto-completing entities when you are inserting new entities, additionally you can hover-over entities for useful tips and information.
Figure 24. Config Editor
You can perform additional tabs from this page:
- Click the Information tab to change the name of the configuration or add a description.
- Click the Test tab to view the status of the tests related to this configuration.
- Export either the draft configuration or the currently published configuration.
- Import a configuration as a starting point.
Once you have finished making changes in the editor you can:
- Click Save as draft to save the changes without publishing.
- Click Start test to test your configuration file by publishing it to specific instances.
- Click Publish draft to save the changes and publish them to all the instances which are using the configuration.

Edit a Remote Configuration

You can edit remote configuration and if they are assigned to multiple instances the changes will impact all of the instances of the LogScale Collector.

Click the ellipsis menu next to the configuration you want to edit and click Edit config.
Make the required changes, note that you can only edit the sections: sources, sinks and settings, see Sources & Examplesfor details on the file.
Figure 25. Config Editor
You can perform additional tabs from this page:
- Click the Information tab to change the name of the configuration or add a description.
- Click the Edit Falcon Log Collector instances tab to assign instances to a configuration, unenroll an instance or view the details of an assigned instance.
- Click the Test tab to view the status of the tests related to this configuration.
- Export either the draft configuration or the currently published configuration.
- Import a configuration as a starting point.
Once you have finished making changes click either:
- Save as draft to save the changes without publishing.
- Start test to test a draft on a set of instance which you can choose in the next step, see Editing and Publishing a Test Configuration.
- Click Publish to save the changes and publish them to all the instances which are using the configuration.

Export Configuration Template

You can export a configuration as a template which can then be imported and modified as required from the create new pop-up, see Create a Configuration - Fleet.

Go to the Config overview page.
Figure 26. Config Overview
Click the ellipsis menu next to the configuration you want to export and click Export as template, you can also export from the editor page, see Edit a Remote Configuration.
Select the a radio button to export either:
- Published version
- Draft version
Figure 27. Export Pop-up

And click Export as template
Browse for the location to save the file, specify a name for the file and click Save.

Delete a Remote Configuration

You can delete a configuration from the Config overviewpage.

Go to the Config overview page.
Figure 28. Config Overview
Click the ellipsis menu next to the configuration you want to delete and click Delete config.
Important
It is not possible to delete a configuration which is associated to any instances.
Click Delete config to confirm.
Figure 29. Delete Pop-up

Test a Remote Configuration

When you edit a configuration you can test the configuration on one or more instances before publishing the configuration to its assigned instances, this is useful when you want to test the impact of your changes without impacting instances which are collecting data.

Go the Data ingest and select Config overview.
Click on the ellipsis menu next to the configuration you want to change and select Edit config.
You can test any changes which have been saved as draft, to do so click Start test and select the instance to which you want to assign the draft configuration.

To view the status and add instances to the configuration test see Editing and Publishing a Test Configuration.

Manage Configurations

The editor page consists of the following areas:

Editor
- Edit the configuration and test or publish changes, see Figure 6, “Config Editor”.

Information
- change the name of a configuration
- add a description for the configuration
  Figure 30. Information
Test status
- Add/remove instance from the configuration test
- View the status of instances assigned to a test
  Figure 31. Test status

Edit Configuration Settings

This page allows you to edit some details about your configuration, like name and description.

Go to Config overview and click the ellipsis menu next to the required configuration and select Config settings, the Information page is displayed.
Figure 32. Information
Once you have made the required changes on the Information page click Save changes.

Editing and Publishing a Test Configuration

The Test status page allows you to view the status of the instance on which you are testing a draft configuration, add or remove assigned instances and publish the test draft to all the instances assigned to the configuration. You can also see the status of the test configuration, which could be okay or error.

See Test a Remote Configuration for information on how to test a draft.

Go to Config overview and click the ellipsis menu next to the required configuration and select Test and the Test page is displayed.
Figure 33. Test status
You can now:
- Add or Remove instances: Click Assign instance select and deselect instances and click Assign instances to save the changes.
- Remove an instance from the configuration test: Click ellipsis and Remove from test.
- Publish Draft to All Assigned instances: Click Publish tested draft to assign the instances to their previous configurations, where applicable.
- Revert assigned configurations: Click Revert to published config to reassign the instances to which the draft test is currently applied to their previous configurations, where applicable.