Manage Remote Configurations
Remote configuration are configurations which have been created or
imported using the Config Editor
to be
associated with one or more Falcon Log Collector instance using the
Enroll
command and token.
The Config Overview page provides information on the Falcon Log Collector configuration files you have created for remote centralized use, how they are being used, and details on all the enrolled instances of Falcon Log Collector.
This page also allows you to delete configuration files directly or create and edit files through the Config Editor.
Note
Note that if you want to switch the configuration assigned to an enrolled instance see Extending Remote Configurations.
To access the Config Overview page go the Data ingest tab.
Click
and the page is displayed.
Create a Remote Configuration
You can create a new configuration from this page which can then be assigned to multiple Falcon Log Collector instances and managed centrally.
Go to + New Config.
and clickFigure 22. Config Overview
Type the name for your new configuration and click either:
previously exported or manually created configuration file (
and browse for a.yaml
).Figure 23. Create New Configuration
The Draft Editor is displayed, configure the file to meet your needs, note that you can only edit the sections: sources, sinks and settings, see Sources & Examples for more information.
The editor helps by underlining misspelled or incorrectly positioned entities (incorrect level) and by auto-completing entities when you are inserting new entities, additionally you can hover-over entities for useful tips and information.
Figure 24. Config Editor
You can perform additional tabs from this page:
Click the
tab to change the name of the configuration or add a description.Click the
tab to view the status of the tests related to this configuration.Export either the draft configuration or the currently published configuration.
Import a configuration as a starting point.
Once you have finished making changes in the editor you can:
Click
to save the changes without publishing.Click
to test your configuration file by publishing it to specific instances.Click
to save the changes and publish them to all the instances which are using the configuration.
Edit a Remote Configuration
You can edit remote configuration and if they are assigned to multiple instances the changes will impact all of the instances of the LogScale Collector.
Click the ellipsis menu next to the configuration you want to edit and click Edit config.
Make the required changes, note that you can only edit the sections: sources, sinks and settings, see Sources & Examplesfor details on the file.
Figure 25. Config Editor
You can perform additional tabs from this page:
Click the
tab to change the name of the configuration or add a description.Click the
tab to assign instances to a configuration, unenroll an instance or view the details of an assigned instance.Click the
tab to view the status of the tests related to this configuration.Export either the draft configuration or the currently published configuration.
Import a configuration as a starting point.
Once you have finished making changes click either:
- to test a draft on a set of instance which you can choose in the next step, see
Click
to save the changes and publish them to all the instances which are using the configuration.
Export Configuration Template
You can export a configuration as a template which can then be imported and modified as required from the create new pop-up, see Create a Configuration - Fleet.
Go to the Config overview page.
Figure 26. Config Overview
Click the ellipsis menu next to the configuration you want to export and click Export as template, you can also export from the editor page, see Edit a Remote Configuration.
Select the a radio button to export either:
Figure 27. Export Pop-up
And click
Browse for the location to save the file, specify a name for the file and click
.
Delete a Remote Configuration
You can delete a configuration from the Config overviewpage.
Go to the Config overview page.
Figure 28. Config Overview
Click the ellipsis menu next to the configuration you want to delete and click Delete config.
Important
It is not possible to delete a configuration which is associated to any instances.
Click Delete config to confirm.
Figure 29. Delete Pop-up
Test a Remote Configuration
When you edit a configuration you can test the configuration on one or more instances before publishing the configuration to its assigned instances, this is useful when you want to test the impact of your changes without impacting instances which are collecting data.
Go the
and select .Click on the ellipsis menu next to the configuration you want to change and select
.You can test any changes which have been saved as draft, to do so click
and select the instance to which you want to assign the draft configuration.
To view the status and add instances to the configuration test see Editing and Publishing a Test Configuration.
Manage Configurations
The editor page consists of the following areas:
Editor
Edit the configuration and test or publish changes, see Figure 6, “Config Editor”.
Information
change the name of a configuration
add a description for the configuration
Figure 30. Information
Test status
Add/remove instance from the configuration test
View the status of instances assigned to a test
Figure 31. Test status
Edit Configuration Settings
This page allows you to edit the configuration details, like name and description.
Go to
Config overview
and click the ellipsis menu next to the required configuration and select , theInformation
page is displayed.Figure 32. Information
Once you have made the required changes on the
Information
page click .
Editing and Publishing a Test Configuration
The Test status page allows you to view the status of the instance on which you are testing a draft configuration, add or remove assigned instances and publish the test draft to all the instances assigned to the configuration. You can also see the status of the test configuration, which could be okay or error.
See Test a Remote Configuration for information on how to test a draft.
Go to
Config overview
and click the ellipsis menu next to the required configuration and select and theTest
page is displayed.Figure 33. Test status
You can now:
Add or Remove instances: Click select and deselect instances and click to save the changes.
Remove an instance from the configuration test: Click ellipsis and .
Publish Draft to All Assigned instances: Click to assign the instances to their previous configurations, where applicable.
Revert assigned configurations: Click to reassign the instances to which the draft test is currently applied to their previous configurations, where applicable.