use API to update tags on node

Hi Madison! I saw this on the community channel and figured I can give you another way to do it (without having to use the API).

If it is easier to do it through the system level instead of api, you can follow these steps:(at least for Linux but Window’s shouldn’t be much of a problem either)

1. Create a bash script - I named mine change_fleet.sh. You of course can name it whatever you’d like.
2. In it - set the script to do the following:

   1. #!/bin/bash
      
      YAML_FILE="/opt/cribl/local/_system/instance.yml"
      KEY_NAME="group"
      NEW_VALUE="Your_Fleet_Name"
      
      sed -i "s/$KEY_NAME: .*/$KEY_NAME: $NEW_VALUE/" "$YAML_FILE"

3. Save it and of course run it on the system(s) you want to change the group of the Edge nodes (also will work with Stream).
4. Restart Cribl service (systemctl restart cribl-edge.service)
5. Check the UI and the Edge node should be in the new fleet.

Keep in mind a few things:

1. I have the default Cribl directory for Linux in there (/opt/cribl). You just want to change it to what you have set. Could even use the $CRIBL_HOME environment variable if running as the cribl user (such as $CRIBL_HOME/local/_system/instance.yml).
2. I ran it on one system and it worked changing the fleet. Test slowly and ramp up as you see fit.

Please let me know if you have any questions (this of course is not Cribl documented and not something that is sponsored by Cribl. This is just me doing some testing in my lab environment and figured I would give you possibly another avenue to attack this problem). 

I do want to edit: the config version is not updated when doing this path and will need to do some more things to make it work.

Thank you ​@dbizon539. That is definitely the approach we will be taking if the API doesn’t work out.

We were hoping that we could utilize the native cribl access since it theoretically represents a cleaner approach than trying to use another tool to make new connections to every machine for this purpose. Since we can teleport into nodes and change tags that way I was hoping the API would be an option too.

However, thank you for that code, it will make this alternative process easier for us.

Makes sense. I will continue to try with my own environment to see if there is a simple way with API over doing that with the script. 

​@Madison Haynes  I was able to do a quick Patch to change the tag of an Edge node. It went pretty smoothly - just would need to do what you did with Python instead of using Bash (always seems to be my preferred method).

Anything not listed in the API documents is “use at your own discretion” but that is what open internet is good for. You can open DevTools and change the tag in the UI and click Save and get the cURL commands (or anything for that matter) from right clicking “distributed” as well as “restart” that should follow it in the list.

Those will give you the two commands needed to run (and the restart is needed so it loads the new configuration of tags).

From there its just iterating through all of the GUID’s and placing it in the URL (since it requires the guid). 

dude thank you! Is this in a cloud or on prem environment? I will try it now. Good thing is that Python is my preferred route as well and what I have built so far for this attempt.

I did it from the cloud organization - but should still work locally as well.

Sadly there is no option to “Copy as Python” when you right click one of the items in devtools. Should be simple enough to go from cURL/cmd to python though (and might end up doing something like that as well).