Skip to main content
Solved

Is there a way to use the API to `PATCH` a lookup table in a pack?

  • March 11, 2025
  • 15 replies
  • 58 views

Hey - is there a way to use the API to PATCH a lookup table in a pack?

Best answer by Raanan Dagan

It looks like a format thing .. extra spaces / string?
The one I used

curl -X POST "http://192.168.56.254:9000/api/v1/version/commit"-H "accept: application/json" -H "Authorization: Bearer long_bearer_token_goes_here"-H "Content-Type: application/json"-d '{"message":"automation@cribl:commit","group":"default","files":["groups/default/data/lookups/host_destination.csv","groups/default/data/lookups/host_destination.yml"]}'

15 replies


  • Author
  • Known Participant
  • March 11, 2025

ok gotcha, Yea saw how to do the patch on the WG lookup table.

Do you know if I patch it, is it expecting a replacement file? (or does it append or merge?)


Raanan Dagan

  • Author
  • Known Participant
  • March 11, 2025

ok that's what I figured

So, on the leader, when I do the PUT then POST of the lookup table, according to the docs it should get pushed over to the workers, but even after committing, I am not seeing the lookup table show up anywhere in the UI


Raanan Dagan

question, and after the deploy command, are you able to see the UI with the new file?

In my test I used: Put -> Patch -> commit -> deploy

I did not try Put -> Post


  • Author
  • Known Participant
  • March 11, 2025

I need to commit and deploy (and post it to the group) it seems

Ever see this when trying to do a selective commit: b'{"status":"error","message":"git.commit: requires the commit message to be supplied as a string/string[]"}'

more info:

{
"time": "2023-02-13T18:51:22.560Z", "cid": "api", "channel": "rest:git", "level": "error", "message": "API Error", "error": { "message": "git.commit: requires the commit message to be supplied as a string/string[]", "stack": "Error: git.commit: requires the commit message to be supplied as a string/string[]\n at Object.parser (/opt/cribl/bin/cribl.js:14:15503639)\n at sn.<anonymous> (/opt/cribl/bin/cribl.js:14:15512684)\n at Generator.next (<anonymous>)\n at /opt/cribl/bin/cribl.js:14:15496323\n at new Promise (<anonymous>)\n at T (/opt/cribl/bin/cribl.js:14:15496135)\n at sn.attemptEmptyTask (/opt/cribl/bin/cribl.js:14:15512585)\n at sn.<anonymous> (/opt/cribl/bin/cribl.js:14:15511896)\n at Generator.next (<anonymous>)\n at a (/opt/cribl/bin/cribl.js:14:15496173)" }, "url": "/version/commit"}

Raanan Dagan
  • Employee
  • Answer
  • March 11, 2025

It looks like a format thing .. extra spaces / string?
The one I used

curl -X POST "http://192.168.56.254:9000/api/v1/version/commit"-H "accept: application/json" -H "Authorization: Bearer long_bearer_token_goes_here"-H "Content-Type: application/json"-d '{"message":"automation@cribl:commit","group":"default","files":["groups/default/data/lookups/host_destination.csv","groups/default/data/lookups/host_destination.yml"]}'

  • Author
  • Known Participant
  • March 11, 2025

are you sure it's supposed to be -H "Content-Type: application/json"


Raanan Dagan

at least on my test that worked


  • Author
  • Known Participant
  • March 11, 2025

thanks that worked

this should get updated to be explicit application/json: https://docs.cribl.io/stream/version-control/#api-selective-example


  • Author
  • Known Participant
  • March 11, 2025

the updated version:

curl -X POST -H "Authorization: Bearer token" -H "Content-Type: application/json" "https://logstream:9000/api/v1/version/commit" -d '{"message":"automation@cribl: commit","group":"default","files":["groups/default/data/samples/sample-g0aT.json","groups/default/local/cribl/samples.yml"]}'

I think we also had a ticket open already to rename the LogStream references...


  • Author
  • Known Participant
  • March 11, 2025

We'll see if we can get these fixed up.


  • New Participant
  • March 11, 2025

DOC-299 for tracking.