Skip to main content
Solved

Is there a way to use the API to `PATCH` a lookup table in a pack?

  • March 11, 2025
  • 15 replies
  • 19 views

Hey - is there a way to use the API to PATCH a lookup table in a pack?

Best answer by Raanan Dagan

It looks like a format thing .. extra spaces / string?
The one I used

curl -X POST "http://192.168.56.254:9000/api/v1/version/commit"-H "accept: application/json" -H "Authorization: Bearer long_bearer_token_goes_here"-H "Content-Type: application/json"-d '{"message":"automation@cribl:commit","group":"default","files":["groups/default/data/lookups/host_destination.csv","groups/default/data/lookups/host_destination.yml"]}'

15 replies


  • Author
  • Known Participant
  • March 11, 2025

ok gotcha, Yea saw how to do the patch on the WG lookup table.

Do you know if I patch it, is it expecting a replacement file? (or does it append or merge?)


Raanan Dagan
  • Employee
  • March 11, 2025

  • Author
  • Known Participant
  • March 11, 2025

ok that's what I figured

So, on the leader, when I do the PUT then POST of the lookup table, according to the docs it should get pushed over to the workers, but even after committing, I am not seeing the lookup table show up anywhere in the UI


Raanan Dagan
  • Employee
  • March 11, 2025

question, and after the deploy command, are you able to see the UI with the new file?

In my test I used: Put -> Patch -> commit -> deploy

I did not try Put -> Post


  • Author
  • Known Participant
  • March 11, 2025

I need to commit and deploy (and post it to the group) it seems

Ever see this when trying to do a selective commit: b'{"status":"error","message":"git.commit: requires the commit message to be supplied as a string/string[]"}'

more info:

{
"time": "2023-02-13T18:51:22.560Z", "cid": "api", "channel": "rest:git", "level": "error", "message": "API Error", "error": { "message": "git.commit: requires the commit message to be supplied as a string/string[]", "stack": "Error: git.commit: requires the commit message to be supplied as a string/string[]\n at Object.parser (/opt/cribl/bin/cribl.js:14:15503639)\n at sn.<anonymous> (/opt/cribl/bin/cribl.js:14:15512684)\n at Generator.next (<anonymous>)\n at /opt/cribl/bin/cribl.js:14:15496323\n at new Promise (<anonymous>)\n at T (/opt/cribl/bin/cribl.js:14:15496135)\n at sn.attemptEmptyTask (/opt/cribl/bin/cribl.js:14:15512585)\n at sn.<anonymous> (/opt/cribl/bin/cribl.js:14:15511896)\n at Generator.next (<anonymous>)\n at a (/opt/cribl/bin/cribl.js:14:15496173)" }, "url": "/version/commit"}

Raanan Dagan
  • Employee
  • Answer
  • March 11, 2025

It looks like a format thing .. extra spaces / string?
The one I used

curl -X POST "http://192.168.56.254:9000/api/v1/version/commit"-H "accept: application/json" -H "Authorization: Bearer long_bearer_token_goes_here"-H "Content-Type: application/json"-d '{"message":"automation@cribl:commit","group":"default","files":["groups/default/data/lookups/host_destination.csv","groups/default/data/lookups/host_destination.yml"]}'

  • Author
  • Known Participant
  • March 11, 2025

are you sure it's supposed to be -H "Content-Type: application/json"


Raanan Dagan
  • Employee
  • March 11, 2025

at least on my test that worked


  • Author
  • Known Participant
  • March 11, 2025

thanks that worked

this should get updated to be explicit application/json: https://docs.cribl.io/stream/version-control/#api-selective-example


  • Author
  • Known Participant
  • March 11, 2025

the updated version:

curl -X POST -H "Authorization: Bearer token" -H "Content-Type: application/json" "https://logstream:9000/api/v1/version/commit" -d '{"message":"automation@cribl: commit","group":"default","files":["groups/default/data/samples/sample-g0aT.json","groups/default/local/cribl/samples.yml"]}'

I think we also had a ticket open already to rename the LogStream references...


  • Author
  • Known Participant
  • March 11, 2025

We'll see if we can get these fixed up.


  • New Participant
  • March 11, 2025

DOC-299 for tracking.