Skip to main content

Hey - is there a way to use the API to PATCH a lookup table in a pack?

https://cribl-community.slack.com/archives/CPYBPK65V/p1648786066591059?thread_ts=1648660529.515899&channel=CPYBPK65V&message_ts=1648786066.591059

Update the endpoint using the example here: https://docs.cribl.io/stream/packs/#export-via-api|https://docs.cribl.io/stream/packs/#export-via-api

/api/v1/m/<group>/packs/<pack_id>/system/lookups/…

Disclaimer: haven’t tested fully


ok gotcha, Yea saw how to do the patch on the WG lookup table.

Do you know if I patch it, is it expecting a replacement file? (or does it append or merge?)


Replacement file is the easiest

https://docs.cribl.io/stream/api-tutorials/#lookup%7Chttps://docs.cribl.io/stream/api-tutorials/%23lookup


ok that's what I figured

So, on the leader, when I do the PUT then POST of the lookup table, according to the docs it should get pushed over to the workers, but even after committing, I am not seeing the lookup table show up anywhere in the UI


question, and after the deploy command, are you able to see the UI with the new file?

In my test I used: Put -> Patch -> commit -> deploy

I did not try Put -> Post


I need to commit and deploy (and post it to the group) it seems

Ever see this when trying to do a selective commit: b'{"status":"error","message":"git.commit: requires the commit message to be supplied as a string/stringg]"}'

more info:

{
"time": "2023-02-13T18:51:22.560Z", "cid": "api", "channel": "rest:git", "level": "error", "message": "API Error", "error": { "message": "git.commit: requires the commit message to be supplied as a string/stringg]", "stack": "Error: git.commit: requires the commit message to be supplied as a string/stringg]\n at Object.parser (/opt/cribl/bin/cribl.js:14:15503639)\n at sn.<anonymous> (/opt/cribl/bin/cribl.js:14:15512684)\n at Generator.next (<anonymous>)\n at /opt/cribl/bin/cribl.js:14:15496323\n at new Promise (<anonymous>)\n at T (/opt/cribl/bin/cribl.js:14:15496135)\n at sn.attemptEmptyTask (/opt/cribl/bin/cribl.js:14:15512585)\n at sn.<anonymous> (/opt/cribl/bin/cribl.js:14:15511896)\n at Generator.next (<anonymous>)\n at a (/opt/cribl/bin/cribl.js:14:15496173)" }, "url": "/version/commit"}

It looks like a format thing .. extra spaces / string?
The one I used

curl -X POST "http://192.168.56.254:9000/api/v1/version/commit"-H "accept: application/json" -H "Authorization: Bearer long_bearer_token_goes_here"-H "Content-Type: application/json"-d '{"message":"automation@cribl:commit","group":"default","files":["groups/default/data/lookups/host_destination.csv","groups/default/data/lookups/host_destination.yml"]}'

are you sure it's supposed to be -H "Content-Type: application/json"


at least on my test that worked


thanks that worked

this should get updated to be explicit application/json: https://docs.cribl.io/stream/version-control/#api-selective-example


the updated version:

curl -X POST -H "Authorization: Bearer token" -H "Content-Type: application/json" "https://logstream:9000/api/v1/version/commit" -d '{"message":"automation@cribl: commit","group":"default","files":["groups/default/data/samples/sample-g0aT.json","groups/default/local/cribl/samples.yml"]}'

I think we also had a ticket open already to rename the LogStream references...


This curl example is mixed up https://docs.cribl.io/stream/version-control/#api-deploy-example


We'll see if we can get these fixed up.


DOC-299 for tracking.


Reply