Graylog 3.0 filebeat configuration and tags

Graylog Central (peer support)
,
16

I decided to dig in and figure how I will actually migrate to the new sidecar system if I end up going that route, since I rely on tags for configuration.

Using the API browser I noticed a PUT endpoint at /sidecars/configurations, which was encouraging… but the JSON model in the API browser only mentions a nodes object. After digging into the code, it looks like nodes is a way of referencing NodeConfiguration objects, which require node_id (string) and assignments (another array of objects) as values. That assignments object has two strings, configuration_id and collector_id.

You can get both collector_id and configuration_id by calling GET on /sidecars/configurations - add ?name=configname on that request to search for a specific named configuration. Once you have those values, you can build an object to send to /sidecars/configurations endpoint like so:

{
  "nodes": [
    {
      "node_id": "86cc6573-d443-4dc8-b589-4e9f1c6d7968",
      "assignments": [ 
        {
          "configuration_id": "5c716d9216698621505be8ae",
          "collector_id": "5c7066e279728d1cf7c10a9f"
        }
      ]
    }
  ]
}

After sending this to that PUT endpoint, the collector output shows:

time="2019-02-23T16:56:54Z" level=info msg="[filebeat] Configuration change detected, rewriting configuration file."

so it got the updated configuration. Hopefully this is helpful to folks looking to replicate the old behavior!

I think it’s important to mention, though: this change would be easier to handle if there were more complete documentation and examples on how to register a configuration to a sidecar programatically. While I appreciate the flexibility of the new solution and work you’ve done, bringing up SemVer and “this is better” as a response isn’t very empathetic or kind. For those who are using configuration management to deploy configuration out to their machines, it might be easier to deploy and configure filebeat without sidecar now.