Is there a way to use the API to `PATCH` a lookup table in a pack?

JP Bourget

Hey - is there a way to use the API to PATCH a lookup table in a pack?

Raanan Dagan

It looks like a format thing .. extra spaces / string?
The one I used

curl -X POST "http://192.168.56.254:9000/api/v1/version/commit"
-H "accept: application/json" -H "Authorization: Bearer long_bearer_token_goes_here"
-H "Content-Type: application/json"
-d '{"message":"automation@cribl:commit","group":"default","files":["groups/default/data/lookups/host_destination.csv","groups/default/data/lookups/host_destination.yml"]}'

Brendan Dalpe

https://cribl-community.slack.com/archives/CPYBPK65V/p1648786066591059?thread_ts=1648660529.515899&channel=CPYBPK65V&message_ts=1648786066.591059

Update the endpoint using the example here: https://docs.cribl.io/stream/packs/#export-via-api|https://docs.cribl.io/stream/packs/#export-via-api

/api/v1/m/<group>/packs/<pack_id>/system/lookups/…

Disclaimer: haven’t tested fully

JP Bourget

ok gotcha, Yea saw how to do the patch on the WG lookup table.

Do you know if I patch it, is it expecting a replacement file? (or does it append or merge?)

Raanan Dagan

Replacement file is the easiest

https://docs.cribl.io/stream/api-tutorials/#lookup%7Chttps://docs.cribl.io/stream/api-tutorials/%23lookup

JP Bourget

ok that's what I figured

So, on the leader, when I do the PUT then POST of the lookup table, according to the docs it should get pushed over to the workers, but even after committing, I am not seeing the lookup table show up anywhere in the UI

Raanan Dagan

question, and after the deploy command, are you able to see the UI with the new file?

In my test I used: Put -> Patch -> commit -> deploy

I did not try Put -> Post

JP Bourget

I need to commit and deploy (and post it to the group) it seems

Ever see this when trying to do a selective commit: b'{"status":"error","message":"git.commit: requires the commit message to be supplied as a string/string[]"}'

more info:

{

 "time": "2023-02-13T18:51:22.560Z",
 "cid": "api",
 "channel": "rest:git",
 "level": "error",
 "message": "API Error",
 "error": {
  "message": "git.commit: requires the commit message to be supplied as a string/string[]",
  "stack": "Error: git.commit: requires the commit message to be supplied as a string/string[]\n    at Object.parser (/opt/cribl/bin/cribl.js:14:15503639)\n    at sn.<anonymous> (/opt/cribl/bin/cribl.js:14:15512684)\n    at Generator.next (<anonymous>)\n    at /opt/cribl/bin/cribl.js:14:15496323\n    at new Promise (<anonymous>)\n    at T (/opt/cribl/bin/cribl.js:14:15496135)\n    at sn.attemptEmptyTask (/opt/cribl/bin/cribl.js:14:15512585)\n    at sn.<anonymous> (/opt/cribl/bin/cribl.js:14:15511896)\n    at Generator.next (<anonymous>)\n    at a (/opt/cribl/bin/cribl.js:14:15496173)"
  },
 "url": "/version/commit"
}

Raanan Dagan

It looks like a format thing .. extra spaces / string?
The one I used

curl -X POST "http://192.168.56.254:9000/api/v1/version/commit"
-H "accept: application/json" -H "Authorization: Bearer long_bearer_token_goes_here"
-H "Content-Type: application/json"
-d '{"message":"automation@cribl:commit","group":"default","files":["groups/default/data/lookups/host_destination.csv","groups/default/data/lookups/host_destination.yml"]}'

JP Bourget

are you sure it's supposed to be -H "Content-Type: application/json"

Raanan Dagan

at least on my test that worked

JP Bourget

thanks that worked

this should get updated to be explicit application/json: https://docs.cribl.io/stream/version-control/#api-selective-example

JP Bourget

the updated version:

curl -X POST -H "Authorization: Bearer token" -H "Content-Type: application/json" "https://logstream:9000/api/v1/version/commit" -d '{"message":"automation@cribl: commit","group":"default","files":["groups/default/data/samples/sample-g0aT.json","groups/default/local/cribl/samples.yml"]}'

Brendan Dalpe

I think we also had a ticket open already to rename the LogStream references...

JP Bourget

This curl example is mixed up https://docs.cribl.io/stream/version-control/#api-deploy-example

Brendan Dalpe

We'll see if we can get these fixed up.

Eric Fontenot

DOC-299 for tracking.