Syncing config between clusters

[HywelBurris]

Hi,

To the best of my knowledge, the architecture for multi-site high availability is isolated worker clusters on each site. We have several clusters of forwarders on each site sending forwarding logs to these worker clusters. Global load balancers will check the health of each cluster and only forward to the local site, unless of course that site would fail and then forward to the opposite site.

When using the LI agents this becomes complicated, we will have 5 different clusters of forwarders on each site (two sites). In most scenarios the agent config will be the same across all agents and environments. Is there anyway to sync from a "master" agent config across all forwarders, and indeed, the worker clusters.

Any help or experience would be appreciated.

[MichaelRyom · Accepted solution]

Sync feature no.

But there is an API, which I believe will help in your situation.

Here is some literature to begin with:

Log Insight API calls Appendix

https://michaelryom.dk/log-insight-api-calls-appendix/?doing_wp_cron=1476133899.16355204582214355468...

Log Insight 3.3: Query API

http://sflanders.net/2016/04/20/log-insight-3-3-query-api/

Log Insight 3.3: Authentication API

http://sflanders.net/2016/04/11/log-insight-3-3-authentication-api/

First of I think this is the url you are looking for. Has both post and get options. As per Log Insight API calls Appendix.

https://loginsight.com/api/v1/agent/groups

The authentication part is to first pass username and password to /api/v1/sessions to get a session id and from there use the session id to get the data needed. As the API also has a post option for agent/groups I think it could be handled that way as well.

$Auth = Invoke-WebRequest -Uri https://$LIURL/api/v1/sessions -Method Post -Headers @{"Content-Type"="application/json"} -Body '{"provider":"ActiveDirectory", "username":"admin", "password":"password"}'
$data = Invoke-WebRequest -Uri https://$LIURL/api/v1/events -Method Get -Headers @{"X-LI-Session-Id"=($Auth.Content.Split(":|,")[3])}

This is from some powershell code but I hope it help with the understanding.How to use the API and get what you want.

[HywelBurris]

Thank you will investigate.