mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 08:58:41 +00:00
Add fleetctl convert to fleetctl file format docs (#2201)
This commit is contained in:
parent
f6223ca0e4
commit
53256917a3
1 changed files with 28 additions and 0 deletions
|
|
@ -25,6 +25,34 @@ All of these files can be concatenated together into [one file](../../examples/c
|
|||
`-- queries.yml
|
||||
```
|
||||
|
||||
## Convert Osquery JSON
|
||||
|
||||
`fleetctl` includes easy tooling to convert osquery pack JSON into the
|
||||
`fleetctl` format. Use `fleetctl convert` with a path to the pack file:
|
||||
|
||||
```
|
||||
$ fleetctl convert -f test.json
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: pack
|
||||
spec:
|
||||
name: test
|
||||
queries:
|
||||
- description: "this is a test query"
|
||||
interval: 10
|
||||
name: processes
|
||||
query: processes
|
||||
removed: false
|
||||
targets:
|
||||
labels: null
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
spec:
|
||||
name: processes
|
||||
query: select * from processes
|
||||
```
|
||||
|
||||
## Osquery Queries
|
||||
|
||||
For especially long or complex queries, you may want to define one query in one file. Continued edits and applications to this file will update the query as long as the `metadata.name` does not change. If you want to change the name of a query, you must first create a new query with the new name and then delete the query with the old name. Make sure the old query name is not defined in any packs before deleting it or an error will occur.
|
||||
|
|
|
|||
Loading…
Reference in a new issue