Config Packs

Overview

You can use this document to learn how to import a config pack to an existing agent configuration. 

At a high level, config packs are predefined configurations that you can quickly add to your agent configuration.

• In other words, you can use a config pack to import pre-populated infrastructure and cloud services directly into an agent configuration.

After you update the agent configuration, the config packs will automatically populate corresponding Edge Delta components to monitor data. Afterwards, you will be able to analyze the incoming data. 

At a high level, to import a config pack, you must:

• Create an input or reference an existing input
• Create an agent configuration
• Add the config pack's import statement into the new agent configuration

Review Available Config Packs

Note

Based on market popularity and customer feedback, Edge Delta will regularly publish new config packs with different functionalities. 

Currently, Edge Delta supports the following config pack types:

Import the AWS Application Load Balance (ALB) Config Pack 

Step 1: Create an S3 Input

You must create an S3 SQS input to publish S3 events to AWS SQS. Specifically, this input should sync with your AWS ALB access logs output.

• To learn how to enable access logs for your load balancer, review this document from Amazon.
• To learn how to create an S3 input, see Review Parameters for AWS S3 (S3 via SQS input).
  • If you already have an S3 input, then see Step 2: Obtain Input, Integration, and AWS Information.

Step 2: Obtain Input and Integration Information 

When you import the config pack into an agent configuration, you will need to update the config pack with the following information: 

• Information about the S3 SQS input: 
  • labels (name of the input)
  • sqs_url
  • access_key_id
  • access_secret
  • region
• The name of the integration / output to stream the analytical data 

To obtain information about the S3 SQS input: 

1. In the Edge Delta App, on the left-side navigation, click Data Pipeline, and then click Agent Settings. 
2. If you know the specific agent configuration that contains the desired S3 SQS input, then under Actions, click the vertical ellipses, and then click Edit.
   • If you do not know the specific agent configuration that contains the desired S3 input, then you will need to perform this step for each agent configuration. 
3. In the YAML file, perform a search for input_labels, locate the desired input, and then copy the value for input_labels.
   • This value represents the name of the input.
4. In the YAML file, perform a search with the copied value to locate the parameters for the input. 
   • Locate and copy the following information: 
     • sqs_url
     • access_key_id
     • access_secret
     • region

To obtain the name of the integration:

1. In the Edge Delta App, on the left-side navigation, click Data Pipeline, and then click Integrations.
2. Under Existing Integrations, locate the desired integration, and then copy the name of the integration. 

(Optional) Step 3: Access AWS to Update Notification Preferences

When you stream AWS ALB access logs to a specified S3 bucket, the access logs files will be published to the S3 bucket every 5 minutes. 

However, as an optional step, you can update your S3 bucket to send a notification for every new log file to the configured Amazon Simple Queue Service (SQS).

To learn how to configure your S3 bucket to send notifications to the Amazon SQS queue, please review this document from Amazon.

Step 4: Create and Import an Agent Configuration 

1. In the Edge Delta App, on the left-side navigation, click Data Pipeline, and then click Agent Settings. 
2. Click Create Configuration. 
3. Click YAML.
4. Paste the following text into the YAML file:

   version: v2
   agent_settings:
     tag: aws-alb-test
     
   imports:
     - name: "aws-lb"
       pack_id: "edgedelta/aws-lb:v0"
       params:
         InputLabel: "aws-lb-access-log"
         IntegrationName: "sumo-us-2"
   inputs:
     s3_sqs:
       - labels: "aws-lb-access-log"
         sqs_url: "https://sqs.us-west-2.amazonaws.com/XXXXXXXX/SQS_NAME"
         access_key_id: "ACCESS_KEY_ID"
         access_secret: "ACCESS_SECRET_KEY"
         region: "us-west-2"
         log_type: alb
   outputs:
     streams:
       - name: "sumo-us-2"
         type: "sumologic"
         endpoint: "SUMOLOGIC_ENDPOINT"
         features: "metric, edac, topk, cluster"

5. In the YAML file: 
   • Under imports, update:
     • InputLabel 
     • IntegrationName
   • Under inputs, update: 
     • sqs_url
     • access_key_id
     • access_secret
     • region
   • Under outputs, update the information based on your desired streaming output. 
6. Click Save.