Esteban
02/03/2021, 8:33 PMNoah Talerman
02/03/2021, 9:18 PMfleetctl
Esteban
02/04/2021, 1:00 PMNoah Talerman
02/04/2021, 6:11 PMfleetctl get p <insert_pack_name>
. This will output the properly formatted config in the terminal.
There’s currently no way to get the YAML config for multiple query packs in one command.Esteban
02/05/2021, 1:49 PMfleetctl get p <insert_pack_name>
will not list the queries in the pack, only the names. In any case im trying to migrate from kolide/fleet to fleetdm/fleet with a clean databaseNoah Talerman
02/05/2021, 4:15 PMim trying to migrate from kolide/fleet to fleetdm/fleet with a clean databaseGot it. Yes you’re correct that only the names of the queries are listed and this doesn’t help you in your migration efforts.
fleetctl get queries --yaml
. This will output a list of queries in YAML format. Copy this list into a new file called something like queries.yml
2. With your kolide/fleet instance running, run fleetctl get packs --yaml
. This will output a list of query packs in YAML format. Copy this into a new file called something like packs.yml
3. Now, with your fleetdm/fleet instance running, run fleetctl apply -f queries.yml
. This will import all the queries from your new queries.yml
file into your new Fleet instance.
4. With your fleetdm/fleet instance running, run fleetctl apply -f packs.yml
. This will import all the query packs along with the correct queries (that you just imported) into your new Fleet instance.Esteban
02/05/2021, 5:18 PMNoah Talerman
02/05/2021, 5:34 PMEsteban
02/08/2021, 4:35 PM