What is Template?

A Template is an object in observIQ that allows you to deploy and manage the same Source(s) across multiple Agents. Similarly, all agents associated a Template can be updated with a single click (as opposed to updating each agent individually).

Templates are required gathering logs from Kubernetes , but are optional for gathering logs Linux, Mac, and Windows environments. Using a Template is generally recommended if you intend to gather logs from 2 more hosts, that share the same general logging requirements. (Example: gathering logs Windows Event channels from two separate Windows Server 2016 hosts)

How do I use a Template?

Using a Template is easy. For Linux, Mac, and Windows, the steps are nearly identical. Follow the steps below - get started by creating your first template.

1) Create a Template (Windows Example)

To create a Template, navigate to the Fleet > Templates page and click Add Template


Select Windows as the Platform, fill in a Template Name and click Create.


2) Add a Source to your Template

On the Template > [Template Name] page, click Add Sources.


On the Choose Source Type page, select an applicable Windows Source, like Windows Event Log


Then fill out the required Source configuration parameters, and click Create


3) Deploy observIQ Agent with one-line installation command

On the Template > [Template Name] page, click Add Agents.


On the Install Windows Agents page, copy, paste and run the installation command each host you'd like to an agent (and relate this template).

12631263 961961

After installing each desired agent, they will appear on the Template page, indicating the installation was successful. In this example, we ran the installation command on 2 different Windows hosts.


Upgrading Agents in a Template

When at least one Agent associated with a Template requires an update, the Upgrade button will become available on the related Template page.


Clicking Upgrade will update all Agents to the latest version.