sonar-insert-stream-rule-command-batch
Insert a command into existing stream rules from input records.
Input record:
- guid (required) - Target rule GUID
- command (required) - The ONE command being inserted, e.g. search not(src_ip == ip("10.0.0.1")). Not the whole rule body
- ordinal (optional) - Position to insert at, 0-based. Appended at the end when not given
- template_id (optional) - Command template ID from sonar-stream-rule-command-templates. 1 is free-form
- field_name (optional) - Field the command template applies to
- args (optional) - Template argument map
- invert (optional) - true or false. Uses the template's inverted form (query2)
sonar-insert-stream-rule-command-batch [run=VALUE]
- run=VALUE
- Optional. Update rule only if value is 't'
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| _status | String | Status | e.g. success. One of success (written), applicable (checks passed but run=t was not given, so nothing was written), or failure - see _error |
| _error | String | Error | e.g. Stream rule not found. Reason the record was rejected |