it updates the logging level for all the online agents

change_logging_agents.sh

#!/bin/bash

# Replace the values below for your deployment/cluster

KIBANA_ENDPOINT=https://lab.kb.us-east1.gcp.elastic-cloud.com:9243
KIBANA_USER=octavio
KIBANA_PW=super_secret

echo "Collecting the list from online agents..."

AGENT_IDS=`
curl -s --request GET \
  --url $KIBANA_ENDPOINT/api/fleet/agents?perPage=500&showInactive=false \
  --user "$KIBANA_USER:$KIBANA_PW" \
  --header 'Content-Type: application/json' \
  --header 'kbn-xsrf: as' \
  | jq '.list | map(select(.status == "online")) | map(.agent.id)'
`
echo "List of online agents:"
echo $AGENT_IDS

CHANGE_LOGGING="curl --request POST \
  --url $KIBANA_ENDPOINT/api/fleet/agents/%s/actions \
  --user \"$KIBANA_USER:$KIBANA_PW\" \
  --header 'Content-Type: application/json' \
  --header 'kbn-xsrf: as' \
  --data '{
	\"action\": {
			\"type\": \"SETTINGS\",
		\"data\": {
			\"log_level\": \"warning\"
		}
	}
}'"

# Iterate through the IDs and run the curl command
for AGENT_ID in $(echo "$AGENT_IDS" | jq -r '.[]'); do

  echo -e "\n---\nChanging logging for ID $AGENT_ID..."
  command=$(printf "$CHANGE_LOGGING" "$AGENT_ID")
  #echo $command 
  eval $command
done

change_logging.mp4