# Mass deployment

**URL:** <https://discuss.elastic.co/t/mass-deployment/201668>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [September 30, 2019, 3:29pm UTC](https://discuss.elastic.co/t/mass-deployment/201668 "2019-09-30T15:29:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yatesss](https://avatars.discourse-cdn.com/v4/letter/y/46a35a/32.png) [@Yatesss](https://discuss.elastic.co/u/Yatesss)\
**Post date:** [September 30, 2019, 3:29pm UTC](https://discuss.elastic.co/t/mass-deployment/201668/1 "2019-09-30T15:29:34Z")

</div>

Hi all,

Has anyone managed to automate the deployment of packetbeat to Windows 10 machines? I can't figure out how to define the monitoring interfaces in packetbeat.yml on mass while keeping it relatively simple.

Thanks,

---

<div class="post-metadata">

**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\
**Post date:** [October 1, 2019, 8:16pm UTC](https://discuss.elastic.co/t/mass-deployment/201668/2 "2019-10-01T20:16:16Z")

</div>

Hello, thanks for reaching out about packetbeat on Windows 10. For the Windows 10 machines, does the output of `packetbeat devices` vary? Perhaps there is a pattern where you could specify the first interface like this?

`packetbeat.interfaces.device: 0`

[https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-interfaces.html](https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-interfaces.html)

---

<div class="post-metadata">

**Author:** ![Yatesss](https://avatars.discourse-cdn.com/v4/letter/y/46a35a/32.png) [@Yatesss](https://discuss.elastic.co/u/Yatesss)\
**Post date:** [October 2, 2019, 3:04pm UTC](https://discuss.elastic.co/t/mass-deployment/201668/3 "2019-10-02T15:04:34Z")

</div>

Thanks for your response Michael.

I've got an algorithm which seems do able although it's going to take me a while to put together.

It seems you can have any number of `packetbeat.interfaces.device:` as long as the device exists.

My theory is to do the following:

1. powershell ./packetbeat.exe devices
2. count the values returned
3. for each "device" write to packetbeat.yml `packetbeat.interfaces.device: "device"`  
"device"++

and then run that each time the user logs in to ensure it's continuously accurate. It's messy but seems to be the the closest thing to a workaround I can pull together.

Do you have any thoughts?

---

<div class="post-metadata">

**Author:** ![Yatesss](https://avatars.discourse-cdn.com/v4/letter/y/46a35a/32.png) [@Yatesss](https://discuss.elastic.co/u/Yatesss)\
**Post date:** [October 3, 2019, 11:23am UTC](https://discuss.elastic.co/t/mass-deployment/201668/4 "2019-10-03T11:23:40Z")

</div>

I've put this together - which uses 3 separate .yml

ConfigTemplate.yml which contains the rest of the packetbeat.yml minus the interfaces.

Interfaces.yml which is a temp file used to write the interfaces to.

packetbeat.yml which is the final config file packetbeat will use.

The python script should be in the packetbeat directory along with the config .yml's

The only limitation is that it needs python on the host machines - the next stage is to see if it can be done with powershell.

Hope this helps anyone else! Any improvements are welcome!

```
import subprocess

devices = subprocess.check_output(["powershell.exe", "(./packetbeat.exe devices).count"])

devicesCount = int(devices.decode('utf-8'))

print(devicesCount)

deviceCount = range(devicesCount)

with open('ConfigTemplate.yml', 'r') as original: data1 = original.read()

with open('Interfaces.yml', 'w') as modified: 

  for i in deviceCount:
    modified.write("packetbeat.interfaces.device: " + str(i)+ "\n" )

with open('Interfaces.yml', 'r') as original: data2 = original.read()

with open('Packetbeat.yml', 'w') as modified2: modified2.write("# ================== Set listening interfaces ==================" +"\n"+ data2 + "\n" + data1 + "\n")
```

---

<div class="post-metadata">

**Author:** ![Yatesss](https://avatars.discourse-cdn.com/v4/letter/y/46a35a/32.png) [@Yatesss](https://discuss.elastic.co/u/Yatesss)\
**Post date:** [October 3, 2019, 1:05pm UTC](https://discuss.elastic.co/t/mass-deployment/201668/5 "2019-10-03T13:05:31Z")

</div>

Powershell version -

```auto
$count = (C:\path\to\packetbeat.exe - devices).count

$line = ''

for($i=0; $i -le ($count-1); $i++){

    $line +="packetbeat.interfaces.device:"+" $i `r`n" 

    }

$line | Out-File -FilePath "C:\path\to\packetbeat\Interfaces.yml"

$configTemplate = Get-Content -Path "C:\path\to\packetbeat\ConfigTemplate.yml"

$interfaces = Get-Content -Path "C:\path\to\packetbeat\Interfaces.yml"

$interfaces + "`r`n" + $configTemplate | Out-File -FilePath "C:\path\to\packetbeat\packet.yml"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2019, 1:05pm UTC](https://discuss.elastic.co/t/mass-deployment/201668/6 "2019-10-31T13:05:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.