Route logs from Fluent Bit

You can use Fluent Bit to send logs to Palo Alto Networks Cortex XCOR. To do so, add an HTTP output plugin that specifies your Cortex XCOR tenant as its destination.

Example configuration

To route logs from Fluent Bit to Cortex XCOR, Cortex XCOR recommends configuring an HTTP output plugin with the following parameters and values:

YAML configuration
Classic configuration

pipeline:
  # ...
  outputs:
    - name: http
      match: "kube.*"
      alias: Cortex XCOR
      host: TENANT
      port: 443
      uri: /api/v1/data/logs/ingest
      header: "API-Token ${API_TOKEN}"
      format: json
      compress: gzip
      json_date_format: iso8601
      json_date_key: TIME
      tls: true
      tls.verify: true
      tls.debug: 1
      net.keepalive: true
      net.keepalive_idle_timeout: 30s
      net.connect_timeout: 10s
      net.connect_timeout_log_error: true
      net.keepalive_max_recycle: 2000

[OUTPUT]
    Name                          http
    Match                         kube.*
    Alias                         Cortex XCOR
    Host                          TENANT
    Port                          443
    URI                           /api/v1/data/logs/ingest
    Header                        API-Token ${API_TOKEN}
    Format                        json
    Compress                      gzip
    json_date_format              iso8601
    json_date_key                 TIME
    tls                           On
    tls.verify                    On
    tls.debug                     1
    net.keepalive                 On
    net.keepalive_idle_timeout    30s
    net.connect_timeout           10s
    net.connect_timeout_log_error On
    net.keepalive_max_recycle     2000

The service account must have read access to route log data to Cortex XCOR.
Replace TIME with the value you assigned to timestamps in your log normalization settings. If you didn’t set up log normalization for timestamps, replace TIME with timestamp.

Cortex XCOR

Palo Alto Networks Telemetry Pipeline

More information

Example configuration

​Example configuration

Example configuration