> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Route logs from Fluent Bit

> Learn how to route logs from Fluent Bit to Palo Alto Networks Cortex XCOR.

export const ApiToken = () => <>
    Replace <em><code>API_TOKEN</code></em> with the API token generated from your <a href="/administer/accounts-teams/service-accounts">service account</a>. Cortex XCOR recommends storing your API token in a separate file or Kubernetes Secret and calling it using an environment variable, such as <code>$API_TOKEN</code>.
  </>;

export const MyTenant = () => <>
    Replace <em><code>TENANT</code></em> with the name of your Cortex XCOR tenant.
  </>;

You can use Fluent Bit to send logs to Palo Alto Networks Cortex XCOR. To do
so, add an
[HTTP output plugin](https://docs.fluentbit.io/manual/pipeline/outputs/http)
that specifies your Cortex XCOR tenant as its destination.

## Example configuration

To route logs from Fluent Bit to Cortex XCOR, Cortex XCOR recommends
configuring an HTTP output plugin with the following parameters and values:

<Tabs>
  <Tab title="YAML configuration" id="yaml-configuration">
    ```yaml theme={null}
    pipeline:
      # ...
      outputs:
        - name: http
          match: "kube.*"
          alias: Cortex XCOR
          host: TENANT
          port: 443
          uri: /api/v1/data/logs/ingest
          header: "API-Token ${API_TOKEN}"
          format: json
          compress: gzip
          json_date_format: iso8601
          json_date_key: TIME
          tls: true
          tls.verify: true
          tls.debug: 1
          net.keepalive: true
          net.keepalive_idle_timeout: 30s
          net.connect_timeout: 10s
          net.connect_timeout_log_error: true
          net.keepalive_max_recycle: 2000
    ```
  </Tab>

  <Tab title="Classic configuration" id="classic-configuration">
    ```ini theme={null}
    [OUTPUT]
        Name                          http
        Match                         kube.*
        Alias                         Cortex XCOR
        Host                          TENANT
        Port                          443
        URI                           /api/v1/data/logs/ingest
        Header                        API-Token ${API_TOKEN}
        Format                        json
        Compress                      gzip
        json_date_format              iso8601
        json_date_key                 TIME
        tls                           On
        tls.verify                    On
        tls.debug                     1
        net.keepalive                 On
        net.keepalive_idle_timeout    30s
        net.connect_timeout           10s
        net.connect_timeout_log_error On
        net.keepalive_max_recycle     2000
    ```
  </Tab>
</Tabs>

* <ApiToken />

  <Note>
    The service account must have read access to route log data to Cortex XCOR.
  </Note>

* <MyTenant />

* Replace *`TIME`* with the value you assigned to timestamps in your
  [log normalization settings](/control/shaping/shape-logs/normalize-logs).
  If you didn't set up log normalization for timestamps, replace *`TIME`*
  with `timestamp`.


## Related topics

- [Ingest log data](/ingest/logs.md)
- [Integrate with Cortex XCOR](/integrate.md)
- [Fluent Bit source plugin](/ingest/pipeline/plugins/source-plugins/fluent-bit.md)
- [Palo Alto Networks Telemetry Pipeline v3](/ingest/pipeline/v3.md)
- [Route logs through Palo Alto Networks Telemetry Pipeline](/ingest/logs/pipeline-logs.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.