> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cortex XCOR Logs destination plugin

> Configure the Cortex XCOR Logs destination plugin in Palo Alto Networks Telemetry Pipeline to send logs to Cortex XCOR.

export const entity_0 = "Cortex XCOR Logs destination plugin"

export const plugin_0 = "Cortex XCOR Logs destination plugin"

export const ApiToken = () => <>
    Replace <em><code>API_TOKEN</code></em> with the API token generated from your <a href="/administer/accounts-teams/service-accounts">service account</a>. Cortex XCOR recommends storing your API token in a separate file or Kubernetes Secret and calling it using an environment variable, such as <code>$API_TOKEN</code>.
  </>;

export const MyTenant = () => <>
    Replace <em><code>TENANT</code></em> with the name of your Cortex XCOR tenant.
  </>;

<Info>
  This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone
  product separate from Palo Alto Networks Cortex XCOR.
</Info>

The Cortex XCOR Logs
[destination plugin](/ingest/pipeline/plugins/destination-plugins)
(name: `http`, alias: `Cortex XCOR`) lets you configure your telemetry pipeline
to output log data to Cortex XCOR.

## Supported telemetry types

The {plugin_0} for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

| Logs | Metrics | Traces |
| :-: | :-: | :-: |
| <Icon icon="circle-check" color="green" /> | <Icon icon="ban" color="red" /> | <Icon icon="ban" color="red" /> |

## Configuration parameters

Use the parameters in this section to configure the {entity_0}. The
Palo Alto Networks Telemetry Pipeline web interface uses the items in the **Name** column to
describe these parameters. [Pipeline configuration files](/ingest/pipeline/v2/configure/config-files)
use the items in the **Key** column as YAML keys.

### General

| Name | Key | Description | Default |
| - | - | - | - |
| **Host** | `host` | Required. Your Cortex XCOR tenant. | *`TENANT`*`.chronosphere.io` |
| **Port** | `port` | Required. The port to communicate with Cortex XCOR. | `443` |
| **Key** | `header` | Required. The header type to include with your request. | `API-Token` |
| **Value** | `header` | Required. Your ingest API token to authenticate with Cortex XCOR. | *none* |

* <MyTenant />
* <ApiToken />

### Advanced

| Name | Key | Description | Default |
| - | - | - | - |
| **URI** | `uri` | Required. HTTP URI for the web server. For example, `/api/v1/data/logs/ingest` for JSON format. | `/api/v1/data/logs/ingest` |
| **Format** | `format` | The data format to use in the HTTP request. | `json` |
| **Compress** | `compress` | Sets payload compression. Accepted values: `gzip`, *none*. | `gzip` |
| **HTTP Proxy** | `proxy` | Specifies an HTTP proxy. The expected format is `http://host:port`. | *none* |
| **JSON Date Format** | `json_date_format` | Specifies the date format. Accepted values: `double`, `epoch`, `iso8601` (such as `2018-05-30T09:39:52.000681Z`), `java_sql_timestamp` (such as `2018-05-30 09:39:52.000681`). | `iso8601` |
| **JSON Date Key** | `json_date_key` | Specifies the name of the date field in output. | `_time` |
| **Body Key** | `body_key` | Specifies the key that contains the body. | *none* |
| **Header Tag** | `header_tag` | Sets an HTTP header whose value is the tag of the record. | *none* |
| **Header Key** | `headers_key` | Specifies the key that contains the headers. | *none* |

### Security and TLS

| Name | Key | Description | Default |
| - | - | - | - |
| **TLS** | `tls` | If `true`, enables TLS/SSL. If `false`, disables TLS/SSL. Accepted values: `true`, `false`. | `false` |
| **TLS Certificate Validation** | `tls.verify` | If `on`, and if `tls` is `true`, enables TLS/SSL certificate validation. If `off`, disables TLS/SSL certificate validation. Accepted values: `on`, `off`. | `on` |
| **TLS Debug Level** | `tls.debug` | Sets TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational), `4` (Verbose). | `1` |
| **CA Certificate File Path** | `tls.ca_file` | Absolute path to CA certificate file. | *none* |
| **Certificate File Path** | `tls.crt_file` | Absolute path to certificate file. | *none* |
| **Private Key File Path** | `tls.key_file` | Absolute path to private key file. | *none* |
| **Private Key Path Password** | `tls.key_passwd` | Password for private key file. | *none* |
| **TLS SNI Hostname Extension** | `tls.vhost` | Hostname to be used for TLS SNI extension. | *none* |

### Advanced Networking

| Name | Key | Description | Default |
| - | - | - | - |
| **DNS Mode** | `net.dns.mode` | Selects the primary DNS connection type, which can be `TCP` or `UDP`. | *none* |
| **DNS Resolver** | `net.dns.resolver` | Selects the primary DNS connection type, which can be `LEGACY` or `ASYNC`. | *none* |
| **Prefer IPv4** | `net.dns.prefer_ipv4` | Prioritizes IPv4 DNS results when trying to establish a connection. Accepted values: `true`, `false`. | `false` |
| **Keepalive** | `net.keepalive` | Enables or disables Keepalive support. Accepted values: `true`, `false`. | `true` |
| **Keepalive Idle Timeout** | `net.keepalive_idle_timeout` | Sets the maximum time allowed for an idle Keepalive connection. | `30s` |
| **Max Connect Timeout** | `net.connect_timeout` | Sets the maximum time allowed to establish a connection, which includes the TLS handshake. | `10s` |
| **Max Connect Timeout Log Error** | `net.connect_timeout_log_error` | Specifies whether to log an error on connection timeout. When disabled, the timeout is logged as a debug message. Accepted values: `true`, `false`. | `true` |
| **Source Address** | `net.source_address` | Specifies the network address to bind for data traffic. | *none* |
| **Max Keepalive Recycle** | `net.keepalive_max_recycle` | Sets the maximum number of times a keepalive connection can be used before it's retired. | `2000` |

### Basic Authentication

| Name | Key | Description | Default |
| - | - | - | - |
| **HTTP Username** | `http_user` | Basic auth username. | *none* |
| **HTTP Password** | `http_passwd` | Basic auth password. Requires `http_user` to be set. | *none* |

## Example

The following YAML configuration defines a Fluent Bit input and a Cortex XCOR Logs
output.

```yaml theme={null}
pipeline:
  inputs:
    - name: forward
      alias: Fluent_Bit
      port: "5170"
      tls.verify: on
      tls.debug: "1"
      tag: forward.cb3bae48-0000-4a51-0000-f6ccd3f0ed0c
  filters:
    - name: lua
      match: forward.cb3bae48-0000-4a51-0000-f6ccd3f0ed0c
      active: "false"
  outputs:
    - name: http
      alias: Cortex XCOR
      host: TENANT.chronosphere.io
      port: "443"
      header:
        - API-Token f31b...ed7t292
      uri: /api/v1/data/logs/ingest
      format: json
      compress: gzip
      json_date_format: iso8601
      json_date_key: _time
      tls: true
      tls.verify: on
      tls.debug: "1"
      net.keepalive: true
      net.keepalive_idle_timeout: 30s
      net.connect_timeout: 10s
      net.connect_timeout_log_error: true
      net.keepalive_max_recycle: "2000"
      core.metadata:
        name: Cortex XCOR Logs ingest
      Match_Regex: .{0,}
```


## Related topics

- [Datadog Logs destination plugin](/ingest/pipeline/plugins/destination-plugins/datadog.md)
- [Dynatrace Logs destination plugin](/ingest/pipeline/plugins/destination-plugins/dynatrace.md)
- [Oracle Log Analytics destination plugin](/ingest/pipeline/plugins/destination-plugins/oracle.md)
- [Azure Monitor Logs destination plugin](/ingest/pipeline/plugins/destination-plugins/azure-monitor.md)
- [New Relic Logs destination plugin](/ingest/pipeline/plugins/destination-plugins/new-relic.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.