Forward destination plugin - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

The Forward destination plugin (name: forward) lets you configure your telemetry pipeline to send processed telemetry data to your Forward Services. This plugin supports both TCP and UDP transport protocols and provides options for configuring data buffering and batching to optimize network usage.

Supported telemetry types

The Forward destination plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

Logs	Metrics	Traces

Configuration parameters

Use the parameters in this section to configure the Forward destination plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

General

Name	Key	Description	Default
Host	`host`	Required. Target host where Fluent-Bit or Fluentd are listening for Forward messages.	`127.0.0.1`
Port	`port`	Required. TCP port of the target service.	`24224`
Timestamps as Integers	`time_as_integer`	Sets timestamps in integer format, and enables compatibility mode for Fluentd v0.12 series. Accepted values: `true`, `false`.	`false`
Upstream Configuration Path	`upstream`	If Forward will connect to an Upstream instead of a simple host, this property defines the absolute path for the Upstream configuration file. For more details, refer to the Upstream Servers documentation section.	none
Unix Socket	`unix_path`	Specifies the path to the Unix socket to send a Forward message. If set, Upstream is ignored.	none
Tag	`tag`	Overwrites the transmitted tag, which lets the receiving pipeline either start fresh or to attribute the source.	none
Send Options	`send_options`	Always send options, with `size` equaling the count of messages. Accepted values: `true`, `false`.	`false`
Require Ack Response	`require_ack_response`	Indicates whether to send `chunk`-option and wait for `ack` response from server. Enables at-least-once and receiving server can control rate of traffic. Requires Fluentd v0.14.0 or later server. Accepted values: `true`, `false`.	`false`
Compress	`compress`	Enables gzip compression. Incompatible with `time_as_integer=true` and tags set dynamically using the Rewrite Tag filter. Requires Fluentd v0.14.7 or later server. Accepted values: `gzip`, none.	none
Workers	`workers`	Enables one or more dedicated threads for this output.	`2` (`0` for versions 1.8.12 and earlier)