This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone
product separate from Palo Alto Networks Cortex XCOR.
stackdriver) lets you configure your telemetry pipeline to stream your
log data and metrics to Google Cloud Operations Suite.
Supported telemetry types
The Google Cloud Operations Suite destination plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:| Logs | Metrics | Traces |
|---|---|---|
Configuration parameters
Use the parameters in this section to configure the Google Cloud Operations Suite destination plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.GCP Authentication
| Name | Key | Description | Default |
|---|---|---|---|
| Google Service Credentials Path | google_service_credentials | The Service Credentials file lets Palo Alto Networks Telemetry Pipeline communicate directly with Google Cloud Services. For information about how to set up service credentials, see the Google Cloud Observability documentation. | none |
| GCP Service Account Email | service_account_email | Account email associated to the service. Available only if no credentials file is provided. | none |
| GCP Service Account Secret | service_account_secret | Private key content associated with the service account. Available only if no credentials file is provided. | none |
| Metadata Server | metadata_server | Private key content associated with the service account. Available only if no credentials file is provided. | http://metadata.google.internal |
Advanced
| Name | Key | Description | Default |
|---|---|---|---|
| Region Location | location | The Google Cloud or AWS region in which to store data about the resource. If the resource type is either generic_node or generic_task, this field is required. | none |
| Namespace Identifier | namespace | A namespace identifier, such as a cluster name or environment. If the resource type is either generic_node or generic_task, this field is required. | none |
| Node ID Identifier | node_id | A unique identifier for the node within the namespace, such as hostname or IP address. If the resource type is generic_node, this field is required. | none |
| Job Identifier | job | An identifier for a grouping of related task, such as the name of a microservice or distributed batch. If the resource type is generic_task, this field is required. | none |
| Task ID Identifier | task_id | A unique identifier for the task within the namespace and job, such as a replica index identifying the task within the job. If the resource type is generic_task, this field is required. | none |
| GCP Project ID | export_to_project_id | The Google Cloud project to receive these logs. Defaults to the project ID of the google_service_credentials file, or the project_id from Google’s metadata.google.internal server. | none |
| Resource Type | resource | Sets the resource type of data. Accepted values: k8s_container, k8s_node, k8s_pod, global, generic_node, generic_task, gce_instance. | none |
| Kubernetes Cluster Name | k8s_cluster_name | The name of the cluster that the container (node or pod based on the resource type) is running in. If the resource type is k8s_container, k8s_node, or k8s_pod, this field is required. | none |
| Kubernetes Cluster Location | k8s_cluster_location | The physical location of the cluster that contains (node or pod based on the resource type) the container. If the resource type is k8s_container, k8s_node, or k8s_pod, this field is required. | none |
| Labels Key | labels_key | The value of this field is used by the Stackdriver output plugin to find the related labels from jsonPayload and then extract the value of it to set the LogEntry labels. | none |
| Labels | labels | Optional list of comma-separated of strings specifying key-value pairs. The resulting labels are combined with the elements in obtained from labels_key to set the LogEntry labels. Elements from labels override duplicate values from labels_key. | none |
| Log Name Key | log_name_key | The value of this field is used by the plugin to extract logName from jsonPayload and set the logName field. | none |
| Tag Prefix | tag_prefix | Sets the tag_prefix used to validate the tag of logs with k8s resource type. Without this option, the tag of the log must be in format of k8s_container(pod/node).* to use the k8s_container resource type. Now the tag prefix is configurable by this option, being aware of the ending dot. | none |
| Severity Key | severity_key | Specifies the name of the key from the original record that contains the severity information. | none |
| Enable Cloud Trace Integration | autoformat_stackdriver_trace | Rewrite the trace field to include the projectID and format it for use with Cloud Trace. When enabled, the user can get the correct result by printing only the traceID (usually 32 characters). Accepted values: true, false. | false |
| Custom K8s Regex | custom_k8s_regex | Sets a custom regular expression to extract field like pod_name, namespace_name, container_name, and docker_id from the local_resource_id in logs. This is helpful if the value of pod or node name contains dots. | none |
Security and TLS
| Name | Key | Description | Default |
|---|---|---|---|
| TLS | tls | If true, enables TLS/SSL. If false, disables TLS/SSL. Accepted values: true, false. | false |
| TLS Certificate Validation | tls.verify | If on, and if tls is true, enables TLS/SSL certificate validation. If off, disables TLS/SSL certificate validation. Accepted values: on, off. | on |
| TLS Debug Level | tls.debug | Sets TLS debug verbosity level. Accepted values: 0 (No debug), 1 (Error), 2 (State change), 3 (Informational), 4 (Verbose). | 1 |
| CA Certificate File Path | tls.ca_file | Absolute path to CA certificate file. | none |
| Certificate File Path | tls.crt_file | Absolute path to certificate file. | none |
| Private Key File Path | tls.key_file | Absolute path to private key file. | none |
| Private Key Path Password | tls.key_passwd | Password for private key file. | none |
| TLS SNI Hostname Extension | tls.vhost | Hostname to be used for TLS SNI extension. | none |
Advanced Networking
| Name | Key | Description | Default |
|---|---|---|---|
| DNS Mode | net.dns.mode | Selects the primary DNS connection type, which can be TCP or UDP. | none |
| DNS Resolver | net.dns.resolver | Selects the primary DNS connection type, which can be LEGACY or ASYNC. | none |
| Prefer IPv4 | net.dns.prefer_ipv4 | Prioritizes IPv4 DNS results when trying to establish a connection. Accepted values: true, false. | false |
| Keepalive | net.keepalive | Enables or disables Keepalive support. Accepted values: true, false. | true |
| Keepalive Idle Timeout | net.keepalive_idle_timeout | Sets the maximum time allowed for an idle Keepalive connection. | 30s |
| Max Connect Timeout | net.connect_timeout | Sets the maximum time allowed to establish a connection, which includes the TLS handshake. | 10s |
| Max Connect Timeout Log Error | net.connect_timeout_log_error | Specifies whether to log an error on connection timeout. When disabled, the timeout is logged as a debug message. Accepted values: true, false. | true |
| Source Address | net.source_address | Specifies the network address to bind for data traffic. | none |
| Max Keepalive Recycle | net.keepalive_max_recycle | Sets the maximum number of times a keepalive connection can be used before it’s retired. | 2000 |