Grafana Loki destination plugin - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

The Grafana Loki destination plugin (name: loki) lets you configure your telemetry pipeline to send your log data to Grafana Loki.

Supported telemetry types

The Grafana Loki destination plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

Logs	Metrics	Traces

Configuration parameters

Use the parameters in this section to configure the Grafana Loki destination plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

Required

Name	Key	Description	Default
Host	`host`	Required. Loki hostname or IP address. Don’t include the sub path, such as `loki/api/v1/push`. Include only the base hostname or URL.	`127.0.0.1`
Port	`port`	Required. TCP port of the target Loki service.	`3100`

Basic Authentication

Name	Key	Description	Default
HTTP Username	`http_user`	Basic auth username.	none
HTTP Password	`http_passwd`	Basic auth password. Requires `http_user` to be set.	none

Advanced

Name	Key	Description	Default
Tenant ID	`tenant_id`	Tenant ID used by default to push logs to Loki. If omitted or empty, it’s assumed that Loki is running in single-tenant mode and no `X-Scope-OrgID` header is sent.	none
Tenant ID Key	`tenant_id_key`	Required. If set, `X-Scope-OrgID` will be the value of the key from incoming record. It can be useful to set `X-Scode-OrgID` dynamically.	none
Labels	`labels`	Labels for API requests.	`job=fluentbit`
Label Keys	`label_keys`	Comma-separated list of keys to use as stream labels.	none
Enable Auto Kubernetes Labels	`auto_kubernetes_labels`	If set to true, adds all Kubernetes labels to Loki labels. Accepted values: `true`, `false`.	`false`
Drop Single Key	`drop_single_key`	If set to true and only a single key remains, the log line sent to Loki is the value of that key. Accepted values: `true`, `false`.	`false`
Remove Keys	`remove_keys`	Comma-separated list of keys to remove.	none
Line Format	`line_format`	Format to use when flattening the record to a log line. Accepted values: `json` (sent log line is the Palo Alto Networks Telemetry Pipeline record dumped as JSON), `key_value` (log line is each item in the record concatenated together, separated by a single space, in the format `=`).	`json`

Security and TLS

Name	Key	Description	Default
TLS	`tls`	If `true`, enables TLS/SSL. If `false`, disables TLS/SSL. Accepted values: `true`, `false`.	`false`
TLS Certificate Validation	`tls.verify`	If `on`, and if `tls` is `true`, enables TLS/SSL certificate validation. If `off`, disables TLS/SSL certificate validation. Accepted values: `on`, `off`.	`on`
TLS Debug Level	`tls.debug`	Sets TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational), `4` (Verbose).	`1`
CA Certificate File Path	`tls.ca_file`	Absolute path to CA certificate file.	none
Certificate File Path	`tls.crt_file`	Absolute path to certificate file.	none
Private Key File Path	`tls.key_file`	Absolute path to private key file.	none
Private Key Path Password	`tls.key_passwd`	Password for private key file.	none
TLS SNI Hostname Extension	`tls.vhost`	Hostname to be used for TLS SNI extension.	none

Advanced Networking

Name	Key	Description	Default
DNS Mode	`net.dns.mode`	Selects the primary DNS connection type, which can be `TCP` or `UDP`.	none
DNS Resolver	`net.dns.resolver`	Selects the primary DNS connection type, which can be `LEGACY` or `ASYNC`.	none
Prefer IPv4	`net.dns.prefer_ipv4`	Prioritizes IPv4 DNS results when trying to establish a connection. Accepted values: `true`, `false`.	`false`
Keepalive	`net.keepalive`	Enables or disables Keepalive support. Accepted values: `true`, `false`.	`true`
Keepalive Idle Timeout	`net.keepalive_idle_timeout`	Sets the maximum time allowed for an idle Keepalive connection.	`30s`
Max Connect Timeout	`net.connect_timeout`	Sets the maximum time allowed to establish a connection, which includes the TLS handshake.	`10s`
Max Connect Timeout Log Error	`net.connect_timeout_log_error`	Specifies whether to log an error on connection timeout. When disabled, the timeout is logged as a debug message. Accepted values: `true`, `false`.	`true`
Source Address	`net.source_address`	Specifies the network address to bind for data traffic.	none
Max Keepalive Recycle	`net.keepalive_max_recycle`	Sets the maximum number of times a keepalive connection can be used before it’s retired.	`2000`