HTTP destination plugin - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

The HTTP destination plugin (name: http, alias: HTTP) lets you configure your telemetry pipeline to send your data to remote servers or services over the internet to an HTTP endpoint, such as a web server or an API.

Supported telemetry types

The HTTP destination plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

Logs	Metrics	Traces

Configuration parameters

Use the parameters in this section to configure the HTTP destination plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

General

Name	Key	Description	Default
Host	`host`	Required. IP address or hostname of the target HTTP Server.	`0.0.0.0`
Port	`port`	Required. TCP port of the target HTTP Server.	`80`
URI	`uri`	Required. Specifies an optional HTTP URI for the target web server.	`/`
Format	`format`	Required. Specifies the data format to be used in the HTTP request body. Accepted values: `json`, `json_lines`, `json_stream`.	`json_lines`

Advanced

Name	Key	Description	Default
Headers	`header`	Adds an HTTP header key-value pair. You can set multiple headers.	none
Compress	`compress`	Sets the payload compression mechanism. Accepted values: `gzip`, no value	none
HTTP Proxy	`proxy`	Specifies an HTTP Proxy. The expected format of this value is `http://host:port`.	none
JSON Date Format	`json_date_format`	Specifies the format of the date. Accepted values: `double`, `epoch`, `iso8601` (for example, `2018-05-30T09:39:52.000681Z`), `java_sql_timestamp` (for example, `2018-05-30 09:39:52.000681`, which can be used with AWS Athena).	none
JSON Date Key	`json_date_key`	Specifies the name of the date field in output.	none
Body Key	`body_key`	Specifies the key that contains the body.	none
Header Tag	`header_tag`	Sets an HTTP header whose value is the tag of the record.	none
Header Key	`headers_key`	Specifies the key that contains the headers.	none

Security and TLS

Name	Key	Description	Default
TLS	`tls`	If `true`, enables TLS/SSL. If `false`, disables TLS/SSL. Accepted values: `true`, `false`.	`false`
TLS Certificate Validation	`tls.verify`	If `on`, and if `tls` is `true`, enables TLS/SSL certificate validation. If `off`, disables TLS/SSL certificate validation. Accepted values: `on`, `off`.	`on`
TLS Debug Level	`tls.debug`	Sets TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational), `4` (Verbose).	`1`
CA Certificate File Path	`tls.ca_file`	Absolute path to CA certificate file.	none
Certificate File Path	`tls.crt_file`	Absolute path to certificate file.	none
Private Key File Path	`tls.key_file`	Absolute path to private key file.	none
Private Key Path Password	`tls.key_passwd`	Password for private key file.	none
TLS SNI Hostname Extension	`tls.vhost`	Hostname to be used for TLS SNI extension.	none

Advanced Networking

Name	Key	Description	Default
DNS Mode	`net.dns.mode`	Selects the primary DNS connection type, which can be `TCP` or `UDP`.	none
DNS Resolver	`net.dns.resolver`	Selects the primary DNS connection type, which can be `LEGACY` or `ASYNC`.	none
Prefer IPv4	`net.dns.prefer_ipv4`	Prioritizes IPv4 DNS results when trying to establish a connection. Accepted values: `true`, `false`.	`false`
Keepalive	`net.keepalive`	Enables or disables Keepalive support. Accepted values: `true`, `false`.	`true`
Keepalive Idle Timeout	`net.keepalive_idle_timeout`	Sets the maximum time allowed for an idle Keepalive connection.	`30s`
Max Connect Timeout	`net.connect_timeout`	Sets the maximum time allowed to establish a connection, which includes the TLS handshake.	`10s`
Max Connect Timeout Log Error	`net.connect_timeout_log_error`	Specifies whether to log an error on connection timeout. When disabled, the timeout is logged as a debug message. Accepted values: `true`, `false`.	`true`
Source Address	`net.source_address`	Specifies the network address to bind for data traffic.	none
Max Keepalive Recycle	`net.keepalive_max_recycle`	Sets the maximum number of times a keepalive connection can be used before it’s retired.	`2000`

Basic Authentication

Name	Key	Description	Default
HTTP Username	`http_user`	Basic auth username.	none
HTTP Password	`http_passwd`	Basic auth password. Requires `http_user` to be set.	none

AWS Authentication

Name	Key	Description	Default
Enable AWS Authentication	`aws_auth`	Enable AWS Sigv4 Authentication. Accepted values: `true`, `false`.	`false`
AWS Destination Service Code	`aws_service`	AWS destination service code, used by SigV4 authentication.	none
AWS Region	`aws_region`	AWS Region of your service.	none
AWS STS Endpoint	`aws_sts_endpoint`	Custom endpoint for the AWS STS API, used with the `aws_role_arn` option.	none
AWS IAM Assume Role	`aws_role_arn`	Amazon Resource Name (ARN) of an AWS Identity and Access Management (IAM) role to assume, for uses like cross-account access.	none
AWS External ID	`aws_external_id`	Specifies an external ID for the STS API. Can be used with the `aws_role_arn` parameter if your role requires an external ID.	none