Oracle Log Analytics destination plugin - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

The Oracle Log Analytics destination plugin (name: oracle_log_analytics) lets you configure your telemetry pipeline to output log data to Oracle Log Analytics.

Supported telemetry types

The Oracle Log Analytics destination plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

Logs	Metrics	Traces

Configuration parameters

Use the parameters in this section to configure the Oracle Log Analytics destination plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

General

Name	Key	Description	Default
Configuration File Location	`config_file_location`	Required. The location of the configuration file containing OCI authentication details. See SDK and CLI Configuration File for steps on generating the configuration file.	`~/.oci/config`
Profile Name	`profile_name`	Required. OCI Config Profile Name to be used from the configuration file.	`DEFAULT`
Namespace	`namespace`	Required. OCI Tenancy Namespace in which the collected log data is to be uploaded.	none
Proxy	`proxy`	Defines a proxy. Must be in the format `http://host:port`. Supports the HTTP protocol only.	none

Advanced

Name	Key	Description	Default
OCI Config in Record	`oci_config_in_record`	If set to `true`, the following `oci_la_*` parameters are read from the record itself instead of the output plugin configuration. Accepted values: `true`, `false`.	`false`
OCI Log Group ID	`oci_la_log_group_id`	Required. The OCID of the Logging Analytics Log Group where the logs must be stored.	none
OCI Log Source Name	`oci_la_log_source_name`	Required. The Logging Analytics Source that must be used to process the log records.	none
OCI Entity ID	`oci_la_entity_id`	The ID of the Logging Analytics Entity.	none
OCI Entity Type	`oci_la_entity_type`	The entity type of the Logging Analytics Entity.	none
OCI Log Path	`oci_la_log_path`	Specifies the original location of the log files.	none
OCI Global Metadata	`oci_la_global_metadata`	Specifies additional global metadata along with original log content to Logging Analytics. The format is `key value`. This option can be set multiple times.	none
OCI Metadata	`oci_la_metadata`	Specifies additional metadata for a log event along with original log content to Logging Analytics. The format is `key value`. This option can be set multiple times.	none

Security and TLS

Name	Key	Description	Default
TLS	`tls`	If `true`, enables TLS/SSL. If `false`, disables TLS/SSL. Accepted values: `true`, `false`.	`false`
TLS Certificate Validation	`tls.verify`	If `on`, and if `tls` is `true`, enables TLS/SSL certificate validation. If `off`, disables TLS/SSL certificate validation. Accepted values: `on`, `off`.	`on`
TLS Debug Level	`tls.debug`	Sets TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational), `4` (Verbose).	`1`
CA Certificate File Path	`tls.ca_file`	Absolute path to CA certificate file.	none
Certificate File Path	`tls.crt_file`	Absolute path to certificate file.	none
Private Key File Path	`tls.key_file`	Absolute path to private key file.	none
Private Key Path Password	`tls.key_passwd`	Password for private key file.	none
TLS SNI Hostname Extension	`tls.vhost`	Hostname to be used for TLS SNI extension.	none

Advanced Networking

Name	Key	Description	Default
DNS Mode	`net.dns.mode`	Selects the primary DNS connection type, which can be `TCP` or `UDP`.	none
DNS Resolver	`net.dns.resolver`	Selects the primary DNS connection type, which can be `LEGACY` or `ASYNC`.	none
Prefer IPv4	`net.dns.prefer_ipv4`	Prioritizes IPv4 DNS results when trying to establish a connection. Accepted values: `true`, `false`.	`false`
Keepalive	`net.keepalive`	Enables or disables Keepalive support. Accepted values: `true`, `false`.	`true`
Keepalive Idle Timeout	`net.keepalive_idle_timeout`	Sets the maximum time allowed for an idle Keepalive connection.	`30s`
Max Connect Timeout	`net.connect_timeout`	Sets the maximum time allowed to establish a connection, which includes the TLS handshake.	`10s`
Max Connect Timeout Log Error	`net.connect_timeout_log_error`	Specifies whether to log an error on connection timeout. When disabled, the timeout is logged as a debug message. Accepted values: `true`, `false`.	`true`
Source Address	`net.source_address`	Specifies the network address to bind for data traffic.	none
Max Keepalive Recycle	`net.keepalive_max_recycle`	Sets the maximum number of times a keepalive connection can be used before it’s retired.	`2000`

Example

The following YAML configuration defines a Fluent Bit input and an Oracle Log Analytics output.

pipeline:
  inputs:
    - Name: forward
      alias: Fluent_Bit
      port: "5170"
      tls.verify: on
      tls.debug: "1"
      tag: forward.0dd7a9e7-ed46-4c31-bbd3-40e8b607f501
  outputs:
    - Name: oracle_log_analytics
      config_file_location: ~/.oci/config
      profile_name: DEFAULT
      namespace: NAMESPACE
      proxy: http://host:port
      oci_la_log_group_id: log_group_id
      oci_la_log_source_name: REST API
      oci_la_entity_id: entity
      oci_la_entity_type: entity_type
      oci_la_log_path: log_path
      oci_la_global_metadata:
        - key1 value1
      oci_la_metadata:
        - key2 value2
      tls: true
      tls.verify: on
      tls.debug: "1"
      net.keepalive: true
      net.keepalive_idle_timeout: 30s
      net.connect_timeout: 10s
      net.connect_timeout_log_error: true
      net.keepalive_max_recycle: "2000"
      Match_Regex: .{0,}