Bash Command source plugin - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

The Bash Command source plugin (name: exec) lets you run bash commands once at pipeline startup, or at repeated intervals. Although this is a self-contained plugin that doesn’t communicate with external sources, it’s still classified as a pull-based source plugin.

Supported telemetry types

The Bash Command source plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

Logs	Metrics	Traces

Configuration parameters

Use the parameters in this section to configure the Bash Command source plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

Required

Name	Key	Description	Default
Command	`command`	Required. The bash command to run.	none
Polling Interval (Seconds)	`interval_sec`	Required. The number of seconds between polls.	none
Only Run Once	`Oneshot`	Allows collection of data preceding pipelines startup. If `true`, this plugin runs only a single time at startup. Accepted values: `true`, `false`.	`false`

Advanced

Name	Key	Description	Default
Buffer Size	`Buf_Size`	The buffer sizes for your bash command. In cases of large output, set this value to a larger size.	`8mb`
Polling Interval (nanoseconds)	`Interval_Nsec`	The number of nanoseconds to add to the polling interval set in the Required settings.	`0`
Memory Buffer Limit	`mem_buf_limit`	Sets a limit for how much buffered data the plugin can write to memory, which affects backpressure. This value must follow Fluent Bit’s rules for unit sizes. If unspecified, no limit is enforced. For v2 pipelines, this parameter affects only pipelines with the Deployment or DaemonSet workload type. To learn more, see the v2 backpressure guide. For v3 pipelines, this parameter is independent from the OpenTelemetry `memory_limiter` and `batch` processors.	none