chronicleforwarderexporter

README

Chronicle Forwarder Exporter

The Chronicle Forwarder Exporter is designed for forwarding logs to a Chronicle Forwarder endpoint using either Syslog or File-based methods. This exporter supports customization of data export types and various configuration options to tailor the connection and data handling to specific needs.

Minimum Agent Versions

• Introduced: v1.42.0

Supported Pipelines

• Logs

How It Works

1. For Syslog, it establishes a network connection to the specified Chronicle forwarder endpoint.
2. For File, it writes logs to a specified file path.

Configuration

Field	Type	Default Value	Required	Description
export_type	string	syslog	true	Type of export, either syslog or file.
raw_log_field	string		false	The field name to send raw logs to Chronicle.
syslog.endpoint	string	127.0.0.1:10514	false	The Chronicle forwarder endpoint.
syslog.transport	string	tcp	false	The network protocol to use (e.g., tcp, udp).
syslog.tls.key_file	string		false	Configure the receiver to use TLS.
syslog.tls.cert_file	string		false	Configure the receiver to use TLS.
file.path	string		false	The path to the file for storing logs.

Raw Log Field

The raw log field is the field name that the exporter will use to send raw logs to Chronicle. It is an OTTL expression that can be used to reference any field in the log record. If the field is not present in the log record, the exporter will not send the log to the Chronicle Forwarder. The log record context can be viewed here: Log Record Context.

Example Configurations

Syslog Configuration Example

chronicleforwarder:
  export_type: "syslog"
  raw_log_field: body
  syslog:
    endpoint: "syslog.example.com:10514"
    network: "tcp"

File Configuration Example

chronicleforwarder:
  export_type: "file"
  raw_log_field: attributes["message"]
  file:
    path: "/path/to/logfile"

---

Documentation

Overview

Package chronicleforwarderexporter exports OpenTelemetry data to an endpoint or file.

Index

• func NewFactory() exporter.Factory
• type Config
  • func (cfg *Config) Validate() error
• type File
• type SyslogConfig

Functions

func NewFactory

func NewFactory() exporter.Factory

NewFactory creates a new Chronicle exporter factory.

Types

type Config

type Config struct {
	exporterhelper.TimeoutSettings `mapstructure:",squash"`
	exporterhelper.QueueSettings   `mapstructure:"sending_queue"`
	configretry.BackOffConfig      `mapstructure:"retry_on_failure"`

	// ExportType is the type of export to use.
	ExportType string `mapstructure:"export_type"`

	// Syslog is the configuration for the connection to the Chronicle forwarder.
	Syslog SyslogConfig `mapstructure:"syslog"`

	// File is the configuration for the connection to the Chronicle forwarder.
	File File `mapstructure:"file"`

	// RawLogField is the field name that will be used to send raw logs to Chronicle.
	RawLogField string `mapstructure:"raw_log_field"`
}

Config defines configuration for the Chronicle exporter.

func (*Config) Validate

func (cfg *Config) Validate() error

Validate validates the Chronicle exporter configuration.

type File

type File struct {
	// Path is the path to the file to send to Chronicle.
	Path string `mapstructure:"path"`
}

File defines configuration for sending to.

type SyslogConfig

type SyslogConfig struct {
	confignet.AddrConfig `mapstructure:",squash"`

	// TLSSetting struct exposes TLS client configuration.
	TLSSetting *configtls.ClientConfig `mapstructure:"tls"`
}

SyslogConfig defines configuration for the Chronicle forwarder connection.