{ "name": "google_workspace", "title": "Google Workspace", "version": "2.33.0", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Collect logs from Google Workspace with Elastic Agent.", "type": "integration", "download": "/epr/google_workspace/google_workspace-2.33.0.zip", "path": "/package/google_workspace/2.33.0", "icons": [ { "src": "/img/logo.svg", "path": "/package/google_workspace/2.33.0/img/logo.svg", "title": "logo Google", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "productivity_security" ], "signature_path": "/epr/google_workspace/google_workspace-2.33.0.zip.sig", "format_version": "3.2.3", "readme": "/package/google_workspace/2.33.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/google-workspace-chrome-screenshot.png", "path": "/package/google_workspace/2.33.0/img/google-workspace-chrome-screenshot.png", "title": "Google Workspace Chrome Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-rules-screenshot.png", "path": "/package/google_workspace/2.33.0/img/google-workspace-rules-screenshot.png", "title": "Google Workspace Rules Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-alert-screenshot.png", "path": "/package/google_workspace/2.33.0/img/google-workspace-alert-screenshot.png", "title": "Google Workspace Alert Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-device-screenshot.png", "path": "/package/google_workspace/2.33.0/img/google-workspace-device-screenshot.png", "title": "Google Workspace Device Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-token-screenshot.png", "path": "/package/google_workspace/2.33.0/img/google-workspace-token-screenshot.png", "title": "Google Workspace Token Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-group-enterprise-screenshot.png", "path": "/package/google_workspace/2.33.0/img/google-workspace-group-enterprise-screenshot.png", "title": "Google Workspace Group Enterprise Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-access-transparency-and-gcp-screenshot.png", "path": "/package/google_workspace/2.33.0/img/google-workspace-access-transparency-and-gcp-screenshot.png", "title": "Google Workspace Access Transparency and GCP Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-context-aware-access-screenshot.png", "path": "/package/google_workspace/2.33.0/img/google-workspace-context-aware-access-screenshot.png", "title": "Google Workspace Context Aware Access Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/google_workspace/2.33.0/LICENSE.txt", "/package/google_workspace/2.33.0/changelog.yml", "/package/google_workspace/2.33.0/manifest.yml", "/package/google_workspace/2.33.0/validation.yml", "/package/google_workspace/2.33.0/docs/README.md", "/package/google_workspace/2.33.0/img/google-workspace-access-transparency-and-gcp-screenshot.png", "/package/google_workspace/2.33.0/img/google-workspace-alert-screenshot.png", "/package/google_workspace/2.33.0/img/google-workspace-chrome-screenshot.png", "/package/google_workspace/2.33.0/img/google-workspace-context-aware-access-screenshot.png", "/package/google_workspace/2.33.0/img/google-workspace-device-screenshot.png", "/package/google_workspace/2.33.0/img/google-workspace-group-enterprise-screenshot.png", "/package/google_workspace/2.33.0/img/google-workspace-rules-screenshot.png", "/package/google_workspace/2.33.0/img/google-workspace-token-screenshot.png", "/package/google_workspace/2.33.0/img/logo.svg", "/package/google_workspace/2.33.0/kibana/tags.yml", "/package/google_workspace/2.33.0/data_stream/access_transparency/manifest.yml", "/package/google_workspace/2.33.0/data_stream/access_transparency/sample_event.json", "/package/google_workspace/2.33.0/data_stream/admin/manifest.yml", "/package/google_workspace/2.33.0/data_stream/admin/sample_event.json", "/package/google_workspace/2.33.0/data_stream/alert/manifest.yml", "/package/google_workspace/2.33.0/data_stream/alert/sample_event.json", "/package/google_workspace/2.33.0/data_stream/chrome/manifest.yml", "/package/google_workspace/2.33.0/data_stream/chrome/sample_event.json", "/package/google_workspace/2.33.0/data_stream/context_aware_access/manifest.yml", "/package/google_workspace/2.33.0/data_stream/context_aware_access/sample_event.json", "/package/google_workspace/2.33.0/data_stream/device/manifest.yml", "/package/google_workspace/2.33.0/data_stream/device/sample_event.json", "/package/google_workspace/2.33.0/data_stream/drive/manifest.yml", "/package/google_workspace/2.33.0/data_stream/drive/sample_event.json", "/package/google_workspace/2.33.0/data_stream/gcp/manifest.yml", "/package/google_workspace/2.33.0/data_stream/gcp/sample_event.json", "/package/google_workspace/2.33.0/data_stream/group_enterprise/manifest.yml", "/package/google_workspace/2.33.0/data_stream/group_enterprise/sample_event.json", "/package/google_workspace/2.33.0/data_stream/groups/manifest.yml", "/package/google_workspace/2.33.0/data_stream/groups/sample_event.json", "/package/google_workspace/2.33.0/data_stream/login/manifest.yml", "/package/google_workspace/2.33.0/data_stream/login/sample_event.json", "/package/google_workspace/2.33.0/data_stream/rules/manifest.yml", "/package/google_workspace/2.33.0/data_stream/rules/sample_event.json", "/package/google_workspace/2.33.0/data_stream/saml/manifest.yml", "/package/google_workspace/2.33.0/data_stream/saml/sample_event.json", "/package/google_workspace/2.33.0/data_stream/token/manifest.yml", "/package/google_workspace/2.33.0/data_stream/token/sample_event.json", "/package/google_workspace/2.33.0/data_stream/user_accounts/manifest.yml", "/package/google_workspace/2.33.0/data_stream/user_accounts/sample_event.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-26c10e40-8cbc-11ed-add3-0fec96545f1c.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-3be0b490-3430-11ed-9f31-c9178ccae8cd.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-3fb94480-8cbc-11ed-add3-0fec96545f1c.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-4c5a4cc0-8cbc-11ed-add3-0fec96545f1c.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-7b55f304-7a6b-4131-bc36-591e35732394.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-8925d900-3b43-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-ca3ff140-3b3f-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-d3cf6d50-3bfb-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-d6287d50-0107-11ed-825d-df764a9c0c57.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-d79f1730-9585-11ed-82ba-c3ec829933e4.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-e9a62e70-9583-11ed-82ba-c3ec829933e4.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-ec193fd0-3ab6-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-f163f270-3b13-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/dashboard/google_workspace-f8210e80-3b28-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-10b37c00-3c03-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-1cac9ed0-3b2f-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-2c0d5bc0-3b0d-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-2c40f770-3b24-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-3ceeeba0-3c04-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-676e6980-3bfc-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-7ab25b80-3b13-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-8817b016-61c1-4d10-bdc2-e30e9fd93d4c.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-8e8f98d0-3c02-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-8ec40930-0110-11ed-825d-df764a9c0c57.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-b95cf166-2f93-42c0-bf69-6ce3e2309a5b.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-c3960ae0-9586-11ed-82ba-c3ec829933e4.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-d542c8e0-3bfa-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-e013b790-010b-11ed-825d-df764a9c0c57.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-e3d44490-3bfc-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/kibana/search/google_workspace-ebb44680-3bf5-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/2.33.0/data_stream/access_transparency/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/access_transparency/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/access_transparency/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/access_transparency/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/admin/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/admin/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/admin/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/admin/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/alert/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/alert/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/alert/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/chrome/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/chrome/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/chrome/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/context_aware_access/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/context_aware_access/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/context_aware_access/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/context_aware_access/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/device/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/device/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/device/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/device/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/drive/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/drive/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/drive/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/drive/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/gcp/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/gcp/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/gcp/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/gcp/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/group_enterprise/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/group_enterprise/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/group_enterprise/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/group_enterprise/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/groups/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/groups/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/groups/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/groups/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/login/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/login/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/login/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/login/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/rules/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/rules/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/rules/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/rules/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/saml/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/saml/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/saml/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/saml/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/token/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/token/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/token/fields/fields.yml", "/package/google_workspace/2.33.0/data_stream/token/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/user_accounts/fields/base-fields.yml", "/package/google_workspace/2.33.0/data_stream/user_accounts/fields/beats.yml", "/package/google_workspace/2.33.0/data_stream/user_accounts/fields/package-fields.yml", "/package/google_workspace/2.33.0/data_stream/access_transparency/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/access_transparency/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/admin/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/admin/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/alert/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/alert/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/chrome/agent/stream/cel.yml.hbs", "/package/google_workspace/2.33.0/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/context_aware_access/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/device/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/device/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/drive/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/drive/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/gcp/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/group_enterprise/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/groups/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/groups/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/login/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/login/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/rules/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/rules/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/saml/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/saml/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/token/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/token/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/2.33.0/data_stream/user_accounts/agent/stream/httpjson.yml.hbs", "/package/google_workspace/2.33.0/data_stream/user_accounts/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "google_workspace", "title": "Google Workspace logs", "description": "Collect logs from Google Workspace APIs", "inputs": [ { "type": "httpjson", "vars": [ { "name": "jwt_file", "type": "text", "title": "Jwt File", "description": "Specifies the path to the JWT credentials file.\nNOTE: Please use either JWT File or JWT JSON parameter.\n", "multi": false, "required": false, "show_user": true }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "jwt_json", "type": "password", "title": "Jwt JSON", "description": "Raw contents of the JWT file. Useful when hosting a file along with the agent is not possible.\nNOTE: Please use either JWT File or JWT JSON parameter.\n", "multi": false, "required": false, "show_user": true }, { "name": "delegated_account", "type": "text", "title": "Delegated Account", "description": "Email of the admin user used to access the API.", "multi": false, "required": true, "show_user": true }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull events from Google Workspace. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "http_client_timeout", "type": "text", "title": "Http Client Timeout", "description": "Duration of the time limit on HTTP requests. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": true, "default": "60s" }, { "name": "user_key", "type": "text", "title": "User Key", "description": "Specifies the user key to fetch reports from.", "multi": false, "required": true, "show_user": true, "default": "all" }, { "name": "api_host", "type": "text", "title": "API Host.", "description": "The Google Workspace API Host. The path will be automatically set.", "multi": false, "required": true, "show_user": false, "default": "https://www.googleapis.com" } ], "title": "Collect access_transparency, admin, alert, context_aware_access, device, drive, gcp, groups, group_enterprise, login, rules, saml, token and user accounts logs (input: httpjson)", "description": "Collecting access_transparency, admin, alert, context_aware_access, device, drive, gcp, groups, group_enterprise, login, rules, saml, token and user accounts logs (input: httpjson)" }, { "type": "cel", "vars": [ { "name": "jwt_file", "type": "text", "title": "Jwt File", "description": "Specifies the path to the JWT credentials file.\nNOTE: Please use either JWT File or JWT JSON parameter.\n", "multi": false, "required": false, "show_user": true }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "jwt_json", "type": "password", "title": "Jwt JSON", "description": "Raw contents of the JWT file. Useful when hosting a file along with the agent is not possible.\nNOTE: Please use either JWT File or JWT JSON parameter.\n", "multi": false, "required": false, "show_user": true }, { "name": "delegated_account", "type": "text", "title": "Delegated Account", "description": "Email of the admin user used to access the API.", "multi": false, "required": true, "show_user": true }, { "name": "http_client_timeout", "type": "text", "title": "Http Client Timeout", "description": "Duration of the time limit on HTTP requests. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": true, "default": "60s" }, { "name": "user_key", "type": "text", "title": "User Key", "description": "Specifies the user key to fetch reports from.", "multi": false, "required": true, "show_user": true, "default": "all" }, { "name": "api_host", "type": "text", "title": "API Host.", "description": "The Google Workspace API Host. The path will be automatically set.", "multi": false, "required": true, "show_user": false, "default": "https://www.googleapis.com" } ], "title": "Collect Google Workspace Chrome logs via API", "description": "Collecting Google Workspace Chrome logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "google_workspace.access_transparency", "title": "Access Transparency logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-access_transparency" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.access_transparency fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "httpjson.yml.hbs", "title": "Access Transparency logs (httpjson)", "description": "Collect Access Transparency logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "access_transparency" }, { "type": "logs", "dataset": "google_workspace.admin", "title": "Admin logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-admin" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Admin logs (httpjson)", "description": "Collect admin logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "admin" }, { "type": "logs", "dataset": "google_workspace.alert", "title": "Collect Alert logs from Google Workspace", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "alert_center_api_host", "type": "text", "title": "Alert Center API Host", "description": "The Google Workspace Alert Center API Host. The path will be automatically set.", "multi": false, "required": true, "show_user": false, "default": "https://alertcenter.googleapis.com" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "page_size", "type": "text", "title": "Page Size", "description": "Page Size for the response of the Google Workspace API.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-alert" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve custom fields for all ECS mappings.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "httpjson.yml.hbs", "title": "Alert logs", "description": "Collect Alert logs using httpjson input from Google Workspace.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "alert" }, { "type": "logs", "dataset": "google_workspace.chrome", "title": "Google Workspace Chrome logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Google Workspace Chrome logs Google Workspace API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "text", "title": "Batch Size", "description": "Batch size for the response of the Google Workspace Chrome API. Maximum batch size can be 1000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-chrome" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.chrome fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "cel.yml.hbs", "title": "Google Workspace Chrome logs", "description": "Collecting Google Workspace Chrome logs via API.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "chrome" }, { "type": "logs", "dataset": "google_workspace.context_aware_access", "title": "Context Aware Access logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-context_aware_access" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.context_aware_access fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "httpjson.yml.hbs", "title": "Context Aware Access logs (httpjson)", "description": "Collect Context Aware Access logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "context_aware_access" }, { "type": "logs", "dataset": "google_workspace.device", "title": "Device logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-device" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.device fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "httpjson.yml.hbs", "title": "Device logs (httpjson)", "description": "Collect device logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "device" }, { "type": "logs", "dataset": "google_workspace.drive", "title": "Drive logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-drive" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Drive logs (httpjson)", "description": "Collect drive logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "drive" }, { "type": "logs", "dataset": "google_workspace.gcp", "title": "GCP logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-gcp" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.gcp fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "httpjson.yml.hbs", "title": "GCP logs (httpjson)", "description": "Collect GCP logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "gcp" }, { "type": "logs", "dataset": "google_workspace.group_enterprise", "title": "Group Enterprise logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-group_enterprise" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.group_enterprise fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "httpjson.yml.hbs", "title": "Group Enterprise logs (httpjson)", "description": "Collect group enterprise logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "group_enterprise" }, { "type": "logs", "dataset": "google_workspace.groups", "title": "Groups logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-groups" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Groups logs (httpjson)", "description": "Collect groups logs using httpjson input", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "groups" }, { "type": "logs", "dataset": "google_workspace.login", "title": "Login logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-login" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Login logs (httpjson)", "description": "Collect login logs using httpjson input", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "login" }, { "type": "logs", "dataset": "google_workspace.rules", "title": "Rules logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-rules" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.rules fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "httpjson.yml.hbs", "title": "Rules logs (httpjson)", "description": "Collect rules logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "rules" }, { "type": "logs", "dataset": "google_workspace.saml", "title": "SAML logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-saml" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "SAML logs (httpjson)", "description": "Collect SAML logs using httpjson input", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "saml" }, { "type": "logs", "dataset": "google_workspace.token", "title": "Token logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-token" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.token fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "httpjson.yml.hbs", "title": "Token logs (httpjson)", "description": "Collect token logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "token" }, { "type": "logs", "dataset": "google_workspace.user_accounts", "title": "User accounts logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-user_accounts" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "User accounts logs (httpjson)", "description": "Collect user accounts logs using httpjson input", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "user_accounts" } ] }