{ "name": "google_workspace", "title": "Google Workspace", "version": "3.3.3", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Collect logs from Google Workspace with Elastic Agent.", "type": "integration", "download": "/epr/google_workspace/google_workspace-3.3.3.zip", "path": "/package/google_workspace/3.3.3", "icons": [ { "src": "/img/logo.svg", "path": "/package/google_workspace/3.3.3/img/logo.svg", "title": "logo Google", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ~9.0.7 || ^9.1.4" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "productivity_security" ], "signature_path": "/epr/google_workspace/google_workspace-3.3.3.zip.sig", "format_version": "3.4.0", "readme": "/package/google_workspace/3.3.3/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/google_workspace-gmail-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google_workspace-gmail-screenshot.png", "title": "Google Workspace Gmail Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-keep-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-keep-screenshot.png", "title": "Google Workspace Keep Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-meet-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-meet-screenshot.png", "title": "Google Workspace Meet Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-vault-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-vault-screenshot.png", "title": "Google Workspace Vault Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-chat-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-chat-screenshot.png", "title": "Google Workspace Chat Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-calendar-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-calendar-screenshot.png", "title": "Google Workspace Calendar Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-data-studio-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-data-studio-screenshot.png", "title": "Google Workspace Data Studio Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-chrome-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-chrome-screenshot.png", "title": "Google Workspace Chrome Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-rules-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-rules-screenshot.png", "title": "Google Workspace Rules Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-alert-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-alert-screenshot.png", "title": "Google Workspace Alert Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-device-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-device-screenshot.png", "title": "Google Workspace Device Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-token-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-token-screenshot.png", "title": "Google Workspace Token Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-group-enterprise-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-group-enterprise-screenshot.png", "title": "Google Workspace Group Enterprise Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-access-transparency-and-gcp-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-access-transparency-and-gcp-screenshot.png", "title": "Google Workspace Access Transparency and GCP Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/google-workspace-context-aware-access-screenshot.png", "path": "/package/google_workspace/3.3.3/img/google-workspace-context-aware-access-screenshot.png", "title": "Google Workspace Context Aware Access Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/google_workspace/3.3.3/LICENSE.txt", "/package/google_workspace/3.3.3/changelog.yml", "/package/google_workspace/3.3.3/manifest.yml", "/package/google_workspace/3.3.3/validation.yml", "/package/google_workspace/3.3.3/docs/README.md", "/package/google_workspace/3.3.3/img/google-workspace-access-transparency-and-gcp-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-alert-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-calendar-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-chat-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-chrome-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-context-aware-access-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-data-studio-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-device-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-group-enterprise-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-keep-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-meet-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-rules-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-token-screenshot.png", "/package/google_workspace/3.3.3/img/google-workspace-vault-screenshot.png", "/package/google_workspace/3.3.3/img/google_workspace-gmail-screenshot.png", "/package/google_workspace/3.3.3/img/logo.svg", "/package/google_workspace/3.3.3/kibana/tags.yml", "/package/google_workspace/3.3.3/data_stream/access_transparency/manifest.yml", "/package/google_workspace/3.3.3/data_stream/access_transparency/sample_event.json", "/package/google_workspace/3.3.3/data_stream/admin/manifest.yml", "/package/google_workspace/3.3.3/data_stream/admin/sample_event.json", "/package/google_workspace/3.3.3/data_stream/alert/manifest.yml", "/package/google_workspace/3.3.3/data_stream/alert/sample_event.json", "/package/google_workspace/3.3.3/data_stream/calendar/manifest.yml", "/package/google_workspace/3.3.3/data_stream/calendar/sample_event.json", "/package/google_workspace/3.3.3/data_stream/chat/manifest.yml", "/package/google_workspace/3.3.3/data_stream/chat/sample_event.json", "/package/google_workspace/3.3.3/data_stream/chrome/manifest.yml", "/package/google_workspace/3.3.3/data_stream/chrome/sample_event.json", "/package/google_workspace/3.3.3/data_stream/context_aware_access/manifest.yml", "/package/google_workspace/3.3.3/data_stream/context_aware_access/sample_event.json", "/package/google_workspace/3.3.3/data_stream/data_studio/manifest.yml", "/package/google_workspace/3.3.3/data_stream/data_studio/sample_event.json", "/package/google_workspace/3.3.3/data_stream/device/manifest.yml", "/package/google_workspace/3.3.3/data_stream/device/sample_event.json", "/package/google_workspace/3.3.3/data_stream/drive/manifest.yml", "/package/google_workspace/3.3.3/data_stream/drive/sample_event.json", "/package/google_workspace/3.3.3/data_stream/gcp/manifest.yml", "/package/google_workspace/3.3.3/data_stream/gcp/sample_event.json", "/package/google_workspace/3.3.3/data_stream/gmail/manifest.yml", "/package/google_workspace/3.3.3/data_stream/gmail/sample_event.json", "/package/google_workspace/3.3.3/data_stream/group_enterprise/manifest.yml", "/package/google_workspace/3.3.3/data_stream/group_enterprise/sample_event.json", "/package/google_workspace/3.3.3/data_stream/groups/manifest.yml", "/package/google_workspace/3.3.3/data_stream/groups/sample_event.json", "/package/google_workspace/3.3.3/data_stream/keep/manifest.yml", "/package/google_workspace/3.3.3/data_stream/keep/sample_event.json", "/package/google_workspace/3.3.3/data_stream/login/manifest.yml", "/package/google_workspace/3.3.3/data_stream/login/sample_event.json", "/package/google_workspace/3.3.3/data_stream/meet/manifest.yml", "/package/google_workspace/3.3.3/data_stream/meet/sample_event.json", "/package/google_workspace/3.3.3/data_stream/rules/manifest.yml", "/package/google_workspace/3.3.3/data_stream/rules/sample_event.json", "/package/google_workspace/3.3.3/data_stream/saml/manifest.yml", "/package/google_workspace/3.3.3/data_stream/saml/sample_event.json", "/package/google_workspace/3.3.3/data_stream/token/manifest.yml", "/package/google_workspace/3.3.3/data_stream/token/sample_event.json", "/package/google_workspace/3.3.3/data_stream/user_accounts/manifest.yml", "/package/google_workspace/3.3.3/data_stream/user_accounts/sample_event.json", "/package/google_workspace/3.3.3/data_stream/vault/manifest.yml", "/package/google_workspace/3.3.3/data_stream/vault/sample_event.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-0a2bcebc-a1ca-42b6-bb04-6206d8885eec.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-11cad61d-9f39-4934-bd77-5555586a0a07.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-26c10e40-8cbc-11ed-add3-0fec96545f1c.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-2a8ee7bc-4398-4d4f-ad0a-abb9de3520a8.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-3be0b490-3430-11ed-9f31-c9178ccae8cd.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-3fb94480-8cbc-11ed-add3-0fec96545f1c.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-4c5a4cc0-8cbc-11ed-add3-0fec96545f1c.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-7b55f304-7a6b-4131-bc36-591e35732394.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-8925d900-3b43-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-8fb2feb0-097a-4530-82a7-f258d6830297.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-a99b1683-7bb5-4147-9a8c-3b7dfcaf6735.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-b13d4e0d-c6c7-4a2b-967f-4d87459e0bd1.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-ca3ff140-3b3f-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-cc67d7a7-7606-4f9b-8a92-1594886558d2.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-d3cf6d50-3bfb-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-d6287d50-0107-11ed-825d-df764a9c0c57.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-d79f1730-9585-11ed-82ba-c3ec829933e4.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-e9a62e70-9583-11ed-82ba-c3ec829933e4.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-ec193fd0-3ab6-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-f163f270-3b13-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/dashboard/google_workspace-f8210e80-3b28-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-10b37c00-3c03-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-1cac9ed0-3b2f-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-2c0d5bc0-3b0d-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-2c40f770-3b24-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-36dc0c42-4dc3-4df6-8b2a-2ee29f0d22fd.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-3ceeeba0-3c04-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-676e6980-3bfc-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-7437b9cc-b1d4-4a1e-9e12-3817f54292f6.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-7ab25b80-3b13-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-8817b016-61c1-4d10-bdc2-e30e9fd93d4c.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-8e8f98d0-3c02-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-8ec40930-0110-11ed-825d-df764a9c0c57.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-b95cf166-2f93-42c0-bf69-6ce3e2309a5b.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-c3960ae0-9586-11ed-82ba-c3ec829933e4.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-d542c8e0-3bfa-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-e013b790-010b-11ed-825d-df764a9c0c57.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-e3d44490-3bfc-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/kibana/search/google_workspace-ebb44680-3bf5-11ed-8bdd-f5c5df6c1370.json", "/package/google_workspace/3.3.3/data_stream/access_transparency/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/access_transparency/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/access_transparency/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/access_transparency/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/admin/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/admin/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/admin/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/admin/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/alert/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/alert/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/alert/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/calendar/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/calendar/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/calendar/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/calendar/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/chat/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/chat/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/chat/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/chat/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/chrome/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/chrome/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/chrome/fields/ecs.yml", "/package/google_workspace/3.3.3/data_stream/chrome/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/context_aware_access/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/context_aware_access/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/context_aware_access/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/context_aware_access/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/data_studio/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/data_studio/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/data_studio/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/data_studio/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/device/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/device/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/device/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/device/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/drive/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/drive/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/drive/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/drive/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/gcp/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/gcp/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/gcp/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/gcp/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/gmail/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/gmail/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/gmail/fields/ecs.yml", "/package/google_workspace/3.3.3/data_stream/gmail/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/group_enterprise/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/group_enterprise/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/group_enterprise/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/group_enterprise/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/groups/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/groups/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/groups/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/groups/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/keep/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/keep/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/keep/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/keep/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/login/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/login/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/login/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/login/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/meet/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/meet/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/meet/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/meet/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/rules/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/rules/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/rules/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/rules/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/saml/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/saml/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/saml/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/saml/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/token/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/token/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/token/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/token/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/user_accounts/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/user_accounts/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/user_accounts/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/vault/fields/base-fields.yml", "/package/google_workspace/3.3.3/data_stream/vault/fields/beats.yml", "/package/google_workspace/3.3.3/data_stream/vault/fields/fields.yml", "/package/google_workspace/3.3.3/data_stream/vault/fields/package-fields.yml", "/package/google_workspace/3.3.3/data_stream/access_transparency/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/access_transparency/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/admin/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/admin/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/alert/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/alert/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/calendar/agent/stream/cel.yml.hbs", "/package/google_workspace/3.3.3/data_stream/calendar/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/chat/agent/stream/cel.yml.hbs", "/package/google_workspace/3.3.3/data_stream/chat/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/chrome/agent/stream/cel.yml.hbs", "/package/google_workspace/3.3.3/data_stream/chrome/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/context_aware_access/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/data_studio/agent/stream/cel.yml.hbs", "/package/google_workspace/3.3.3/data_stream/data_studio/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/device/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/device/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/drive/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/drive/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/gcp/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/gmail/agent/stream/cel.yml.hbs", "/package/google_workspace/3.3.3/data_stream/gmail/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/group_enterprise/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/groups/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/groups/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/keep/agent/stream/cel.yml.hbs", "/package/google_workspace/3.3.3/data_stream/keep/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/login/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/login/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/meet/agent/stream/cel.yml.hbs", "/package/google_workspace/3.3.3/data_stream/meet/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/rules/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/rules/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/saml/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/saml/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/token/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/token/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/user_accounts/agent/stream/httpjson.yml.hbs", "/package/google_workspace/3.3.3/data_stream/user_accounts/elasticsearch/ingest_pipeline/default.yml", "/package/google_workspace/3.3.3/data_stream/vault/agent/stream/cel.yml.hbs", "/package/google_workspace/3.3.3/data_stream/vault/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "google_workspace", "title": "Google Workspace logs", "description": "Collect logs from Google Workspace APIs", "inputs": [ { "type": "httpjson", "vars": [ { "name": "jwt_file", "type": "text", "title": "Jwt File", "description": "Specifies the path to the JWT credentials file.\nNOTE: Please use either JWT File or JWT JSON parameter.\n", "multi": false, "required": false, "show_user": true }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "jwt_json", "type": "password", "title": "Jwt JSON", "description": "Raw contents of the JWT file. Useful when hosting a file along with the agent is not possible.\nNOTE: Please use either JWT File or JWT JSON parameter.\n", "multi": false, "required": false, "show_user": true }, { "name": "delegated_account", "type": "text", "title": "Delegated Account", "description": "Email of the admin user used to access the API.", "multi": false, "required": true, "show_user": true }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull events from Google Workspace. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "http_client_timeout", "type": "text", "title": "Http Client Timeout", "description": "Duration of the time limit on HTTP requests. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": true, "default": "60s" }, { "name": "user_key", "type": "text", "title": "User Key", "description": "Specifies the user key to fetch reports from.", "multi": false, "required": true, "show_user": true, "default": "all" }, { "name": "api_host", "type": "text", "title": "API Host.", "description": "The Google Workspace API Host. The path will be automatically set.", "multi": false, "required": true, "show_user": false, "default": "https://www.googleapis.com" } ], "title": "Collect access_transparency, admin, alert, context_aware_access, device, drive, gcp, groups, group_enterprise, login, rules, saml, token and user accounts logs (input: httpjson)", "description": "Collecting access_transparency, admin, alert, context_aware_access, device, drive, gcp, groups, group_enterprise, login, rules, saml, token and user accounts logs (input: httpjson)" }, { "type": "cel", "vars": [ { "name": "jwt_file", "type": "text", "title": "Jwt File", "description": "Specifies the path to the JWT credentials file.\nNOTE: Please use either JWT File or JWT JSON parameter.\n", "multi": false, "required": false, "show_user": true }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "jwt_json", "type": "password", "title": "Jwt JSON", "description": "Raw contents of the JWT file. Useful when hosting a file along with the agent is not possible.\nNOTE: Please use either JWT File or JWT JSON parameter.\n", "multi": false, "required": false, "show_user": true }, { "name": "delegated_account", "type": "text", "title": "Delegated Account", "description": "Email of the admin user used to access the API.", "multi": false, "required": true, "show_user": true }, { "name": "http_client_timeout", "type": "text", "title": "Http Client Timeout", "description": "Duration of the time limit on HTTP requests. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": true, "default": "60s" }, { "name": "user_key", "type": "text", "title": "User Key", "description": "Specifies the user key to fetch reports from.", "multi": false, "required": true, "show_user": true, "default": "all" }, { "name": "api_host", "type": "text", "title": "API Host.", "description": "The Google Workspace API Host. The path will be automatically set.", "multi": false, "required": true, "show_user": false, "default": "https://www.googleapis.com" } ], "title": "Collect Google Workspace Chrome logs via API", "description": "Collecting Google Workspace Chrome logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "google_workspace.access_transparency", "title": "Access Transparency logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-access_transparency" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.access_transparency fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "access_transparency" } ], "template_path": "httpjson.yml.hbs", "title": "Access Transparency logs (httpjson)", "description": "Collect Access Transparency logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "access_transparency" }, { "type": "logs", "dataset": "google_workspace.admin", "title": "Admin logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-admin" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "admin" } ], "template_path": "httpjson.yml.hbs", "title": "Admin logs (httpjson)", "description": "Collect admin logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "admin" }, { "type": "logs", "dataset": "google_workspace.alert", "title": "Collect Alert logs from Google Workspace", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "alert_center_api_host", "type": "text", "title": "Alert Center API Host", "description": "The Google Workspace Alert Center API Host. The path will be automatically set.", "multi": false, "required": true, "show_user": false, "default": "https://alertcenter.googleapis.com" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "page_size", "type": "integer", "title": "Page Size", "description": "Page Size for the response of the Google Workspace API.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Google Workspace defaults to a 2 hour polling interval because Google reports can go from some minutes up to 3 days of delay. For more details on this, you can read more at https://support.google.com/a/answer/7061566. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-alert" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve custom fields for all ECS mappings.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "httpjson.yml.hbs", "title": "Alert logs", "description": "Collect Alert logs using httpjson input from Google Workspace.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "alert" }, { "type": "logs", "dataset": "google_workspace.calendar", "title": "Google Workspace Calendar logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Google Workspace Calendar logs Google Workspace Reporting API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Google Workspace Reporting API. Maximum batch size can be 1000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-calendar" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.calendar fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL Config for the host i.e. certificate_authorities, supported_protocols, verification_mode etc.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "calendar" } ], "template_path": "cel.yml.hbs", "title": "Google Workspace Calendar logs", "description": "Collecting Google Workspace Calendar logs via API.", "enabled": false, "ingestion_method": "API" } ], "package": "google_workspace", "path": "calendar" }, { "type": "logs", "dataset": "google_workspace.chat", "title": "Google Workspace Chat logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Google Workspace Chat logs Google Workspace Reporting API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Google Workspace Reporting API. Maximum batch size can be 1000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-chat" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.chat fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "chat" } ], "template_path": "cel.yml.hbs", "title": "Google Workspace Chat logs", "description": "Collecting Google Workspace Chat logs via API.", "enabled": false, "ingestion_method": "API" } ], "package": "google_workspace", "path": "chat" }, { "type": "logs", "dataset": "google_workspace.chrome", "title": "Google Workspace Chrome logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Google Workspace Chrome logs Google Workspace API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Google Workspace Chrome API. Maximum batch size can be 1000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-chrome" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.chrome fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "chrome" } ], "template_path": "cel.yml.hbs", "title": "Google Workspace Chrome logs", "description": "Collecting Google Workspace Chrome logs via API.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "chrome" }, { "type": "logs", "dataset": "google_workspace.context_aware_access", "title": "Context Aware Access logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-context_aware_access" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.context_aware_access fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "context_aware_access" } ], "template_path": "httpjson.yml.hbs", "title": "Context Aware Access logs (httpjson)", "description": "Collect Context Aware Access logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "context_aware_access" }, { "type": "logs", "dataset": "google_workspace.data_studio", "title": "Google Workspace Data Studio logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Google Workspace Data Studio logs Google Workspace Reporting API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Google Workspace Reporting API. Maximum batch size can be 1000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-data_studio" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.data_studio fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL Config for the host i.e. certificate_authorities, supported_protocols, verification_mode etc.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "data_studio" } ], "template_path": "cel.yml.hbs", "title": "Google Workspace Data Studio logs", "description": "Collecting Google Workspace Data Studio logs via API.", "enabled": false, "ingestion_method": "API" } ], "package": "google_workspace", "path": "data_studio" }, { "type": "logs", "dataset": "google_workspace.device", "title": "Device logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-device" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.device fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "mobile" } ], "template_path": "httpjson.yml.hbs", "title": "Device logs (httpjson)", "description": "Collect device logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "device" }, { "type": "logs", "dataset": "google_workspace.drive", "title": "Drive logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-drive" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "drive" } ], "template_path": "httpjson.yml.hbs", "title": "Drive logs (httpjson)", "description": "Collect drive logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "drive" }, { "type": "logs", "dataset": "google_workspace.gcp", "title": "GCP logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-gcp" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.gcp fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "gcp" } ], "template_path": "httpjson.yml.hbs", "title": "GCP logs (httpjson)", "description": "Collect GCP logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "gcp" }, { "type": "logs", "dataset": "google_workspace.gmail", "title": "Google Workspace Gmail logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to query the Google Workspace Gmail logs from BigQuery. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "60m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "job_status_timeout", "type": "text", "title": "Job Status Timeout", "description": "Duration to wait for the BigQuery job to complete before it is cancelled via API. Increase this value if the job requires more time. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "30m" }, { "name": "resource_rate_limit_limit", "type": "text", "title": "Resource Rate Limit", "description": "The value of the response that specifies the maximum overall resource request rate. This controls the polling frequency.", "multi": false, "required": true, "show_user": false, "default": "0.2" }, { "name": "resource_rate_limit_burst", "type": "integer", "title": "Resource Rate Limit Burst", "description": "The maximum burst size. Burst is the maximum number of resource requests that can be made above the overall rate limit.", "multi": false, "required": true, "show_user": false, "default": 5 }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "The maximum number of rows of data to return per page of results. Responses are also limited to 10 MB. By default, there is no maximum row count, and only the byte limit applies.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "bigquery_endpoint", "type": "text", "title": "BigQuery API Host.", "description": "The BigQuery API host. The path will automatically be set.", "multi": false, "required": true, "show_user": false, "default": "https://bigquery.googleapis.com" }, { "name": "project_id", "type": "text", "title": "GCP Project ID", "description": "The Google Cloud Platform Project ID of project that has enabled export Gmail Logs.", "multi": false, "required": true, "show_user": true }, { "name": "dataset_name", "type": "text", "title": "Dataset Name", "description": "BigQuery dataset name.", "multi": false, "required": true, "show_user": true }, { "name": "location", "type": "text", "title": "Location", "description": "The geographic location of the job, defaults to `US`. For more details on BigQuery locations, see the [documentation](https://cloud.google.com/bigquery/docs/locations).", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-gmail" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.gmail fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "cel.yml.hbs", "title": "Google Workspace Gmail logs", "description": "Collecting Google Workspace Gmail logs via BigQuery API.", "enabled": false, "ingestion_method": "API" } ], "package": "google_workspace", "path": "gmail" }, { "type": "logs", "dataset": "google_workspace.group_enterprise", "title": "Group Enterprise logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-group_enterprise" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.group_enterprise fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "groups_enterprise" } ], "template_path": "httpjson.yml.hbs", "title": "Group Enterprise logs (httpjson)", "description": "Collect group enterprise logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "group_enterprise" }, { "type": "logs", "dataset": "google_workspace.groups", "title": "Groups logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-groups" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "groups" } ], "template_path": "httpjson.yml.hbs", "title": "Groups logs (httpjson)", "description": "Collect groups logs using httpjson input", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "groups" }, { "type": "logs", "dataset": "google_workspace.keep", "title": "Google Workspace Keep logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Google Workspace Keep logs Google Workspace Reporting API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Google Workspace Reporting API. Maximum batch size can be 1000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-keep" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.keep fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "keep" } ], "template_path": "cel.yml.hbs", "title": "Google Workspace Keep logs", "description": "Collecting Google Workspace Keep logs via API.", "enabled": false, "ingestion_method": "API" } ], "package": "google_workspace", "path": "keep" }, { "type": "logs", "dataset": "google_workspace.login", "title": "Login logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-login" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "login" } ], "template_path": "httpjson.yml.hbs", "title": "Login logs (httpjson)", "description": "Collect login logs using httpjson input", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "login" }, { "type": "logs", "dataset": "google_workspace.meet", "title": "Google Workspace Meet logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Google Workspace Meet logs Google Workspace Reporting API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Google Workspace Reporting API. Maximum batch size can be 1000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-meet" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.meet fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "meet" } ], "template_path": "cel.yml.hbs", "title": "Google Workspace Meet logs", "description": "Collecting Google Workspace Meet logs via API.", "enabled": false, "ingestion_method": "API" } ], "package": "google_workspace", "path": "meet" }, { "type": "logs", "dataset": "google_workspace.rules", "title": "Rules logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-rules" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.rules fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "rules" } ], "template_path": "httpjson.yml.hbs", "title": "Rules logs (httpjson)", "description": "Collect rules logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "rules" }, { "type": "logs", "dataset": "google_workspace.saml", "title": "SAML logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-saml" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "saml" } ], "template_path": "httpjson.yml.hbs", "title": "SAML logs (httpjson)", "description": "Collect SAML logs using httpjson input", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "saml" }, { "type": "logs", "dataset": "google_workspace.token", "title": "Token logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-token" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.token fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "token" } ], "template_path": "httpjson.yml.hbs", "title": "Token logs (httpjson)", "description": "Collect token logs using httpjson input.", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "token" }, { "type": "logs", "dataset": "google_workspace.user_accounts", "title": "User accounts logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-user_accounts" ] }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "user_accounts" } ], "template_path": "httpjson.yml.hbs", "title": "User accounts logs (httpjson)", "description": "Collect user accounts logs using httpjson input", "enabled": true, "ingestion_method": "API" } ], "package": "google_workspace", "path": "user_accounts" }, { "type": "logs", "dataset": "google_workspace.vault", "title": "Google Workspace Vault logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Google Workspace Vault logs Google Workspace Reporting API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the API. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "lag_time", "type": "text", "title": "Lag Time", "description": "The lag time allowed for when fetching this report. Lag times vary by report, and go up to a few hours. There are more details in the [Google Workspace Admin documentation](https://support.google.com/a/answer/7061566). NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "3m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Google Workspace Reporting API. Maximum batch size can be 1000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags for the data-stream.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "google_workspace-vault" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve google_workspace.vault fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "application_name_for_url", "type": "text", "title": "Application Name for the URL", "description": "Do not modify. The application name used to build the endpoint URL.", "multi": false, "required": true, "show_user": false, "default": "vault" } ], "template_path": "cel.yml.hbs", "title": "Google Workspace Vault logs", "description": "Collecting Google Workspace Vault logs via API.", "enabled": false, "ingestion_method": "API" } ], "package": "google_workspace", "path": "vault" } ] }