This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
How are others ingesting Gmail logs into Chronicle?We've been sending
them directly to BQ and querying them there for months, but would love
to have the data available in Chronicle. AFAIK we can't access the logs
that are exported to BQ through an AP...
Hi NikhilIt looks like theres the following default log type and parser:
GCP_APP_ENGINE I'd try to get the app engine logs ingested through that
parser as a first step. How are you currently ingesting your data? EDIT
for clarity: When you say direct ...
Dan is 100% right about how you can fix it, however, I think thats the
wrong optimisation. If this is a bug in the default parser then you can
get it fixed for all of us by making a support ticket and walking them
through the issue.If you are referri...
One other thing that hasn't been mentioned: If you want to try out your
modified custom parser and are worried about downtime, you can just set
it up on any unused log label. You'll need to configure your logs to go
to both log labels, so if this is ...
The source of truth is always Chris Martin In an old blog post he
wrote the following:My ingestion_stats table's last modified date is Feb
6th (today is Feb 14th). I'm not sure *what* its still used for, but
best to rely on the metrics one I think.A...
You're probably better off going with the chronicle documentation where
possible. I'm not sure if the differences between logstash and chronicle
parser syntax are comprehensively documented somewhere, but there seem
to have been significant changes m...
