Sources
Sources provide matching rules for sender ip addresses. Sources can specify a single IP, a range of IP addresses or a list of IP addresses. A source definition can specify one or more of single IP, range of IP addresses or a list of IP addresses. In this case the source condition evaluates true if any of these source definitions are a match.
1
sources:
2
-
3
name: localhost
4
ipv4: 127.0.0.1
5
-
6
name: 3164_ip_1
7
ipv4: 192.168.55.20
8
-
9
name: 3164_ip_2
10
ipv4: 192.168.55.21
11
-
12
name: qa_lab
13
ipv4: 192.168.40.3
14
ipv4_range: 10.0.1.5/24
15
ipv4_list: 192.168.1.1, 192.168.1.10
Copied!
Sources are defined with the "sources" keyword in the config file. All source definitions must have a "name". Sources are referred in rules using their name. The config file validator will flag an error for names that are not found and or source definitions that have a missing name.

name [required]

This key is used to specify a unique name for source matching rules.
1
-
2
name: qa_lab
3
ipv4_list: 192.168.1.1, 192.168.1.10
Copied!
The source matching conditions are referenced in message rules using their names
1
rules:
2
-
3
source: localhost
4
destination: t_debug
Copied!

Client IP/Network details [optional]

At least one of ipv4, ipv4_list and ipv4_range is required when selecting a Client IP/Network based source

ipv4 - Specify a single ip address

1
sources:
2
-
3
name: qa_lab_dns
4
ipv4: 192.168.4.21
Copied!

ipv4_list - Specify a list of ip addresses

An IP address list is specified by individual ip addresses separated by commas. Note that in the "ipv4_list" keyword, only individual ip addresses are allowed and not CIDR ranges.
1
sources:
2
-
3
name: qa_lab
4
ipv4_list: 192.168.1.1, 192.168.1.10
Copied!

ipv4_range - Specify a range of ip addresses

The IP address range is specified using the CIDR notation. E.g. 10.0.1.5/24 represents a range of ip's starting from 10.0.1.0 - 10.0.1.255 or a total of 256 addresses.
1
sources:
2
-
3
name: qa_lab
4
ipv4_range: 10.0.1.5/24
Copied!

Cloud S3 storage buckets

Stackdriver logs from GCP cloud storage

LOGIQ can directly ingest from Stackdriver's Google cloud storage sink. You do not need to incur additional pub sub costs for this. Create a google_cloud_storage source in LOGIQ config for this.
1
-
2
name: stackdriver_gcp_storage_bucket
3
s3:
4
type: google_cloud_storage
5
credential: >
6
{
7
"type": "service_account",
8
"project_id": <google_project_id>,
9
"private_key_id": <private_key_id>,
10
"private_key": <private_key_string>,
11
"client_email": <client_email>,
12
"client_id": <client_id>,
13
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
14
"token_uri": "https://oauth2.googleapis.com/token",
15
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
16
"client_x509_cert_url": <client cert url>
17
}
18
bucket: <cloud storage bucket name>
Copied!
Last modified 1yr ago