About ion_

ion_

How are others ingesting Gmail logs into Chronicle?We've been sending them directly to BQ and querying them there for months, but would love to have the data available in Chronicle. AFAIK we can't access the logs that are exported to BQ through an AP...

ion_

Hi NikhilIt looks like theres the following default log type and parser: GCP_APP_ENGINE I'd try to get the app engine logs ingested through that parser as a first step. How are you currently ingesting your data? EDIT for clarity: When you say direct ...

ion_

Dan is 100% right about how you can fix it, however, I think thats the wrong optimisation. If this is a bug in the default parser then you can get it fixed for all of us by making a support ticket and walking them through the issue.If you are referri...

ion_

One other thing that hasn't been mentioned: If you want to try out your modified custom parser and are worried about downtime, you can just set it up on any unused log label. You'll need to configure your logs to go to both log labels, so if this is ...

ion_ · 02-14-2024

The source of truth is always Chris Martin In an old blog post he wrote the following:My ingestion_stats table's last modified date is Feb 6th (today is Feb 14th). I'm not sure *what* its still used for, but best to rely on the metrics one I think.A...

ion_ · 01-30-2024

You're probably better off going with the chronicle documentation where possible. I'm not sure if the differences between logstash and chronicle parser syntax are comprehensively documented somewhere, but there seem to have been significant changes m...

My Stats

ion_'s Bio

Badges ion_ Earned

Recent Activity

GMAIL Log Ingestion

Re: Needhelp with yara rule to find the users who are accessing the website which is hosted in AppEn

Re: Parser extension Multiple Raw field to same UDM Field

Re: Parser extension vs. modify parser ?

Re: Info: Clarification needed - Dashboard Ingestion metrics

Re: mutate filter - copy function