Google Cloud Pub/Sub (om_googlepubsub)

Google Cloud Pub/Sub is a service that allows event producers to deliver events to subscribers asynchronously. It is commonly used for data streaming, real-time event distribution, or as a message queue for parallel workflows.

This module uses the Google Pub/Sub REST API to publish logs to a Google Pub/Sub topic.

To examine the supported platforms, see the list of installer packages in the Available Modules chapter.

Configuring a Google Cloud service account

om_googlelogging requires a Google Cloud service account and a corresponding private key file in JSON format to connect to the Cloud Logging API. Follow these instructions to create a new service account and download its private key file for an existing project.

Log in to your Google Cloud account and switch to the project you want to configure.
From the navigation menu, click on IAM & Admin > Service Accounts.
Click CREATE SERVICE ACCOUNT.
Enter a service account name and description and click CREATE AND CONTINUE.
Select the Owner role from the Role drop-down and click DONE.
Click on the newly created account on the Service accounts page to open its configuration page.
Click the KEYS tab, expand the ADD KEY drop-down and select Create new key.
Select JSON for the key type and click CREATE to download the private key. Save the private key file to a location accessible by NXLog. This file is required for the NXLog configuration.

Configuration

The om_googlepubsub module accepts the following directives in addition to the common module directives. The CredentialsFile and Topic directives are required.

CredentialsFile: This mandatory directive specifies the path to the private key file of the service account required for authenticating with the Google Pub/Sub. See Configuring a Google Cloud service account for more information.

Topic: This mandatory directive specifies the name of the topic which will publish the messages. The format is projects/{project}/topics/{topic}.

Attributes

A list of key-value pairs for providing event metadata.

<Attributes>
    zone    us-central
</Attributes>

CADir

This directive specifies a path to a directory containing certificate authority (CA) certificates. These certificates will be used to verify the certificate presented by the remote server. The certificate files must be named using the OpenSSL hashed format, i.e. the hash of the certificate followed by .0, .1 etc. To find the hash of a certificate using OpenSSL:

$ openssl x509 -hash -noout -in ca.crt

For example, if the certificate hash is e2f14e4a, then the certificate filename should be e2f14e4a.0. If there is another certificate with the same hash then it should be named e2f14e4a.1 and so on.

A remote server’s self-signed certificate (which is not signed by a CA) can also be trusted by including a copy of the certificate in this directory.

The default operating system root certificate store will be used if this directive is not specified. Unix-like operating systems commonly store root certificates in /etc/ssl/certs. Windows operating systems use the Windows Certificate Store, while macOS uses the Keychain Access Application as the default certificate store. See NXLog TLS/SSL configuration in the User Guide for more information on using this directive.

Connections: Number of allowed parallel HTTP connections. The default is 1.

OutputRequestSize: Maximum size of the request in bytes. The default is 65 KB.

URL: Optional directive for specifying a region-specific URL. The default is https://pubsub.googleapis.com.

Reconnect: This optional directive sets the reconnect interval in seconds. If it is set, the module attempts to reconnect in every defined second. If it is not set, the reconnect interval will start at 1 second and doubles on every attempt. If the duration of the successful connection is greater than the current reconnect interval, then the reconnect interval will be reset to 1 sec.

Examples

Example 1. Forwarding logs to Google Pub/Sub

This configuration uses the om_googlepubsub output module to publish logs to the test topic of the Google Cloud project myproject.

<Output google_pubsub>
    Module             om_googlepubsub
    CredentialsFile    /path/to/credentials.json (1)
    Topic              projects/myproject-343509/topics/test
    <Attributes> (2)
        zone   us-central 
    </Attributes>
</Output>

1	Credentials file for authenticating with the Google Pub/Sub. See Configuring a Google Cloud service account for more information.
2	List of labels defined as key-value pairs to attach to the event.