> For the complete documentation index, see [llms.txt](https://docs.fluentbit.io/manual/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fluentbit.io/manual/4.1/data-pipeline/outputs/chronicle.md).

# Google Chronicle

The *Google Chronicle* output plugin lets you ingest security logs into the [Google Chronicle](https://chronicle.security/) service. This connector is designed to send unstructured security logs.

## Google Cloud configuration

Fluent Bit streams data into an existing Google Chronicle tenant using a service account that you specify. Before using the Chronicle output plugin, you must:

1. Create a service account.

   To stream security logs into Google Chronicle, create a [Google Cloud service account](https://cloud.google.com/iam/docs/creating-managing-service-accounts) for Fluent Bit:
2. Create a tenant of Google Chronicle.

   Fluent Bit doesn't create a tenant of Google Chronicle for your security logs, so you must create this ahead of time.
3. Retrieve service account credentials.

   The Fluent Bit Chronicle output plugin uses a JSON credentials file for authentication credentials. Download the credentials file by following the instructions for [Creating and Managing Service Account Keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys).

## Configurations parameters

| Key                          | Description                                                                                                                                                                              | Default                                                         |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| `google_service_credentials` | Absolute path to a Google Cloud credentials JSON file.                                                                                                                                   | Value of the environment variable `$GOOGLE_SERVICE_CREDENTIALS` |
| `service_account_email`      | Account email associated with the service. Only available if no credentials file has been provided.                                                                                      | Value of environment variable `$SERVICE_ACCOUNT_EMAIL`          |
| `service_account_secret`     | Private key content associated with the service account. Only available if no credentials file has been provided.                                                                        | Value of environment variable `$SERVICE_ACCOUNT_SECRET`         |
| `project_id`                 | The project id containing the tenant of Google Chronicle to stream into.                                                                                                                 | The value of the `project_id` in the credentials file           |
| `customer_id`                | The customer id to identify the tenant of Google Chronicle to stream into. The value of the `customer_id` should be specified in the configuration file.                                 | *none*                                                          |
| `log_type`                   | The log type to parse logs as. Google Chronicle supports parsing for [specific log types only](https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers). | *none*                                                          |
| `region`                     | The GCP region in which to store security logs. Supported regions: `US`, `EU`, `UK`, `ASIA`. Blank is handled as `US`.                                                                   | *none*                                                          |
| `log_key`                    | By default, the whole log record will be sent to Google Chronicle. If you specify a key name with this option, then only the value of that key will be sent to Google Chronicle.         | *none*                                                          |
| `workers`                    | The number of [workers](/manual/4.1/administration/multithreading.md#outputs) to perform flush operations for this output.                                                               | `0`                                                             |

See Google's [official documentation](https://cloud.google.com/chronicle/docs/reference/ingestion-api) for further details.

## Configuration file

If you are using a Google Cloud credentials file, the following configuration will get you started:

{% tabs %}
{% tab title="fluent-bit.yaml" %}

```yaml
pipeline:
  inputs:
    - name: dummy
      tag: dummy

  outputs:
    - name: chronicle
      match: '*'
      customer_id: my_customer_id
      log_type: my_super_awesome_type
```

{% endtab %}

{% tab title="fluent-bit.conf" %}

```
[INPUT]
  Name dummy
  Tag  dummy

[OUTPUT]
  Name         chronicle
  Match        *
  customer_id  my_customer_id
  log_type     my_super_awesome_type
```

{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.fluentbit.io/manual/4.1/data-pipeline/outputs/chronicle.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.