Skip to content

save_google_cloud_pubsub

Publishes to a Google Cloud Pub/Sub topic.

save_google_cloud_pubsub project_id=string, topic_id=string

The operator publishes bytes to a Google Cloud Pub/Sub topic.

The project to connect to. Note that this is the project_id, not the display name.

The topic to publish to.

The save_google_cloud_pubsub operator can also be used from the to operator. For this, the gcps:// scheme can be used. The URI is then translated:

to "gcps://my_project/my_topic"
save_google_cloud_pubsub project_id="my_project", topic_id="my_topic"

Publish suricata.alert events as JSON to alerts-topic:

export
where @name = "suricata.alert"
write_json
save_google_cloud_pubsub project_id="amazing-project-123456", topic_id="alerts-topic"

load_google_cloud_pubsub