1Password

You can send available logs from the 1Password API with Logzio API fetcher.

Pull Docker Image

Download the logzio-api-fetcher image:

docker pull logzio/logzio-api-fetcher

Configuration

Create a local config file config.yaml.

apis:
  - name: 1Password Audit Events
    type: 1password
    onepassword_bearer_token: <<1PASSWORD_BEARER_TOKEN>>
    url: https://events.1password.com/api/v1/auditevents
    method: POST
    days_back_fetch: 7
    scrape_interval: 5
    additional_fields:
      type: 1password

logzio:
  url: https://<<LISTENER-HOST>>:8071
  token: <<LOG-SHIPPING-TOKEN>>

note

You can customize the endpoints to collect data from by adding extra API configurations under apis.

1Password configuration options

Parameter Name	Description	Required/Optional	Default
name	Name of the API (custom name)	Optional	the defined url
onepassword_bearer_token	The 1Password Bearer token	Required	-
url	The request URL	Required	-
method	The request method (GET or POST)	Optional	GET
additional_fields	Additional custom fields to add to the logs before sending to logzio	Optional	-
days_back_fetch	The amount of days to fetch back in the first request. Applies a filter on 1password start_time parameter.	Optional	-
scrape_interval	Time interval to wait between runs (unit: minutes)	Optional	1 (minute)
onepassword_limit	1Password limit for number of events to return in a single request (allowed range: 100 to 1000)	Optional	100
pagination_off	True if builtin pagination should be off, False otherwise	Optional	False

Logzio output configuration options

Parameter Name	Description	Required/Optional	Default
url	The logzio Listener address (You can find the relevant <<LISTENER-HOST>> here.)	Optional	https://listener.logz.io:8071
token	The logzio shipping token	Required	-

Run The Docker Container

In the path where you saved your config.yaml, run:

docker run --name logzio-api-fetcher \
-v "$(pwd)":/app/src/shared \
logzio/logzio-api-fetcher 

note

To run in Debug mode add --level flag to the command:

docker run --name logzio-api-fetcher \
-v "$(pwd)":/app/src/shared \
logzio/logzio-api-fetcher \
--level DEBUG

Available Options: INFO, WARN, ERROR, DEBUG

Stopping the container

When you want to stop the container, to make sure it will finish the iteration on time, please give it a grace period of 30 seconds when you run the docker stop command:

docker stop -t 30 logzio-api-fetcher

Check Logz.io for your logs

Give your logs some time to get from your system to ours, and then open Open Search Dashboards. You can filter for data of your custom field type value or type 1password to see the incoming logs.