Skip to main content

1Password

You can send available logs from the 1Password API with Logzio API fetcher.

Pull Docker Image

Download the logzio-api-fetcher image:

docker pull logzio/logzio-api-fetcher

Configuration

Create a local config file config.yaml.

apis:
- name: 1Password Audit Events
type: 1password
onepassword_bearer_token: <<1PASSWORD_BEARER_TOKEN>>
url: https://events.1password.com/api/v1/auditevents
method: POST
days_back_fetch: 7
scrape_interval: 5
additional_fields:
type: 1password

logzio:
url: https://<<LISTENER-HOST>>:8071
token: <<LOG-SHIPPING-TOKEN>>
note

You can customize the endpoints to collect data from by adding extra API configurations under apis.

1Password configuration options

Parameter NameDescriptionRequired/OptionalDefault
nameName of the API (custom name)Optionalthe defined url
onepassword_bearer_tokenThe 1Password Bearer tokenRequired-
urlThe request URLRequired-
methodThe request method (GET or POST)OptionalGET
additional_fieldsAdditional custom fields to add to the logs before sending to logzioOptional-
days_back_fetchThe amount of days to fetch back in the first request. Applies a filter on 1password start_time parameter.Optional-
scrape_intervalTime interval to wait between runs (unit: minutes)Optional1 (minute)
onepassword_limit1Password limit for number of events to return in a single request (allowed range: 100 to 1000)Optional100
pagination_offTrue if builtin pagination should be off, False otherwiseOptionalFalse

Logzio output configuration options

Parameter NameDescriptionRequired/OptionalDefault
urlThe logzio Listener address (You can find the relevant <<LISTENER-HOST>> here.)Optionalhttps://listener.logz.io:8071
tokenThe logzio shipping tokenRequired-

Run The Docker Container

In the path where you saved your config.yaml, run:

docker run --name logzio-api-fetcher \
-v "$(pwd)":/app/src/shared \
logzio/logzio-api-fetcher
note

To run in Debug mode add --level flag to the command:

docker run --name logzio-api-fetcher \
-v "$(pwd)":/app/src/shared \
logzio/logzio-api-fetcher \
--level DEBUG

Available Options: INFO, WARN, ERROR, DEBUG

Stopping the container

When you want to stop the container, to make sure it will finish the iteration on time, please give it a grace period of 30 seconds when you run the docker stop command:

docker stop -t 30 logzio-api-fetcher

Check Logz.io for your logs

Give your logs some time to get from your system to ours, and then open Open Search Dashboards. You can filter for data of your custom field type value or type 1password to see the incoming logs.