OpenObserve

To add an OpenObserve destination to Axoflow, complete the following steps.

Prerequisites

• An OpenObserve account for Axoflow, or
• a self-hosted OpenObserve deployment.
• To configure Axoflow, you’ll need the username, password, the name of your organization, and the name of the OpenObserve stream where you want to send your data.

Steps

1. Create a new destination.

   1. Open the Axoflow Console.
   2. Select Topology.
   3. Select + > Destination.

2. Configure the destination.

   1. Select OpenObserve.

   2. Enter a name for the destination.

      

   3. Enter your OpenObserve URL into the URL field, for example, https://api.openobserve.ai/api/

   4. Enter the name of the OpenObserve stream where you want to send your data, for example, your-example-stream.

   5. Enter the name and password for the account you want to use.

   6. (Optional)

      By default, Axoflow rejects connections to the destination server if the certificate of the server is invalid (for example, it’s expired, signed by an unknown CA, or its CN and the name of the server is mismatched).

      Warning When validating a certificate, the entire certificate chain must be valid, including the CA certificate. If any certificate of the chain is invalid, Axoflow will reject the connection.

      If you want to accept invalid certificates (or no certificate) from the destination servers, disable the Verify server certificate option.

   7. Select Create.

   8. The new destination appears on the Topology page.

      

3. Create a flow to connect the new destination to an AxoRouter instance.

   1. Select Flows.

   2. Select Create New Flow.

   3. Enter a name for the flow, for example, my-test-flow.

      

   4. In the Router Selector field, enter an expression that matches the router(s) you want to apply the flow. To select a specific router, use a name selector, for example, name = my-axorouter-hostname.

   5. Select the Destination where you want to send your data. If you don’t have any destination configured, see Destinations.

   6. (Optional) To process the data transferred in the flow, select Add New Processing Step. For details, see Processing steps. For example:

      1. Add a Reduce step to automatically remove redundant and empty fields from your data.
      2. To select which messages are processed by the flow, add a Select Messages step, and enter a filter into the Query field. For example, to select only the messages received from Fortinet Fortigate firewalls, use the meta.vendor = fortinet + meta.product = fortigate query.
      3. Save the processing steps.

      

   7. Select Create.

   8. The new flow appears in the Flows list.