OVHcloud Logs Data Platform

SIEM Platform

Synopsis

The OVHcloud target forwards events, formatted as GELF, to the OVHcloud Logs Data Platform GELF input over TLS, TCP, UDP, or HTTPS. It handles GELF wire framing for the chosen transport — the event payload is expected to already be a complete GELF JSON document when it reaches the target.

Schema

- name: <string>
  description: <string>
  type: ovhcloud
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    protocol: <string>
    max_message_size: <numeric>
    url: <string>
    timeout: <numeric>
    tls:
      verify: <boolean>
      server_name: <string>
      ca_name: <string>
      cert_name: <string>
      key_name: <string>
      passphrase: <string>
      min_tls_version: <string>
      max_tls_version: <string>
    field_format: <string>
    debug:
      status: <boolean>
      dont_send_logs: <boolean>

Configuration

The following fields are used to define the target:

Field	Required	Default	Description
name	Y		Target name
description	N	-	Optional description
type	Y		Must be ovhcloud
pipelines	N	-	Optional post-processor pipelines
status	N	true	Enable/disable the target

Connection

Field	Required	Default	Description
address	Y*	-	OVHcloud Logs Data Platform GELF endpoint, for example gra1.logs.ovh.com. Required for the tls, tcp, and udp transports
port	N	12202	GELF+TLS input port
protocol	N	tls	Transport: tls (recommended, required by OVHcloud LDP) | tcp | udp (chunked) | https
max_message_size	N	8192	UDP only: payload bytes per chunk before GELF chunking. 0 sends a single datagram. Ignored for tls/tcp/https
url	N*	built as scheme://address:port/gelf	https only: explicit endpoint override
timeout	N	30	Connection/write timeout in seconds. Bounds the stream dial and write deadline for tls/tcp/udp, and the HTTP client timeout for https

* = Conditionally required. address is required for tls, tcp, and udp; for https, either address (with port) or an explicit url must be supplied.

TLS

Field	Required	Default	Description
tls.verify	N	true	Verify the server certificate
tls.server_name	N	-	SNI / expected server hostname
tls.ca_name	N	-	Custom CA to trust. Empty uses the OS trust store
tls.cert_name	N*	-	Client certificate for mutual TLS
tls.key_name	N*	-	Client key for mutual TLS
tls.passphrase	N	-	Passphrase for an encrypted client key
tls.min_tls_version	N	tls1.2	Minimum negotiated TLS version
tls.max_tls_version	N	tls1.3	Maximum negotiated TLS version

* = Conditionally optional. tls.cert_name and tls.key_name must be supplied together to enable mutual TLS; supplying only one fails configuration validation. There is no tls.status field — TLS is engaged by setting protocol: tls or protocol: https.

note

TLS material fields (cert_name, key_name, ca_name, client_ca_name) accept any of the following:

• File name — resolved relative to the service root directory. Nested paths such as certs/prod/server.pem are supported.
• Absolute path — honored only if it resolves inside the service root. Any path that escapes the root is refused.
• Inline PEM content — used verbatim when the value contains -----BEGIN.
• Environment variable — ${ENV_VAR}.
• Vault reference — $secret{id=...} or $secret{store=...,ref=...}.

Processing

Field	Required	Default	Description
field_format	N	-	Optional target-side normalization format applied before delivery. Typically left empty, since the payload already arrives as GELF from upstream processing. See applicable Normalization section

Scheduling

See Scheduling and Pool Behavior for interval and cron fields shared by all targets.

Debug Options

Field	Required	Default	Description
debug.status	N	false	Enable debug logging
debug.dont_send_logs	N	false	Process logs but don't send to target (testing)

Details

This target is transport-only: it does not render GELF itself. It expects each event to already be a complete GELF JSON document when it reaches the target, and applies wire framing and delivery on top of that payload. There is no batching — each event is a single, complete delivery to the OVHcloud Logs Data Platform GELF input.

OVHcloud Requires TLS

Unlike the generic GELF target, this target defaults protocol to tls and port to 12202, and tls.verify defaults to true. The OVHcloud Logs Data Platform GELF input requires an encrypted connection; the tcp and udp transports remain available for non-default configurations, but tls (or https) is the expected transport.

Authentication

OVHcloud LDP authenticates ingestion per log stream using an X-OVH-TOKEN value. This token is carried as a GELF field on each event — set upstream, before the event reaches this target — rather than as a property of this target's configuration.

Transports

• GELF-TLS (default): the document is written null-delimited over a TLS-wrapped stream.
• GELF-TCP: the same null-delimited framing, without TLS.
• GELF-UDP: the document is sent as one datagram, or split into GELF-chunked datagrams (2-byte magic 0x1e 0x0f, 8-byte message ID, sequence number, sequence count) when it exceeds max_message_size. A document that would need more than 128 chunks fails — use tls or tcp for events that large.
• GELF-HTTPS: the document is POSTed as the request body to the GELF HTTPS input.

Endpoint Resolution (HTTPS)

An explicit url always wins. Otherwise the endpoint is built as https://address:port/gelf.

note

The target does not perform GELF rendering or field mapping — it only frames and delivers the payload it receives. Format the event as GELF, with the X-OVH-TOKEN field set, before it reaches this target.

Examples

Secure TLS

Sending GELF events to the OVHcloud Logs Data Platform over TLS...

targets: - name: ovhcloud type: ovhcloud properties: address: "gra1.logs.ovh.com" port: 12202 tls: verify: true

Custom Timeout

Widening the connection and write timeout for a slower network path...

targets: - name: ovhcloud-timeout type: ovhcloud properties: address: "gra1.logs.ovh.com" timeout: 60