Zscaler Secure Private Access (ZPA)

Open in ChatGPTOpen in Claude

Send your Zscaler Secure Private Access (ZPA) logs to Coralogix. ZPA streams JSON to a log receiver you host (on-premises or in the cloud) and a Fluentd pipeline on that host parses the stream and forwards it to Coralogix.

What you need

• Admin access to the ZPA admin portal.
• A server reachable from your App Connector group, with a free TCP port for the stream (this page uses 5514).
• A Coralogix Send-Your-Data API key.
• The singles endpoint for your Coralogix domain. Use the domain selector at the top of this page to resolve it: https://ingress./logs/v1/singles

Configure the ZPA log receiver

1.

Define the receiver

In the ZPA admin portal, edit the log receiver. Enter a Name, the Domain or IP Address of your server, and the TCP Port it listens on. Select the App Connector Groups that reach it, then select Next.

Shows the first wizard step, where the receiver's network destination is set.

2.

Set the log stream to JSON

On the Log Stream step, select your Log Type and set Log Template to JSON, then select Next.

Shows the template that determines the field set arriving at your receiver.

Zscaler documents the receiver in full in Configuring a Log Receiver.

Forward the stream to Coralogix

1.

Install Fluentd

Install Fluentd on the server receiving the stream.

2.

Configure the pipeline

This configuration listens on the receiver port, parses each line as JSON, tags the records, and posts them to Coralogix. Replace the API key placeholder, and set the endpoint to the singles endpoint for your domain.

<source>
 @type tcp # for UDP delivery, use the udp input plugin and its equivalent settings
 @log_level debug
 tag zscaler-tcp # required
 <parse>
   @type json
 </parse>
 port 5514   # the port ZPA streams to
 bind 0.0.0.0
 delimiter "\n"
</source>

<filter **>
@type record_transformer
<record>
tag ${tag_parts[0]}
</record>
</filter>
<filter **>
@type record_transformer
@log_level warn
enable_ruby true
auto_typecast true
renew_record true
<record>
applicationName ${record['tag']} # matches the tag above; a static value works too
subsystemName ${record['tag']} # matches the tag above; a static value works too
computerName ${hostname}
text ${record.to_json}
</record>
</filter>

<match **>
@type http
@id out_http_coralogix
endpoint "https://ingress.eu2.coralogix.com/logs/v1/singles"
headers {"private_key":"<Coralogix send your data api-key>"}
error_response_as_unrecoverable false
<buffer tag>
@type memory
   compress gzip
   flush_thread_count 4
   chunk_limit_size 6MB
   flush_interval 1s
   overflow_action throw_exception
   retry_max_times 10
   retry_type periodic
   retry_wait 8
   total_limi_size 512MB
</buffer>
</match>

<label @FLUENT_LOG>
<match fluent.*>
@type stdout
</match>
</label>

Related resources

Zscaler Internet Access (ZIA)Coralogix endpointsSend-Your-Data API key