Configure [Zscaler Secure Private Access (ZPA)](https://www.zscaler.com/products/zscaler-private-access) to seamlessly send logs to Coralogix.

## Configuration

Configure Zscaler Secure Private Access (ZPA) to send logs in JSON format to a local server hosted on-premises or on-cloud on a custom port (for example, 5514).

**STEP 1**. Edit the Log Receiver. Click **Next**.

**STEP 2**. Configure the Log Stream. Select JSON **Log Template**. Click **Next**.

**STEP 3**. [Install](https://docs.fluentd.org/installation) Fluentd on a local server.

**STEP 4**. Use the configuration below to listen to Zscaler on the configured port, parse it to JSON format, and send it to Coralogix.

```text
 <source>
 @type tcp #tcp input filter, in case you are sending it via UDP use udp input plugin and corresponding configuration
 @log_level debug
 tag zscaler-tcp # required
 <parse>
   @type json
 </parse>
 port 5514   #port on which you are sending zscaler logs
 bind 0.0.0.0
 delimiter "\n"
</source>

<filter **>
@type record_transformer
<record>
tag ${tag_parts[0]}
</record>
</filter>
<filter **>
@type record_transformer
@log_level warn
enable_ruby true
auto_typecast true
renew_record true
<record>
applicationName ${record['tag']} #this sets the application name same as tag specified, you can also set a static value
subsystemName ${record['tag']} #this sets the application name same as tag specified, you can also set a static value
computerName ${hostname}
text ${record.to_json}
</record>
</filter>

<match **>
@type http
@id out_http_coralogix
endpoint "https://ingress.[[DOMAIN_VALUE]]/logs/v1/singles" # Use the domain selector in the upper right corner of the page to select the correct Coralogix API endpoint for the domain associated with your Coralogix account.
headers {"private_key":"<Coralogix send your data api-key>"}
error_response_as_unrecoverable false
<buffer tag>
@type memory
   compress gzip
   flush_thread_count 4
   chunk_limit_size 6MB
   flush_interval 1s
   overflow_action throw_exception
   retry_max_times 10
   retry_type periodic
   retry_wait 8
   total_limi_size 512MB
</buffer>
</match>

<label @FLUENT_LOG>
<match fluent.*>
@type stdout
</match>
</label>
```

## Parameters & Descriptions

Choose the https://ingress.\[[DOMAIN_VALUE]\]/logs/v1/singles endpoint that corresponds to your Coralogix [domain](https://coralogix.com/docs/user-guides/account-management/account-settings/coralogix-domain/index.md) using the domain selector at the top of the page.

## Additional resources

|                            |                                                                                             |
| -------------------------- | ------------------------------------------------------------------------------------------- |
| Configuring a Log Receiver | [Configuring a Log Receiver](https://help.zscaler.com/zpa/configuring-log-receiver)         |
| Coralogix Endpoints        | [Coralogix Endpoints](https://coralogix.com/docs/integrations/coralogix-endpoints/index.md) |