/
Zscaler Collector Migration Guide

Zscaler Collector Migration Guide

Welcome to the migration guide for zscaler Collector version 2.0.0! This guide will walk you through the process of updating your configuration from the old version (1.1.0) to the new version (2.0.0). The new version introduces significant improvements and changes to the configuration style to enhance performance, usability, and security.

Overview of Changes

The new configuration format introduces several key changes:

Preparing for Migration

Before starting the migration process, we recommend the following steps:

  1. Backup Your Current Configuration: Always ensure you have a backup of your existing configuration files to prevent any data loss.

  2. Review the New Configuration Documentation: Familiarize yourself with the new configuration options available in version 2.0.0.

Migration Steps

Take credentials and base_url out of service block.

An example of the old and new configuration is shown below:

old version (<2.0.0)

{ "global_overrides": { "debug": false }, "inputs": { "zscaler": { "id": "<short_unique_id>", "enabled": true, "services": { "zscaler_audit_logs": { "base_url": "<zscaler customer domain · example -> https://admin.zscalerbeta.net>", "credentials": { "username": "<username_value>", "password": "<password_value>", "api_key": "<api_key_value>" }, "time_range_in_days": "<valid range -> 1 to 31>", "audit_logs_page_size_in_items": "<valid range -> 10 to 500>", "start_time_in_epoch": "<start_time_in_epoch>", "audit_logs_check_interval_in_seconds": "<valid range -> 5 to 20>", "types": [ "audit_logs" ] } } } } }

new version (2.0.0)

{ "global_overrides": { "debug": false }, "inputs": { "zscaler": { "id": "<short_unique_id>", "enabled": true, "base_url": "<zscaler customer domain · example -> https://admin.zscalerbeta.net>", "credentials": { "username": "<username_value>", "password": "<password_value>", "api_key": "<api_key_value>" }, "services": { "zscaler_audit_logs": { "time_range_in_days": "<valid range -> 1 to 31>", "audit_logs_page_size_in_items": "<valid range -> 10 to 500>", "initial_start_time_in_utc": "<initial_start_time_in_utc_value>", "audit_logs_check_interval_in_seconds": "<valid range -> 5 to 20>", "types": [ "audit_logs" ], "override_tag": "<override base tag>", "requests_limits": [ { "period": "<period_value>", "number_of_requests": "<number_of_requests>" } ] } } } } }

Update the Service Configuration Parameter Field Name On Premise Collector

old version (<2.0.0)

inputs: zscaler: id: <short_unique_id> enabled: true services: zscaler_audit_logs: base_url: <zscaler customer domain · example -> https://admin.zscalerbeta.net> credentials: username: <username_value> password: <password_value> api_key: <api_key_value> time_range_in_days: <valid range -> 1 to 31> audit_logs_page_size_in_items: <valid range -> 10 to 500> start_time_in_epoch: <start_time_in_epoch> audit_logs_check_interval_in_seconds: <valid range -> 5 to 20> types: - audit_logs

new version (2.0.0)

inputs: zscaler: id: <short_unique_id> enabled: true base_url: <zscaler customer domain · example -> https://admin.zscalerbeta.net> credentials: username: <username_value> password: <password_value> api_key: <api_key_value> services: zscaler_audit_logs: time_range_in_days: <valid range -> 1 to 31> audit_logs_page_size_in_items: <valid range -> 10 to 500> initial_start_time_in_utc: <initial_start_time_in_utc_value> audit_logs_check_interval_in_seconds: <valid range -> 5 to 20> types: - audit_logs

Important note: Now collector sending data to new table sse.zscaler.zia.audit

Related content