Kafka Forwarder Reference
Basic Configuration
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Integration Name | Display name for the integration instance | string | yes | Kafka Forwarder1 |
Kafka Connection Settings
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Connection Name | Unique identifier for the connection | string | yes | default |
Broker Host | Kafka broker host name | string | yes | localhost |
Broker Port | Kafka broker port | integer | yes | 9092 |
Compression Codec | Compression codec | string | yes | none |
Use SSL | Enable SSL encryption | boolean | no | false |
Use SASL | Enable SASL authentication | boolean | no | false |
SSL Configuration
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Truststore Location | Path to the SSL truststore file | string | If SSL is enabled | n / a |
Truststore Password | Password for the SSL truststore | password | If SSL is enabled | n / a |
Keystore Location | Path to the SSL keystore file | string | If SSL is enabled | n / a |
Keystore Password | Password for the SSL keystore | password | If SSL is enabled | n / a |
Key Password | Password for the private key | password | If SSL is enabled | n / a |
SSL Endpoint Algorithm | SSL endpoint verification algorithm | string | no | "" |
SASL Configuration
Field | Description | Type | Required | Default |
|---|---|---|---|---|
SASL Mechanism | SASL authentication mechanism | string | If SASL is enabled | PLAIN |
Security Protocol | Security protocol used for SASL communication | string | If SASL is enabled | SASL_PLAINTEXT |
JAAS Configuration | JAAS login configuration settings | string | If SASL is enabled | "" |
Kerberos Configuration (GSSAPI Only)
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Enable Kerberos Debug Logging | Enables detailed Kerberos debug logging. | Boolean | no | false |
Kerberos Service Name | Specifies the Kerberos service name used for authentication. | string | If GSSAPI | "" |
Kerberos Configuration File Path | Specifies the path to the krb5.conf file. | string | If GSSAPI | "" |
Additional Kafka SASL Properties
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Property Key | Specifies the Kafka client property name (for example, sasl.login.refresh.window.factor). | string | yes | "" |
Property Value | Specifies the value of the Kafka client property. | string | yes | "" |
Common Additional Properties for OAUTHBEARER:
sasl.login.refresh.window.factor: Specifies the window factor used for login refresh. Default: "0.8"
sasl.login.refresh.window.jitter: Specifies the jitter applied to the login refresh window. Default: "0.05"
sasl.login.refresh.min.period.seconds: Specifies the minimum period, in seconds, between login refresh attempts. Default: "60"
sasl.login.refresh.min.buffer.seconds: Specifies the minimum buffer time, in seconds, before token expiration. Default: "300"
Alert Map Configuration
An alert map defines how alerts are filtered, transformed, and routed to a Kafka topic. It specifies the Kafka connection and topic to use, an optional message key, and a set of transformation rules that map source event fields to the output payload.
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Map Name | Unique name for the alert map. | string | yes | default |
Alert Filter | CEvent filter expression. | string | no | "" |
Kafka Connection | Name of the Kafka connection to use. | string | no | "" |
Topic | Target Kafka topic. | string | no | "" |
Message Key | Optional message key with substitutions. | string | no | "" |
Transformation Rules | List of field mapping rules. | array | no | [] |
Alert Transformation Rules
Each transformation rule maps source event fields to fields in the output payload.
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Field Name | Name of the target field in the output payload. | string | yes | "" |
Rule | Transformation rule defined using Moogsoft Onprem macro syntax. | string | yes | "" |
Use Default | Specifies whether a default value is used when the source field is empty. | boolean | no | false |
Default Value | Default value applied when the source field is empty and Use Default is enabled. | string | Conditional (if Use Default is enabled) | "" |
Alert Field Substitutions
Alert field substitutions can be used in message keys and transformation rules to dynamically populate values from alert fields. The following substitutions are supported.
$(alert_id): Alert ID
$(description): Alert description
$(severity): Alert severity (0–9)
$(source): Alert source
$(source_id): Source ID
$(state): Alert state (open or closed)
$(type): Alert type
$(class): Alert class
$(manager): Alert manager
$(signature): Alert signature
$(agent): Alert agent
$(agent_location): Agent location
$(count): Alert count
$(owner): Alert owner ID
For complete information about transformation rules, see Configure Payload Mapping Rules.
Situation Map Configuration
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Map Name | Unique name for the Situation map. | string | yes | default |
Situation Filter | CEvent filter expression. | string | no | "" |
Kafka Connection | Name of the Kafka connection to use. | string | no | "" |
Topic | Target Kafka topic. | string | no | "" |
Message Key | Optional message key with substitutions. | string | no | "" |
Forward Alerts | Includes contained alerts. | boolean | no | false |
Transformation Rules | List of field mapping rules. | array | no | [] |
Situation Transformation Rules
Transformation rules map source event fields to fields in the output payload.
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Field Name | Name of the target field in the output payload. | string | yes | "" |
Rule | Transformation rule using Moogsoft Onprem macro syntax. | string | yes | "" |
Use Default | Uses a default value if the source field is empty. | boolean | no | false |
Default Value | Default value used when the source field is empty. | string | If Use Default is enabled | "" |
Situation Field Substitutions
Situation field substitutions can be used in message keys and transformation rules to dynamically populate values from Situation fields. The following substitutions are supported.
$(sig_id): Situation ID
$(description): Situation description
$(internal_priority): Internal priority (0–9)
$(status): Situation status
$(total_alerts): Number of alerts in the Situation
$(moderator_id): Situation moderator ID
$(created_at): Creation timestamp
$(first_event_time): First event timestamp
$(last_event_time): Last event timestamp
For complete information about transformation rules, see Configure Payload Mapping Rules.
Thread Map Configuration
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Map Name | Unique name for the thread map. | string | yes | default |
Thread Filter | CEvent filter expression. | string | no | "" |
Kafka Connection | Name of the Kafka connection to use. | string | no | "" |
Topic | Target Kafka topic. | string | no | "" |
Message Key | Optional message key with substitutions. | string | no | "" |
Transformation Rules | List of field mapping rules. | array | no | [] |
Thread Transformation Rules
Transformation rules map source event fields to fields in the output payload.
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Field Name | Name of the target field in the output payload. | string | yes | "" |
Rule | Transformation rule using Moogsoft Onprem macro syntax. | string | yes | "" |
Use Default | Uses a default value if the source field is empty. | boolean | no | false |
Default Value | Default value used when the source field is empty. | string | If Use Default is enabled | "" |
Thread Entry Substitutions
Thread entry substitutions can be used in message keys and transformation rules to dynamically populate values from thread entry fields. The following substitutions are supported.
$(action): Thread action type
$(timed_at): Action timestamp
$(uid): User ID of the user who performed the action
$(details.thread_name): Thread name
$(details.entry_id): Thread entry ID
$(threadEntry.entry): Thread entry text content
For complete information about transformation rules, see Configure Payload Mapping Rules.
Global Defaults
Global defaults provide fallback values that are used when a specific configuration is not defined in an alert, Situation, or thread map.
Field | Description | Type | Required | Default |
|---|---|---|---|---|
Default Kafka Connection | Fallback Kafka connection name. | string | no | default |
Default Topic | Fallback Kafka topic name. | string | no | default_topic |
Default Message Key | Fallback message key. | string | no | "" |
Forward Alerts by Default | Default behavior for forwarding alerts. | boolean | no | true |