Chronicle to BindPlane Converter

A Go CLI tool that converts Google Chronicle forwarder configurations to BindPlane OpenTelemetry format with SecOps standardization.

Features

• Collector Support: Converts Chronicle forwarder collectors (syslog, TCP, UDP, file, Splunk) to BindPlane receivers
• SecOps Standardization: Automatically adds transform processors to set chronicle_log_type and chronicle_namespace attributes
• Batch Processing: Includes batch processors with optimized settings (3000/3200 batch size, 5s timeout)
• Resource Detection: Adds resource detection processors for hostname
• Dual Output: Supports both file output and direct API push to BindPlane server
• Flexible Configuration: Per-collector log type mapping via CLI flags

Installation

From Source

git clone https://github.com/observiq/chronicle2bindplane.git
cd chronicle2bindplane
go build -o chronicle2bindplane

Using Go Install

go install github.com/observiq/chronicle2bindplane@latest

Usage

Basic Usage (File Output)

Convert a Chronicle config and write to a file:

chronicle2bindplane --input chronicle-config.yaml --output bindplane-config.yaml

With Log Type Mapping (Optional)

The tool automatically uses data_type from the Chronicle config's common section as the chronicle_log_type. You can override specific collectors if needed:

chronicle2bindplane \
  --input chronicle-config.yaml \
  --output bindplane-config.yaml \
  --log-types "syslog_0=CUSTOM_TYPE" \
  --namespace "production"

Note: The data_type from Chronicle config takes precedence. CLI flags are only used when data_type is not present.

Push to BindPlane API

Push the converted configuration directly to BindPlane:

chronicle2bindplane \
  --input chronicle-config.yaml \
  --api-url https://bindplane.example.com \
  --api-key your-api-key-here \
  --log-types "syslog1=SYSLOG"

Dry Run

Generate configuration without pushing to API:

chronicle2bindplane \
  --input chronicle-config.yaml \
  --output bindplane-config.yaml \
  --api-url https://bindplane.example.com \
  --api-key your-api-key-here \
  --dry-run

CLI Flags

Flag	Short	Description	Required
--input	-i	Input Chronicle forwarder config file	Yes
--output	-o	Output file for BindPlane config	Conditional*
--api-url		BindPlane API URL	Conditional*
--api-key		BindPlane API key	With --api-url
--log-types		Override chronicle_log_type for specific sources	No
--namespace		Chronicle namespace value	No
--default-log-type		Fallback when data_type not in config	No
--dry-run		Generate without pushing to API	No

* Either --output or --api-url must be specified

Collector Type Mappings

Chronicle collectors are converted to BindPlane receivers as follows:

Chronicle Collector	BindPlane Receiver	Notes
syslog	tcplog	Uses TCP receiver (not syslog receiver) to skip parsing
tcp	tcplog	TCP log receiver
udp	udplog	UDP log receiver
pcap	tcplog	PCAP over TCP
file	filelog	File log receiver
splunk_hec	splunk_hec	Splunk HEC receiver with metadata mapping

Log Type Priority

The chronicle_log_type attribute is set using the following priority:

1. data_type from Chronicle config (in common section) - Recommended
2. --log-types CLI flag (only if data_type not present)
3. --default-log-type CLI flag (fallback)
4. "UNKNOWN" (if nothing specified)

Generated Pipeline Structure

For each Chronicle collector, the tool generates:

1. Receiver: Based on collector type (see table above)
2. Processors (in order):
   • resourcedetection: Detects system hostname from OS
   • transform: Sets chronicle_log_type and chronicle_namespace attributes
   • batch: Batches logs with optimized settings
3. Forward Connector: Routes logs to destinations

Example

Input: Chronicle Config

collectors:
  - syslog:
      common:
        enabled: true
        data_type: "WINDOWS_DHCP"
        batch_n_seconds: 10
        batch_n_bytes: 1048576
      tcp_address: 0.0.0.0:10514
      connection_timeout_sec: 60

  - file:
      common:
        enabled: true
        data_type: "LINUX_SYSLOG"
      file_path: /var/log/messages

Output: BindPlane Config

receivers:
  tcplog/syslog_0:
    listen_address: 0.0.0.0:10514
  filelog/file_1:
    include:
      - /var/log/messages

processors:
  resourcedetection/syslog_0:
    detectors:
      - system
    system:
      hostname_sources:
        - os
  
  transform/syslog_0__secops:
    error_mode: ignore
    log_statements:
      - context: log
        statements:
          - set(attributes["chronicle_log_type"], "WINDOWS_DHCP") where (true)
  
  batch/syslog_0:
    send_batch_size: 3000
    send_batch_max_size: 3200
    timeout: 5s

connectors:
  forward/syslog_0: null

service:
  pipelines:
    logs/syslog_0:
      receivers:
        - tcplog/syslog_0
      processors:
        - resourcedetection/syslog_0
        - transform/syslog_0__secops
        - batch/syslog_0
      exporters:
        - forward/syslog_0

Note: The chronicle_log_type is automatically set to WINDOWS_DHCP from the data_type field in the Chronicle config.

Development

Project Structure

chronicle2bindplane/
├── cmd/                    # CLI commands
│   └── root.go            # Root command with flags
├── internal/
│   ├── bindplane/         # BindPlane config types & generator
│   │   ├── types.go       # BindPlane OTTL config types
│   │   ├── generator.go   # Conversion logic
│   │   └── client.go      # API client
│   └── chronicle/         # Chronicle config types & parser
│       ├── types.go       # Chronicle config types
│       └── parser.go      # YAML parser
├── examples/              # Sample configs
└── main.go               # Entry point

Running Tests

go test ./...

Building

go build -o chronicle2bindplane

Contributing

Contributions are welcome! Please submit issues and pull requests.

License

Apache License 2.0 - See LICENSE for details.

Support

For issues and questions, please open a GitHub issue.