DataExport class

DataExport resource represents a request to export data from Chronicle to a GCS bucket.

To get more information about DataExport, see:

Example Usage

Chronicle Data Export Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = gcp.organizations.getProject({
    projectId: "my-project-name",
});
const testBucket = new gcp.storage.Bucket("test_bucket", {
    name: "chronicle-test-bucket-my-project-name-_56730",
    project: "my-project-name",
    location: "us",
    forceDestroy: true,
});
const example = new gcp.chronicle.DataExport("example", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    gcsBucket: pulumi.all([project, testBucket.name]).apply(([project, name]) => `projects/${project.number}/buckets/${name}`),
    startTime: "2025-01-01T00:00:00Z",
    endTime: "2025-01-01T12:00:00Z",
});

import pulumi
import pulumi_gcp as gcp

project = gcp.organizations.get_project(project_id="my-project-name")
test_bucket = gcp.storage.Bucket("test_bucket",
    name="chronicle-test-bucket-my-project-name-_56730",
    project="my-project-name",
    location="us",
    force_destroy=True)
example = gcp.chronicle.DataExport("example",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    gcs_bucket=test_bucket.name.apply(lambda name: f"projects/{project.number}/buckets/{name}"),
    start_time="2025-01-01T00:00:00Z",
    end_time="2025-01-01T12:00:00Z")

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var project = Gcp.Organizations.GetProject.Invoke(new()
    {
        ProjectId = "my-project-name",
    });

    var testBucket = new Gcp.Storage.Bucket("test_bucket", new()
    {
        Name = "chronicle-test-bucket-my-project-name-_56730",
        Project = "my-project-name",
        Location = "us",
        ForceDestroy = true,
    });

    var example = new Gcp.Chronicle.DataExport("example", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        GcsBucket = Output.Tuple(project, testBucket.Name).Apply(values =>
        {
            var project = values.Item1;
            var name = values.Item2;
            return $"projects/{project.Apply(getProjectResult => getProjectResult.Number)}/buckets/{name}";
        }),
        StartTime = "2025-01-01T00:00:00Z",
        EndTime = "2025-01-01T12:00:00Z",
    });

});

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		project, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{
			ProjectId: pulumi.StringRef("my-project-name"),
		}, nil)
		if err != nil {
			return err
		}
		testBucket, err := storage.NewBucket(ctx, "test_bucket", &storage.BucketArgs{
			Name:         pulumi.String("chronicle-test-bucket-my-project-name-_56730"),
			Project:      pulumi.String("my-project-name"),
			Location:     pulumi.String("us"),
			ForceDestroy: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		_, err = chronicle.NewDataExport(ctx, "example", &chronicle.DataExportArgs{
			Location: pulumi.String("us"),
			Instance: pulumi.String("00000000-0000-0000-0000-000000000000"),
			GcsBucket: testBucket.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("projects/%v/buckets/%v", project.Number, name), nil
			}).(pulumi.StringOutput),
			StartTime: pulumi.String("2025-01-01T00:00:00Z"),
			EndTime:   pulumi.String("2025-01-01T12:00:00Z"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

data "gcp_organizations_getproject" "project" {
  project_id = "my-project-name"
}

resource "gcp_storage_bucket" "test_bucket" {
  name          = "chronicle-test-bucket-my-project-name-_56730"
  project       = "my-project-name"
  location      = "us"
  force_destroy = true
}
resource "gcp_chronicle_dataexport" "example" {
  location   = "us"
  instance   = "00000000-0000-0000-0000-000000000000"
  gcs_bucket ="projects/${data.gcp_organizations_getproject.project.number}/buckets/${gcp_storage_bucket.test_bucket.name}"
  start_time = "2025-01-01T00:00:00Z"
  end_time   = "2025-01-01T12:00:00Z"
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.storage.Bucket;
import com.pulumi.gcp.storage.BucketArgs;
import com.pulumi.gcp.chronicle.DataExport;
import com.pulumi.gcp.chronicle.DataExportArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var project = OrganizationsFunctions.getProject(GetProjectArgs.builder()
            .projectId("my-project-name")
            .build());

        var testBucket = new Bucket("testBucket", BucketArgs.builder()
            .name("chronicle-test-bucket-my-project-name-_56730")
            .project("my-project-name")
            .location("us")
            .forceDestroy(true)
            .build());

        var example = new DataExport("example", DataExportArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .gcsBucket(testBucket.name().applyValue(_name -> String.format("projects/%s/buckets/%s", project.number(),_name)))
            .startTime("2025-01-01T00:00:00Z")
            .endTime("2025-01-01T12:00:00Z")
            .build());

    }
}

resources:
  testBucket:
    type: gcp:storage:Bucket
    name: test_bucket
    properties:
      name: chronicle-test-bucket-my-project-name-_56730
      project: my-project-name
      location: us
      forceDestroy: true
  example:
    type: gcp:chronicle:DataExport
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      gcsBucket: projects/${project.number}/buckets/${testBucket.name}
      startTime: 2025-01-01T00:00:00Z
      endTime: 2025-01-01T12:00:00Z
variables:
  project:
    fn::invoke:
      function: gcp:organizations:getProject
      arguments:
        projectId: my-project-name

Chronicle Data Export Full

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = gcp.organizations.getProject({
    projectId: "my-project-name",
});
const testBucket = new gcp.storage.Bucket("test_bucket", {
    name: "chronicle-test-bucket-my-project-name-_95154",
    project: "my-project-name",
    location: "us",
    forceDestroy: true,
});
const example = new gcp.chronicle.DataExport("example", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    gcsBucket: pulumi.all([project, testBucket.name]).apply(([project, name]) => `projects/${project.number}/buckets/${name}`),
    startTime: "2025-01-01T00:00:00Z",
    endTime: "2025-01-01T12:00:00Z",
    includeLogTypes: ["projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT"],
    ingestionLabels: [{
        key: "key1",
        value: "val1",
    }],
    namespaces: ["my-namespace"],
});

import pulumi
import pulumi_gcp as gcp

project = gcp.organizations.get_project(project_id="my-project-name")
test_bucket = gcp.storage.Bucket("test_bucket",
    name="chronicle-test-bucket-my-project-name-_95154",
    project="my-project-name",
    location="us",
    force_destroy=True)
example = gcp.chronicle.DataExport("example",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    gcs_bucket=test_bucket.name.apply(lambda name: f"projects/{project.number}/buckets/{name}"),
    start_time="2025-01-01T00:00:00Z",
    end_time="2025-01-01T12:00:00Z",
    include_log_types=["projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT"],
    ingestion_labels=[{
        "key": "key1",
        "value": "val1",
    }],
    namespaces=["my-namespace"])

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var project = Gcp.Organizations.GetProject.Invoke(new()
    {
        ProjectId = "my-project-name",
    });

    var testBucket = new Gcp.Storage.Bucket("test_bucket", new()
    {
        Name = "chronicle-test-bucket-my-project-name-_95154",
        Project = "my-project-name",
        Location = "us",
        ForceDestroy = true,
    });

    var example = new Gcp.Chronicle.DataExport("example", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        GcsBucket = Output.Tuple(project, testBucket.Name).Apply(values =>
        {
            var project = values.Item1;
            var name = values.Item2;
            return $"projects/{project.Apply(getProjectResult => getProjectResult.Number)}/buckets/{name}";
        }),
        StartTime = "2025-01-01T00:00:00Z",
        EndTime = "2025-01-01T12:00:00Z",
        IncludeLogTypes = new[]
        {
            "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
        },
        IngestionLabels = new[]
        {
            new Gcp.Chronicle.Inputs.DataExportIngestionLabelArgs
            {
                Key = "key1",
                Value = "val1",
            },
        },
        Namespaces = new[]
        {
            "my-namespace",
        },
    });

});

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		project, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{
			ProjectId: pulumi.StringRef("my-project-name"),
		}, nil)
		if err != nil {
			return err
		}
		testBucket, err := storage.NewBucket(ctx, "test_bucket", &storage.BucketArgs{
			Name:         pulumi.String("chronicle-test-bucket-my-project-name-_95154"),
			Project:      pulumi.String("my-project-name"),
			Location:     pulumi.String("us"),
			ForceDestroy: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		_, err = chronicle.NewDataExport(ctx, "example", &chronicle.DataExportArgs{
			Location: pulumi.String("us"),
			Instance: pulumi.String("00000000-0000-0000-0000-000000000000"),
			GcsBucket: testBucket.Name.ApplyT(func(name string) (string, error) {
				return fmt.Sprintf("projects/%v/buckets/%v", project.Number, name), nil
			}).(pulumi.StringOutput),
			StartTime: pulumi.String("2025-01-01T00:00:00Z"),
			EndTime:   pulumi.String("2025-01-01T12:00:00Z"),
			IncludeLogTypes: pulumi.StringArray{
				pulumi.String("projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT"),
			},
			IngestionLabels: chronicle.DataExportIngestionLabelArray{
				&chronicle.DataExportIngestionLabelArgs{
					Key:   pulumi.String("key1"),
					Value: pulumi.String("val1"),
				},
			},
			Namespaces: pulumi.StringArray{
				pulumi.String("my-namespace"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

data "gcp_organizations_getproject" "project" {
  project_id = "my-project-name"
}

resource "gcp_storage_bucket" "test_bucket" {
  name          = "chronicle-test-bucket-my-project-name-_95154"
  project       = "my-project-name"
  location      = "us"
  force_destroy = true
}
resource "gcp_chronicle_dataexport" "example" {
  location          = "us"
  instance          = "00000000-0000-0000-0000-000000000000"
  gcs_bucket        ="projects/${data.gcp_organizations_getproject.project.number}/buckets/${gcp_storage_bucket.test_bucket.name}"
  start_time        = "2025-01-01T00:00:00Z"
  end_time          = "2025-01-01T12:00:00Z"
  include_log_types = ["projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT"]
  ingestion_labels {
    key   = "key1"
    value = "val1"
  }
  namespaces = ["my-namespace"]
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.storage.Bucket;
import com.pulumi.gcp.storage.BucketArgs;
import com.pulumi.gcp.chronicle.DataExport;
import com.pulumi.gcp.chronicle.DataExportArgs;
import com.pulumi.gcp.chronicle.inputs.DataExportIngestionLabelArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var project = OrganizationsFunctions.getProject(GetProjectArgs.builder()
            .projectId("my-project-name")
            .build());

        var testBucket = new Bucket("testBucket", BucketArgs.builder()
            .name("chronicle-test-bucket-my-project-name-_95154")
            .project("my-project-name")
            .location("us")
            .forceDestroy(true)
            .build());

        var example = new DataExport("example", DataExportArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .gcsBucket(testBucket.name().applyValue(_name -> String.format("projects/%s/buckets/%s", project.number(),_name)))
            .startTime("2025-01-01T00:00:00Z")
            .endTime("2025-01-01T12:00:00Z")
            .includeLogTypes("projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT")
            .ingestionLabels(DataExportIngestionLabelArgs.builder()
                .key("key1")
                .value("val1")
                .build())
            .namespaces("my-namespace")
            .build());

    }
}

resources:
  testBucket:
    type: gcp:storage:Bucket
    name: test_bucket
    properties:
      name: chronicle-test-bucket-my-project-name-_95154
      project: my-project-name
      location: us
      forceDestroy: true
  example:
    type: gcp:chronicle:DataExport
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      gcsBucket: projects/${project.number}/buckets/${testBucket.name}
      startTime: 2025-01-01T00:00:00Z
      endTime: 2025-01-01T12:00:00Z
      includeLogTypes:
        - projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT
      ingestionLabels:
        - key: key1
          value: val1
      namespaces:
        - my-namespace
variables:
  project:
    fn::invoke:
      function: gcp:organizations:getProject
      arguments:
        projectId: my-project-name

Import

DataExport can be imported using any of these accepted formats:

projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataExports/{{data_export_id}}
{{project}}/{{location}}/{{instance}}/{{data_export_id}}
{{location}}/{{instance}}/{{data_export_id}}

When using the pulumi import command, DataExport can be imported using one of the formats above. For example:

$ pulumi import gcp:chronicle/dataExport:DataExport default projects/{{project}}/locations/{{location}}/instances/{{instance}}/dataExports/{{data_export_id}}
$ pulumi import gcp:chronicle/dataExport:DataExport default {{project}}/{{location}}/{{instance}}/{{data_export_id}}
$ pulumi import gcp:chronicle/dataExport:DataExport default {{location}}/{{instance}}/{{data_export_id}}

Constructors

DataExport(String name, {DataExportArgs? args, CustomResourceOptions? options}): Creates a new DataExport. name The Pulumi resource name. args Arguments used to configure this DataExport. The set of arguments for DataExport. options Resource options controlling this resource's behavior.
DataExport.reference(String urn): Creates a typed reference to an existing DataExport resource.

Properties

childResources → Set<Resource>: finalinherited
completionSources ↔ Map<String, IOutputCompletionSource>: latefinalinherited
createTime ↔ Output<String>: Timestamp indicating when the DataExport resource was created.
latefinal
dataExportId ↔ Output<String>: The unique identifier for the data export.
latefinal
dataExportStatuses ↔ Output<List<DataExportDataExportStatus>>: Status of the current export. Structure is documented below.
latefinal
endTime ↔ Output<String>: Last, exclusive time from the range.
latefinal
estimatedVolume ↔ Output<int>: The estimated export volume in bytes.
latefinal
exportedVolume ↔ Output<int>: Actual volume of data exported.
latefinal
gcsBucket ↔ Output<String>: Link to the destination Cloud Storage bucket.
latefinal
hashCode → int: The hash code for this object.
no setterinherited
id ↔ Output<String>: getter/setter pairinherited
includeLogTypes ↔ Output<List<String>>: The specific log types to include in the Data Export request.
latefinal
ingestionLabels ↔ Output<List<DataExportIngestionLabel>?>: The ingestion labels used to filter the export. Structure is documented below.
latefinal
instance ↔ Output<String>: The unique identifier for the Chronicle instance.
latefinal
isCustom → bool: Returns whether this resource is provider-managed.
no setterinherited
isProtected → bool: Returns whether this resource is protected from deletion.
no setterinherited
isRemote → bool: Whether this resource is registered as remote.
no setterinherited
isResourceReference → bool: Whether this instance represents a resource value returned over RPC.
finalinherited
location ↔ Output<String>: The location of the resource.
latefinal
name ↔ Output<String>: The resource name of the data export.
latefinal
namespaces ↔ Output<List<String>?>: The namespaces used to filter the export.
latefinal
project ↔ Output<String>: The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
latefinal
resourceTransforms → List<ResourceTransform>: Inherited/explicit async transforms.
no setterinherited
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited
startTime ↔ Output<String>: Start, inclusive time from the range.
latefinal
transformations → List<ResourceTransformation>: Inherited/explicit legacy transformations.
no setterinherited
updateTime ↔ Output<String>: Timestamp indicating the last time the DataExport resource was updated.
latefinal
urn ↔ Output<String>: latefinalinherited

Methods

failId(Object error) → void: Completes this resource ID with an error when registration fails.
inherited
failOutputs(Object error) → void: Completes all output properties with error.
inherited
failUrn(Object error) → void: Completes this resource URN with an error when registration fails.
inherited
getProvider(String moduleMember) → ProviderResource?: Returns provider for moduleMember's package, if configured.
inherited
getResourceName() → String: Returns this resource's logical name.
inherited
getResourceType() → String: Returns this resource's Pulumi type token.
inherited
noSuchMethod(Invocation invocation) → dynamic: Invoked when a nonexistent method or property is accessed.
inherited
registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>: Registers a dynamic output property for this resource.
inherited
resolveId(String? value, {required bool isKnown}) → void: Resolves the provider-assigned ID for this resource.
inherited
resolveOutputs(Struct outputs) → void: Resolves all output properties from a monitor response payload.
inherited
resolveUrn(String value) → void: Resolves this resource's URN once assigned by the engine.
inherited
serializeProperties(Map<String, dynamic> properties) → Future<Struct>: Serializes resource properties for RPC transmission.
inherited
toString() → String: A string representation of this object.
inherited

Operators

operator ==(Object other) → bool: The equality operator.
inherited

Static Methods

get(String name, Input<String> id, {DataExportState? state, CustomResourceOptions? options}) → DataExport: Gets an existing DataExport resource's state with the given name and id.