Skip to main content

​
Forwarding Command

Use beacon endpoint gcs to generate Google Cloud Storage forwarding content for Beacon endpoint events. The generated pack keeps Beacon as a local JSONL producer and helps your customer-managed Vector agent upload runtime and inventory JSONL to a GCS bucket as NDJSON. Beacon does not store Google Cloud credentials, service accounts, workload identity settings, bucket IAM, lifecycle rules, retention policies, or encryption settings. Keep those values in Google Cloud, Vector, endpoint-management policy, or deployment tooling.
Command syntax

​
Commands

beacon endpoint gcs print-config

Print the Vector Google Cloud Storage forwarding template for the configured runtime log.

beacon endpoint gcs install-pack

Write Google Cloud Storage forwarding content to a directory.

beacon endpoint gcs validate

Write and describe a Beacon Google Cloud Storage validation event.

​
Runtime log paths

​
beacon endpoint gcs print-config

beacon endpoint gcs print-config prints a Vector configuration that tails the selected Beacon runtime JSONL log and writes NDJSON objects to Google Cloud Storage.
Print the configuration
Use this command when you want to inspect or copy the Vector template into an existing endpoint forwarding workflow.

​
Examples

Print Vector config for the default per-user Beacon install:
Print Vector config for the default per-user Beacon install
Print Vector config for a system-mode MDM deployment:
Print Vector config for a system-mode MDM deployment
Print Vector config for a custom runtime log:
Print Vector config for a custom runtime log

​
Flags

​
beacon endpoint gcs install-pack

beacon endpoint gcs install-pack writes Google Cloud Storage forwarding content to a directory.
Generate the integration pack
The pack includes setup instructions, a one-shot GCS upload smoke-test script, a Vector gcp_cloud_storage forwarding template, and sample Beacon endpoint events. Current templates keep a root prefix and write runtime activity and inventory snapshots below separate runtime/ and inventory/ folders.

​
Examples

Generate a content pack for the default per-user install:
Generate a content pack for the default per-user install
Generate a content pack for a system-mode deployment:
Generate a content pack for a system-mode deployment
Generate a content pack for a custom runtime log:
Generate a content pack for a custom runtime log

​
Flags

​
beacon endpoint gcs validate

beacon endpoint gcs validate writes a Beacon validation event to the runtime JSONL log and prints the expected GCS validation fields and follow-up Google Cloud checks.
Run the validation check

​
Examples

Write a validation event for the default per-user install:
Write a validation event for the default per-user install
Write a validation event for a system-mode deployment:
Write a validation event for a system-mode deployment
Write a validation event to a custom runtime log:
Write a validation event to a custom runtime log
The validation command writes the local event only. Confirm remote delivery with Google Cloud tooling:
Expected validation fields:

​
Flags

​
Packaged macOS forwarding

The signed macOS endpoint package includes:
The helper requires:
  • BEACON_GCS_BUCKET
  • optional root BEACON_GCS_PREFIX, default beacon
  • optional BEACON_GCS_STORAGE_CLASS, default STANDARD
  • GOOGLE_APPLICATION_CREDENTIALS, pointing to an externally delivered service-account JSON file outside Beacon-managed directories
It writes gcs-vector.toml and a root-owned gcs-vector.env below /Library/Application Support/Beacon/Forwarders, then starts com.beacon.endpoint.gcs-forwarder. The env file stores the credential path, not the credential JSON. Vector 0.56 supports service-account JSON and GCE metadata credentials. On managed Macs, do not depend on interactive gcloud Application Default Credentials or Workload Identity Federation for the launchd service. Use a write-only service account with roles/storage.objectCreator for the endpoint and a separate reader identity for validation. An object creator cannot list or read the objects it successfully uploads.

Object storage forwarding

Configure Vector forwarding from Beacon JSONL into Google Cloud Storage.

Log forwarding

Review forwarding patterns and validation steps.

Endpoint agent

Install and inspect the local endpoint agent.

Endpoint event schema

Review normalized Beacon JSONL fields and example events.