> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# beacon endpoint gcs

> Generate Google Cloud Storage forwarding content and validation events for Beacon endpoint events.

## Forwarding Command

Use `beacon endpoint gcs` to generate Google Cloud Storage forwarding content for Beacon endpoint events. The generated pack keeps Beacon as a local JSONL producer and helps your customer-managed Vector agent upload runtime and inventory JSONL to a GCS bucket as NDJSON.

Beacon does not store Google Cloud credentials, service accounts, workload identity settings, bucket IAM, lifecycle rules, retention policies, or encryption settings. Keep those values in Google Cloud, Vector, endpoint-management policy, or deployment tooling.

```bash title="Command syntax" theme={null}
beacon endpoint gcs [command]
```

## Commands

<Columns cols={2}>
  <Card title="beacon endpoint gcs print-config" icon="file-lines" href="#beacon-endpoint-gcs-print-config">
    Print the Vector Google Cloud Storage forwarding template for the configured runtime log.
  </Card>

  <Card title="beacon endpoint gcs install-pack" icon="box-archive" href="#beacon-endpoint-gcs-install-pack">
    Write Google Cloud Storage forwarding content to a directory.
  </Card>

  <Card title="beacon endpoint gcs validate" icon="check" href="#beacon-endpoint-gcs-validate">
    Write and describe a Beacon Google Cloud Storage validation event.
  </Card>
</Columns>

## Runtime log paths

| Mode        | Path                                    |
| ----------- | --------------------------------------- |
| User mode   | `~/.beacon/endpoint/logs/runtime.jsonl` |
| System mode | `/var/log/beacon-agent/runtime.jsonl`   |

## beacon endpoint gcs print-config

`beacon endpoint gcs print-config` prints a Vector configuration that tails the selected Beacon runtime JSONL log and writes NDJSON objects to Google Cloud Storage.

```bash title="Print the configuration" theme={null}
beacon endpoint gcs print-config
```

Use this command when you want to inspect or copy the Vector template into an existing endpoint forwarding workflow.

### Examples

Print Vector config for the default per-user Beacon install:

```bash title="Print Vector config for the default per-user Beacon install" theme={null}
beacon endpoint gcs print-config
```

Print Vector config for a system-mode MDM deployment:

```bash title="Print Vector config for a system-mode MDM deployment" theme={null}
sudo /opt/beacon/bin/beacon endpoint gcs print-config --system
```

Print Vector config for a custom runtime log:

```bash title="Print Vector config for a custom runtime log" theme={null}
beacon endpoint gcs print-config --log-path /path/to/runtime.jsonl
```

### Flags

| Flag                | Description                                     |
| ------------------- | ----------------------------------------------- |
| `--user`            | Use per-user endpoint paths. Enabled by default |
| `--system`          | Use system endpoint paths and launch daemon     |
| `--log-path <path>` | Runtime JSONL log path                          |

## beacon endpoint gcs install-pack

`beacon endpoint gcs install-pack` writes Google Cloud Storage forwarding content to a directory.

```bash title="Generate the integration pack" theme={null}
beacon endpoint gcs install-pack --output ./beacon-gcs-pack
```

The pack includes setup instructions, a one-shot GCS upload smoke-test script,
a Vector `gcp_cloud_storage` forwarding template, and sample Beacon endpoint
events. Current templates keep a root prefix and write runtime activity and
inventory snapshots below separate `runtime/` and `inventory/` folders.

### Examples

Generate a content pack for the default per-user install:

```bash title="Generate a content pack for the default per-user install" theme={null}
beacon endpoint gcs install-pack --output ./beacon-gcs-pack
```

Generate a content pack for a system-mode deployment:

```bash title="Generate a content pack for a system-mode deployment" theme={null}
sudo /opt/beacon/bin/beacon endpoint gcs install-pack \
  --system \
  --output ./beacon-gcs-pack
```

Generate a content pack for a custom runtime log:

```bash title="Generate a content pack for a custom runtime log" theme={null}
beacon endpoint gcs install-pack \
  --output ./beacon-gcs-pack \
  --log-path /path/to/runtime.jsonl
```

### Flags

| Flag                | Description                                                                               |
| ------------------- | ----------------------------------------------------------------------------------------- |
| `--output <dir>`    | Output directory for the Google Cloud Storage content pack. Defaults to `beacon-gcs-pack` |
| `--user`            | Use per-user endpoint paths. Enabled by default                                           |
| `--system`          | Use system endpoint paths and launch daemon                                               |
| `--log-path <path>` | Runtime JSONL log path                                                                    |

## beacon endpoint gcs validate

`beacon endpoint gcs validate` writes a Beacon validation event to the runtime JSONL log and prints the expected GCS validation fields and follow-up Google Cloud checks.

```bash title="Run the validation check" theme={null}
beacon endpoint gcs validate
```

### Examples

Write a validation event for the default per-user install:

```bash title="Write a validation event for the default per-user install" theme={null}
beacon endpoint gcs validate
```

Write a validation event for a system-mode deployment:

```bash title="Write a validation event for a system-mode deployment" theme={null}
sudo /opt/beacon/bin/beacon endpoint gcs validate --system
```

Write a validation event to a custom runtime log:

```bash title="Write a validation event to a custom runtime log" theme={null}
beacon endpoint gcs validate --log-path /path/to/runtime.jsonl
```

The validation command writes the local event only. Confirm remote delivery with Google Cloud tooling:

```text theme={null}
gcloud storage ls "gs://${BEACON_GCS_BUCKET}/${BEACON_GCS_PREFIX}/**"
gcloud storage cat "gs://${BEACON_GCS_BUCKET}/${BEACON_GCS_PREFIX}/runtime/date=<date>/<object>.jsonl" | grep "Beacon endpoint GCS validation event"
```

Expected validation fields:

```text theme={null}
vendor=beacon product=endpoint-agent destination.type=gcs destination.mode=google_cloud_storage_jsonl
```

### Flags

| Flag                | Description                                     |
| ------------------- | ----------------------------------------------- |
| `--user`            | Use per-user endpoint paths. Enabled by default |
| `--system`          | Use system endpoint paths and launch daemon     |
| `--log-path <path>` | Runtime JSONL log path                          |

## Packaged macOS forwarding

The signed macOS endpoint package includes:

```text theme={null}
/opt/beacon/jamf/claude/gcs/install-forwarder.sh
/opt/beacon/jamf/claude/gcs/run-forwarder.sh
/opt/beacon/jamf/claude/gcs/repair-hooks-and-forwarder.sh
```

The helper requires:

* `BEACON_GCS_BUCKET`
* optional root `BEACON_GCS_PREFIX`, default `beacon`
* optional `BEACON_GCS_STORAGE_CLASS`, default `STANDARD`
* `GOOGLE_APPLICATION_CREDENTIALS`, pointing to an externally delivered
  service-account JSON file outside Beacon-managed directories

It writes `gcs-vector.toml` and a root-owned `gcs-vector.env` below
`/Library/Application Support/Beacon/Forwarders`, then starts
`com.beacon.endpoint.gcs-forwarder`. The env file stores the credential path,
not the credential JSON.

Vector `0.56` supports service-account JSON and GCE metadata credentials. On
managed Macs, do not depend on interactive `gcloud` Application Default
Credentials or Workload Identity Federation for the launchd service.

Use a write-only service account with `roles/storage.objectCreator` for the
endpoint and a separate reader identity for validation. An object creator cannot
list or read the objects it successfully uploads.

## Related

<Columns cols={2}>
  <Card title="Object storage forwarding" icon="chart-line" href="/guides/macos-object-storage-system">
    Configure Vector forwarding from Beacon JSONL into Google Cloud Storage.
  </Card>

  <Card title="Log forwarding" icon="tower-broadcast" href="/log-forwarding">
    Review forwarding patterns and validation steps.
  </Card>

  <Card title="Endpoint agent" icon="desktop" href="/cli/endpoint">
    Install and inspect the local endpoint agent.
  </Card>

  <Card title="Endpoint event schema" icon="code" href="/telemetry-schema/event-schema">
    Review normalized Beacon JSONL fields and example events.
  </Card>
</Columns>
