We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

CreateCollector parity mapping

Supported in:

Google secops SIEM

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Ingestion Collector API (CreateCollector) to the modern Chronicle API (CreateCollector).

Protocol and mapping overview

Feature	Legacy API (`CreateCollector`)	Modern Chronicle API (`CreateCollector`)
HTTP method	`POST`	`POST`
Permissions	Partner token or legacy API keys	`chronicle.googleapis.com/collectors.create`

Request payload field-by-field parity

The modern Chronicle API CreateCollectorRequest requires parent scoping and maps collector attributes to equivalent fields.

Legacy field (`CreateCollectorRequest` / `Collector`)	Modern field (`CreateCollectorRequest` / `Collector`)	Field type	Parity and migration notes
`parent`	`parent` (in HTTP path)	`string`	Google Cloud scoping context: Scopes the creation target using the standard resource path in the HTTP URL path. Pattern: `projects/{project}/locations/{location}/instances/{instance}/forwarders/{forwarder_id}`.
`collector.display_name`	`collector.display_name`	`string`	Parity mapped: Display name of the collector. Rename to `displayName` in JSON payloads.
`collector.config`	`collector.config`	`CollectorConfig`	Parity mapped: Configuration settings mapping (sources, filters, networks).
`collector.override_timezone`	`collector.override_timezone`	`bool`	Parity mapped: Toggles timezone overrides. Rename to `overrideTimezone` in JSON payloads.
`collector.time_zone`	`collector.time_zone`	`string`	Parity mapped: Target timezone override. Rename to `timeZone` in JSON payloads.
`collector.name`	`collector.name`	`string`	Ignored / output-only: Although the field exists in the modern Collector structure, it is generated by the server and shouldn't be provided in the request payload.
`collector.state`	`collector.state`	`enum`	Ignored / output-only: The state is set by the system and ignored during create requests.
`collector.type`	`collector.type`	`enum`	Ignored / output-only: The collector type (for example, `FILE`, `KAFKA`, `SYSLOG`) is defined inside the nested config block, making the root field output-only during creation.

Response payload field-by-field parity

Both responses return the created Collector message representation.

Legacy field (`Collector` message)	Modern field (`Collector` message)	Field type	Parity and migration notes
`name`	`name`	`string`	Parity mapped: Contains the standard canonical resource path: `projects/{project}/locations/{location}/instances/{instance}/forwarders/{forwarder_id}/collectors/{collector_id}`.
`display_name`	`display_name`	`string`	Rename to `displayName` in JSON responses.
`config`	`config`	`CollectorConfig`	Contains equivalent log source and network settings.
`state`	`state`	`enum`	Maps directly to `State` enum (values: `ACTIVE`, `SUSPENDED`).
`type`	`type`	`enum`	Maps directly to `Type` enum (values: `FILE`, `KAFKA`, `PCAP`, `SPLUNK`, `WEBPROXY`, `SYSLOG`).
`override_timezone`	`override_timezone`	`bool`	Rename to `overrideTimezone` in JSON responses.
`time_zone`	`time_zone`	`string`	Rename to `timeZone` in JSON responses.

Key differences

Google Cloud project scoping integration:
- Scoped natively under parent project instance folder bindings.
Resource path renaming:
- Legacy path formats forwarders/<forwarder_id>/collectors/<collector_id> are migrated to standard Google Cloud path parameters projects/{project}/locations/{location}/instances/{instance}/forwarders/{forwarder_id}/collectors/{collector_id}.