BigQueryAuditMetadata

BigQueryAuditMetaData is exposed as part of the new AuditData.metadata messages.

JSON representation 
{

  // Union field event can be only one of the following:
  "jobInsertion": {
    object (JobInsertion)
  },
  "jobChange": {
    object (JobChange)
  },
  "datasetCreation": {
    object (DatasetCreation)
  },
  "datasetChange": {
    object (DatasetChange)
  },
  "datasetDeletion": {
    object (DatasetDeletion)
  },
  "tableCreation": {
    object (TableCreation)
  },
  "tableChange": {
    object (TableChange)
  },
  "tableDeletion": {
    object (TableDeletion)
  },
  "tableDataRead": {
    object (TableDataRead)
  },
  "tableDataChange": {
    object (TableDataChange)
  },
  "modelDeletion": {
    object (ModelDeletion)
  },
  "modelCreation": {
    object (ModelCreation)
  },
  "modelMetadataChange": {
    object (ModelMetadataChange)
  },
  "modelDataChange": {
    object (ModelDataChange)
  },
  "modelDataRead": {
    object (ModelDataRead)
  },
  "routineCreation": {
    object (RoutineCreation)
  },
  "routineChange": {
    object (RoutineChange)
  },
  "routineDeletion": {
    object (RoutineDeletion)
  }
  // End of list of possible types for union field event.
}
Fields
Union field event. Request data for each BigQuery event. event can be only one of the following:
jobInsertion

object (JobInsertion)

Job insertion event.
jobChange

object (JobChange)

Job state change event.
datasetCreation

object (DatasetCreation)

Dataset creation event.
datasetChange

object (DatasetChange)

Dataset change event.
datasetDeletion

object (DatasetDeletion)

Dataset deletion event.
tableCreation

object (TableCreation)

Table creation event.
tableChange

object (TableChange)

Table metadata change event.
tableDeletion

object (TableDeletion)

Table deletion event.
tableDataRead

object (TableDataRead)

Table data read event.
tableDataChange

object (TableDataChange)

Table data change event.
modelDeletion

object (ModelDeletion)

Model deletion event.
modelCreation

object (ModelCreation)

Model creation event.
modelMetadataChange

object (ModelMetadataChange)

Model metadata change event.
modelDataChange

object (ModelDataChange)

Model data change event.
modelDataRead

object (ModelDataRead)

Model data read event.
routineCreation

object (RoutineCreation)

Routine creation event.
routineChange

object (RoutineChange)

Routine change event.
routineDeletion

object (RoutineDeletion)

Routine deletion event.

JobInsertion

Job insertion event. Only logged in the project that runs the job. Other projects will get appropriate logs for table operations

JSON representation 
{
  "job": {
    object (Job)
  },
  "reason": enum (Reason)
}
Fields
job

object (Job)

Job description.
reason

enum (Reason)

Describes a way the job was inserted.

Job

Job represents a BigQuery job.

JSON representation 
{
  "jobName": string,
  "jobConfig": {
    object (JobConfig)
  },
  "jobStatus": {
    object (JobStatus)
  },
  "jobStats": {
    object (JobStats)
  }
}
Fields
jobName

string

Job uri.
jobConfig

object (JobConfig)

Job configuration.
jobStatus

object (JobStatus)

Job state.
jobStats

object (JobStats)

Job statistics.

JobConfig

Job configuration information. See the Jobs API resource for more details on individual fields.

JSON representation 
{
  "type": enum (Type),
  "labels": {
    string: string,
    ...
  },

  // Union field config can be only one of the following:
  "queryConfig": {
    object (Query)
  },
  "loadConfig": {
    object (Load)
  },
  "extractConfig": {
    object (Extract)
  },
  "tableCopyConfig": {
    object (TableCopy)
  }
  // End of list of possible types for union field config.
}
Fields
type

enum (Type)

Job type.
labels

map (key: string, value: string)

Labels provided for the job.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
Union field config. Job configuration information. config can be only one of the following:
queryConfig

object (Query)

Query job information.
loadConfig

object (Load)

Load job information.
extractConfig

object (Extract)

Extract job information.
tableCopyConfig

object (TableCopy)

TableCopy job information.

Query

Describes a query job.

JSON representation 
{
  "query": string,
  "queryTruncated": boolean,
  "destinationTable": string,
  "createDisposition": enum (CreateDisposition),
  "writeDisposition": enum (WriteDisposition),
  "defaultDataset": string,
  "tableDefinitions": [
    {
      object (TableDefinition)
    }
  ],
  "priority": enum (Priority),
  "destinationTableEncryption": {
    object (EncryptionInfo)
  },
  "statementType": enum (QueryStatementType)
}
Fields
query

string

The SQL query to run. Truncated if exceeds 50K.
queryTruncated

boolean

True if the query field was truncated.
destinationTable

string

The table where results are written.
createDisposition

enum (CreateDisposition)

Destination table create disposition.
writeDisposition

enum (WriteDisposition)

Destination table write disposition.
defaultDataset

string

Default dataset for the query.
tableDefinitions[]

object (TableDefinition)

Describes data sources outside BigQuery, if needed.
priority

enum (Priority)

Priority given to the query.
destinationTableEncryption

object (EncryptionInfo)

Result table encryption information. Set when non-default encryption is used.
statementType

enum (QueryStatementType)

Type of the query.

TableDefinition

Describes an external data source used in a query.

JSON representation 
{
  "name": string,
  "sourceUris": [
    string
  ]
}
Fields
name

string

Name of the table, used in queries.
sourceUris[]

string

URIs for the data to be imported.

EncryptionInfo

Describes encryption properties for a table or a job

JSON representation 
{
  "kmsKeyName": string
}
Fields
kmsKeyName

string

unique identifier for cloud kms key

Load

Describes a load job.

JSON representation 
{
  "sourceUris": [
    string
  ],
  "sourceUrisTruncated": boolean,
  "schemaJson": string,
  "schemaJsonTruncated": boolean,
  "destinationTable": string,
  "createDisposition": enum (CreateDisposition),
  "writeDisposition": enum (WriteDisposition),
  "destinationTableEncryption": {
    object (EncryptionInfo)
  }
}
Fields
sourceUris[]

string

URIs for the data to be imported. Entire list is truncated if exceeds 40K.
sourceUrisTruncated

boolean

True if the sourceUris field was truncated.
schemaJson

string

The table schema in JSON format. Entire field is truncated if exceeds 40K.
schemaJsonTruncated

boolean

True if the schemaJson field was truncated.
destinationTable

string

The table where the imported data is written.
createDisposition

enum (CreateDisposition)

Destination table create disposition.
writeDisposition

enum (WriteDisposition)

Destination table write disposition.
destinationTableEncryption

object (EncryptionInfo)

Result table encryption information. Set when non-default encryption is used.

Extract

Describes an extract job.

JSON representation 
{
  "destinationUris": [
    string
  ],
  "destinationUrisTruncated": boolean,

  // Union field source can be only one of the following:
  "sourceTable": string,
  "sourceModel": string
  // End of list of possible types for union field source.
}
Fields
destinationUris[]

string

URIs where extracted data should be written. Entire list is truncated if exceeds 50K.
destinationUrisTruncated

boolean

True if the destinationUris field was truncated.

Union field source.

source can be only one of the following:
sourceTable

string

The source table.
sourceModel

string

The source model.

TableCopy

Describes a copy job, which copies an existing table to another table.

JSON representation 
{
  "sourceTables": [
    string
  ],
  "sourceTablesTruncated": boolean,
  "destinationTable": string,
  "createDisposition": enum (CreateDisposition),
  "writeDisposition": enum (WriteDisposition),
  "destinationTableEncryption": {
    object (EncryptionInfo)
  }
}
Fields
sourceTables[]

string

Source tables. Entire list is truncated if exceeds 50K.
sourceTablesTruncated

boolean

True if the sourceTables field was truncated.
destinationTable

string

Destination table.
createDisposition

enum (CreateDisposition)

Destination table create disposition.
writeDisposition

enum (WriteDisposition)

Destination table write disposition.
destinationTableEncryption

object (EncryptionInfo)

Result table encryption information. Set when non-default encryption is used.

JobStatus

Running state of a job.

JSON representation 
{
  "jobState": enum (JobState),
  "errorResult": {
    object (Status)
  },
  "errors": [
    {
      object (Status)
    }
  ]
}
Fields
jobState

enum (JobState)

State of the job.
errorResult

object (Status)

Job error, if job failed.
errors[]

object (Status)

Errors encountered during the running of the job. Do not necessarily mean that the job has completed or was unsuccessful.

JobStats

Job statistics that may change after job starts.

JSON representation 
{
  "createTime": string,
  "startTime": string,
  "endTime": string,
  "totalSlotMs": string,
  "reservationUsage": [
    {
      object (ReservationResourceUsage)
    }
  ],
  "parentJobName": string,

  // Union field extended can be only one of the following:
  "queryStats": {
    object (Query)
  },
  "loadStats": {
    object (Load)
  }
  // End of list of possible types for union field extended.
}
Fields
createTime

string (Timestamp format)

Time when the job was created.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
startTime

string (Timestamp format)

Time when the job started.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
endTime

string (Timestamp format)

Time when the job ended.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
totalSlotMs

string (int64 format)

The total number of slot-ms consumed by the query job.
reservationUsage[]

object (ReservationResourceUsage)

Reservation usage attributed from each tier of a reservation hierarchy.
parentJobName

string

Parent job name. Only present for child jobs.
Union field extended. Statistics specific to the job type. extended can be only one of the following:
queryStats

object (Query)

Query job statistics
loadStats

object (Load)

Load job statistics;

Query

Query job statistics.

JSON representation 
{
  "totalProcessedBytes": string,
  "totalBilledBytes": string,
  "billingTier": integer,
  "referencedTables": [
    string
  ],
  "referencedViews": [
    string
  ],
  "referencedRoutines": [
    string
  ],
  "outputRowCount": string,
  "cacheHit": boolean
}
Fields
totalProcessedBytes

string (int64 format)

Total bytes processed for a job.
totalBilledBytes

string (int64 format)

Processed bytes, adjusted by the job's CPU usage.
billingTier

integer

The tier assigned by CPU-based billing.
referencedTables[]

string

Tables accessed by the query job.
referencedViews[]

string

Views accessed by the query job.
referencedRoutines[]

string

Routines accessed by the query job.
outputRowCount

string (int64 format)

Number of output rows produced by the query job.
cacheHit

boolean

True if the query cache was used for the results.

Load

Load job statistics.

JSON representation 
{
  "totalOutputBytes": string
}
Fields
totalOutputBytes

string (int64 format)

Total bytes loaded for an import job.

ReservationResourceUsage

Job resource usage breakdown by reservation.

JSON representation 
{
  "name": string,
  "slotMs": string
}
Fields
name

string

Reservation name or "unreserved" for on-demand resources usage.
slotMs

string (int64 format)

Total slot milliseconds used by the reservation for a particular job.

JobChange

Job state change event. Only logged in the project that runs the job.

JSON representation 
{
  "before": enum (JobState),
  "after": enum (JobState),
  "job": {
    object (Job)
  }
}
Fields
before

enum (JobState)

Job state before the job state change.
after

enum (JobState)

Job state after the job state change.
job

object (Job)

Job description.

DatasetCreation

Dataset creation event.

JSON representation 
{
  "dataset": {
    object (Dataset)
  }
}
Fields
dataset

object (Dataset)

Dataset description.

Dataset

Dataset represents a BigQuery dataset.

JSON representation 
{
  "datasetName": string,
  "datasetInfo": {
    object (EntityInfo)
  },
  "createTime": string,
  "updateTime": string,
  "acl": {
    object (BigQueryAcl)
  },
  "defaultTableExpireDuration": string
}
Fields
datasetName

string

Dataset uri.
datasetInfo

object (EntityInfo)

User-provided metadata for the dataset.
createTime

string (Timestamp format)

The time the dataset was created.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
updateTime

string (Timestamp format)

The time the dataset was last modified.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
acl

object (BigQueryAcl)

The access control list for the dataset.
defaultTableExpireDuration

string (Duration format)

Default expiration time for tables in the dataset.

A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".

EntityInfo

User-provided metadata for an entity within a dataset, for e.g. table, model.

JSON representation 
{
  "friendlyName": string,
  "description": string,
  "labels": {
    string: string,
    ...
  }
}
Fields
friendlyName

string

A short name for the entity.
description

string

A long description for the entity.
labels

map (key: string, value: string)

Labels provided for the entity.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

BigQueryAcl

An access control list.

JSON representation 
{
  "policy": {
    object (Policy)
  },
  "authorizedViews": [
    string
  ]
}
Fields
policy

object (Policy)

IAM policy for the resource.
authorizedViews[]

string

List of authorized views for a dataset.

DatasetChange

Dataset change event.

JSON representation 
{
  "dataset": {
    object (Dataset)
  }
}
Fields
dataset

object (Dataset)

Dataset description after the change.

DatasetDeletion

Dataset deletion event.

TableCreation

Table creation event.

JSON representation 
{
  "table": {
    object (Table)
  },
  "reason": enum (Reason),
  "jobName": string
}
Fields
table

object (Table)

Table description.
reason

enum (Reason)

Describes how table was created.
jobName

string

The uri of the job that created a table. Present if the reason is JOB or QUERY.

Table

Table represents a BigQuery table.

JSON representation 
{
  "tableName": string,
  "tableInfo": {
    object (EntityInfo)
  },
  "schemaJson": string,
  "schemaJsonTruncated": boolean,
  "view": {
    object (TableViewDefinition)
  },
  "expireTime": string,
  "createTime": string,
  "updateTime": string,
  "truncateTime": string,
  "encryption": {
    object (EncryptionInfo)
  }
}
Fields
tableName

string

Table uri.
tableInfo

object (EntityInfo)

User-provided metadata for the table.
schemaJson

string

A JSON representation of the table's schema. Entire field is truncated if exceeds 40K.
schemaJsonTruncated

boolean

True if the schemaJson field was truncated.
view

object (TableViewDefinition)

View description. Only present for views.
expireTime

string (Timestamp format)

The expiration date for the table.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
createTime

string (Timestamp format)

The time the table was created.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
updateTime

string (Timestamp format)

The time the table was last updated.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
truncateTime

string (Timestamp format)

The time the table was last truncated.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
encryption

object (EncryptionInfo)

Result table encryption information. Set when non-default encryption is used.

TableViewDefinition

Describes a view.

JSON representation 
{
  "query": string,
  "queryTruncated": boolean
}
Fields
query

string

SQL query defining the view. Truncated if exceeds 40K.
queryTruncated

boolean

True if the schemaJson field was truncated.

TableChange

Table metadata change event.

JSON representation 
{
  "table": {
    object (Table)
  },
  "truncated": boolean,
  "reason": enum (Reason),
  "jobName": string
}
Fields
table

object (Table)

Table description.
truncated

boolean

True if the table was truncated, false otherwise.
reason

enum (Reason)

Describes why the changes occurred.
jobName

string

The uri of the job that changed a table. Present if the reason is JOB or QUERY.

TableDeletion

Table deletion event.

JSON representation 
{
  "reason": enum (Reason),
  "jobName": string
}
Fields
reason

enum (Reason)

Describes how table was deleted.
jobName

string

The uri of the job that deleted a table. Present if the reason is QUERY.

TableDataRead

Table data read event.

JSON representation 
{
  "fields": [
    string
  ],
  "fieldsTruncated": boolean,
  "categories": [
    string
  ],
  "categoriesTruncated": boolean,
  "policyTags": [
    string
  ],
  "policyTagsTruncated": boolean,
  "reason": enum (Reason),
  "jobName": string,
  "sessionName": string
}
Fields
fields[]

string

List of the accessed fields. Entire list is truncated if the record size exceeds 100K.
fieldsTruncated

boolean

True if the fields list is truncated.
categories[]

string
categoriesTruncated

boolean
policyTags[]

string

List of the referenced policy tags. That is, policy tags attached to the accessed fields or their ancestors. Policy tag resource name is a string of the format: "projects//locations//taxonomies//policyTags/"
policyTagsTruncated

boolean

True if the policy tag list is truncated. At most 100 policy tags will be saved.
reason

enum (Reason)

Describes why table data was read.
jobName

string

The uri of the job that read a table. Present if the reason is JOB but can be reducted for privacy reasons.
sessionName

string

The uri of the read session that read a table. Present if the reason is CREATE_READ_SESSION.

TableDataChange

Table data change event.

JSON representation 
{
  "deletedRowsCount": string,
  "insertedRowsCount": string,
  "truncated": boolean,
  "reason": enum (Reason),
  "jobName": string
}
Fields
deletedRowsCount

string (int64 format)

Number of deleted rows.
insertedRowsCount

string (int64 format)

Number of inserted rows.
truncated

boolean

True if the table was truncated, false otherwise.
reason

enum (Reason)

Describes why the changes occurred.
jobName

string

The uri of the job that changed a table.

ModelDeletion

Model deletion event.

JSON representation 
{
  "reason": enum (Reason),
  "jobName": string
}
Fields
reason

enum (Reason)

The reason why the model was deleted.
jobName

string

The URI of the job that deleted a model. Present if and only if the reason is QUERY.

ModelCreation

Model creation event.

JSON representation 
{
  "model": {
    object (Model)
  },
  "reason": enum (Reason),
  "jobName": string
}
Fields
model

object (Model)

Model description.
reason

enum (Reason)

Describes how the model was created.
jobName

string

The URI of the job that created the model.

Model

Model corresponds to a trained BigQuery ML model.

JSON representation 
{
  "modelName": string,
  "modelInfo": {
    object (EntityInfo)
  },
  "expireTime": string,
  "createTime": string,
  "updateTime": string,
  "encryption": {
    object (EncryptionInfo)
  }
}
Fields
modelName

string

Model uri.
modelInfo

object (EntityInfo)

Entity info for the model.
expireTime

string (Timestamp format)

The expiration date for the model.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
createTime

string (Timestamp format)

The time the model was created.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
updateTime

string (Timestamp format)

The time the model was last updated.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
encryption

object (EncryptionInfo)

Encryption information. Set when non-default encryption is used.

ModelMetadataChange

Model metadata change event.

JSON representation 
{
  "model": {
    object (Model)
  },
  "reason": enum (Reason),
  "jobName": string
}
Fields
model

object (Model)

Updated model.
reason

enum (Reason)

Describes how the model metadata was changed.
jobName

string

The URI of the job that changed the model metadata. Present if and only if the reason is QUERY.

ModelDataChange

Model data change event.

JSON representation 
{
  "reason": enum (Reason),
  "jobName": string
}
Fields
reason

enum (Reason)

Describes how the model data was changed.
jobName

string

The URI of the job that changed the model data.

ModelDataRead

Model data read event.

JSON representation 
{
  "reason": enum (Reason),
  "jobName": string
}
Fields
reason

enum (Reason)

Describes how the model data was read.
jobName

string

The URI of the job that read the model data.

RoutineCreation

Routine creation event.

JSON representation 
{
  "routine": {
    object (Routine)
  },
  "reason": enum (Reason),
  "jobName": string
}
Fields
routine

object (Routine)

Created routine.
reason

enum (Reason)

Describes how the routine was created.
jobName

string

The URI of the job that created the routine.

Routine

Routine corresponds to a resource such as a User Defined Function (UDF) or Stored Procedure.

JSON representation 
{
  "routineName": string,
  "createTime": string,
  "updateTime": string
}
Fields
routineName

string

Routine uri.
createTime

string (Timestamp format)

The time the routine was created.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
updateTime

string (Timestamp format)

The time the routine was last updated.

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

RoutineChange

Routine change event.

JSON representation 
{
  "routine": {
    object (Routine)
  },
  "reason": enum (Reason),
  "jobName": string
}
Fields
routine

object (Routine)

Updated routine.
reason

enum (Reason)

Describes how the routine was updated.
jobName

string

The URI of the job that updated the routine.

RoutineDeletion

Routine deletion event.

JSON representation 
{
  "routine": {
    object (Routine)
  },
  "reason": enum (Reason),
  "jobName": string
}
Fields
routine

object (Routine)

Deleted routine.
reason

enum (Reason)

Describes how the routine was deleted.
jobName

string

The URI of the job that deleted the routine.