LoggingLogSink

This resource is able to configure log sinks for a project, folder, or organization. The parent resource is configured by setting one of projectRef, folderRef, or organizationRef.

Property Value
Google Cloud Service Name Cloud Logging
Google Cloud Service Documentation /logging/docs/
Google Cloud REST Resource Name 
v2.folders.sinks
 
v2.organizations.sinks
 
v2.projects.sinks
Google Cloud REST Resource Documentation 
/logging/docs/reference/v2/rest/v2/folders.sinks
 
/logging/docs/reference/v2/rest/v2/organizations.sinks
 
/logging/docs/reference/v2/rest/v2/projects.sinks
Config Connector Resource Short Names gcplogginglogsink
gcplogginglogsinks
logginglogsink
Config Connector Service Name logging.googleapis.com
Config Connector Resource Fully Qualified Name logginglogsinks.logging.cnrm.cloud.google.com
Can Be Referenced by IAMPolicy/IAMPolicyMember No
Config Connector Default Average Reconcile Interval In Seconds 600

Custom Resource Definition Properties

Spec

Schema

bigqueryOptions:
  usePartitionedTables: boolean
description: string
destination:
  bigQueryDatasetRef:
    external: string
    name: string
    namespace: string
  loggingLogBucketRef:
    external: string
    name: string
    namespace: string
  pubSubTopicRef:
    external: string
    name: string
    namespace: string
  storageBucketRef:
    external: string
    name: string
    namespace: string
disabled: boolean
exclusions:
- description: string
  disabled: boolean
  filter: string
  name: string
filter: string
folderRef:
  external: string
  name: string
  namespace: string
includeChildren: boolean
organizationRef:
  external: string
  name: string
  namespace: string
projectRef:
  external: string
  name: string
  namespace: string
resourceID: string
uniqueWriterIdentity: boolean
Fields

bigqueryOptions

Optional

object

Options that affect sinks exporting data to BigQuery.

bigqueryOptions.usePartitionedTables

Required*

boolean

Whether to use BigQuery's partition tables. By default, Logging creates dated tables based on the log entries' timestamps, e.g. syslog_20170523. With partitioned tables the date suffix is no longer present and special query syntax has to be used instead. In both cases, tables are sharded based on UTC timezone.

description

Optional

string

A description of this sink. The maximum length of the description is 8000 characters.

destination

Required

object

destination.bigQueryDatasetRef

Optional

object

destination.bigQueryDatasetRef.external

Optional

string

Allowed value: string of the format `bigquery.googleapis.com/projects/{{project}}/datasets/{{value}}`, where {{value}} is the `name` field of a `BigQueryDataset` resource.

destination.bigQueryDatasetRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

destination.bigQueryDatasetRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

destination.loggingLogBucketRef

Optional

object

Only `external` field is supported to configure the reference.

destination.loggingLogBucketRef.external

Optional

string

Allowed value: string of the format `logging.googleapis.com/projects/{{project}}/locations/{{location}}/buckets/{{value}}`, where {{value}} is the `name` field of a `LoggingLogBucket` resource.

destination.loggingLogBucketRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

destination.loggingLogBucketRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

destination.pubSubTopicRef

Optional

object

destination.pubSubTopicRef.external

Optional

string

Allowed value: string of the format `pubsub.googleapis.com/projects/{{project}}/topics/{{value}}`, where {{value}} is the `name` field of a `PubSubTopic` resource.

destination.pubSubTopicRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

destination.pubSubTopicRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

destination.storageBucketRef

Optional

object

destination.storageBucketRef.external

Optional

string

Allowed value: string of the format `storage.googleapis.com/{{value}}`, where {{value}} is the `name` field of a `StorageBucket` resource.

destination.storageBucketRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

destination.storageBucketRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

disabled

Optional

boolean

If set to True, then this sink is disabled and it does not export any log entries.

exclusions

Optional

list (object)

Log entries that match any of the exclusion filters will not be exported. If a log entry is matched by both filter and one of exclusion's filters, it will not be exported.

exclusions[]

Optional

object

exclusions[].description

Optional

string

A description of this exclusion.

exclusions[].disabled

Optional

boolean

If set to True, then this exclusion is disabled and it does not exclude any log entries.

exclusions[].filter

Required*

string

An advanced logs filter that matches the log entries to be excluded. By using the sample function, you can exclude less than 100% of the matching log entries.

exclusions[].name

Required*

string

A client-assigned identifier, such as "load-balancer-exclusion". Identifiers are limited to 100 characters and can include only letters, digits, underscores, hyphens, and periods. First character has to be alphanumeric.

filter

Optional

string

The filter to apply when exporting logs. Only log entries that match the filter are exported.

folderRef

Optional

object

The folder in which to create the sink. Only one of projectRef, folderRef, or organizationRef may be specified.

folderRef.external

Optional

string

Allowed value: The `folderId` field of a `Folder` resource.

folderRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

folderRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

includeChildren

Optional

boolean

Immutable. Whether or not to include children organizations in the sink export. If true, logs associated with child projects are also exported; otherwise only logs relating to the provided organization are included.

organizationRef

Optional

object

The organization in which to create the sink. Only one of projectRef, folderRef, or organizationRef may be specified.

organizationRef.external

Optional

string

Allowed value: The `name` field of an `Organization` resource.

organizationRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

organizationRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

projectRef

Optional

object

The project in which to create the sink. Only one of projectRef, folderRef, or organizationRef may be specified.

projectRef.external

Optional

string

Allowed value: The `name` field of a `Project` resource.

projectRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

projectRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

resourceID

Optional

string

Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default.

uniqueWriterIdentity

Optional

boolean

Whether or not to create a unique identity associated with this sink. If false (the default), then the writer_identity used is serviceAccount:cloud-logs@system.gserviceaccount.com. If true, then a unique service account is created and used for this sink. If you wish to publish logs across projects, you must set unique_writer_identity to true.

* Field is required when parent field is specified

Status

Schema

conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
observedGeneration: integer
writerIdentity: string
Fields
conditions

list (object)

Conditions represent the latest available observation of the resource's current state.
conditions[]

object
conditions[].lastTransitionTime

string

Last time the condition transitioned from one status to another.
conditions[].message

string

Human-readable message indicating details about last transition.
conditions[].reason

string

Unique, one-word, CamelCase reason for the condition's last transition.
conditions[].status

string

Status is the status of the condition. Can be True, False, Unknown.
conditions[].type

string

Type is the type of the condition.
observedGeneration

integer

ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.
writerIdentity

string

The identity associated with this sink. This identity must be granted write access to the configured destination.

Sample YAML(s)

Folder Sink

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogSink
metadata:
  name: logginglogsink-sample-folder
spec:
  folderRef:
    name: logginglogsink-dep-folder
  destination:
    bigQueryDatasetRef:
      name: logginglogsinkdepfolder
  filter: resource.type="bigquery_project" AND logName:"cloudaudit.googleapis.com"
---
apiVersion: bigquery.cnrm.cloud.google.com/v1beta1
kind: BigQueryDataset
metadata:
  annotations:
    cnrm.cloud.google.com/delete-contents-on-destroy: "true"
  name: logginglogsinkdepfolder
---
apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
kind: Folder
metadata:
  annotations:
    # Replace "${ORG_ID?}" with the numeric ID for your organization
    cnrm.cloud.google.com/organization-id: "${ORG_ID?}"
  name: logginglogsink-dep-folder
spec:
  displayName: Folder Log Sink Sample

Organization Sink

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogSink
metadata:
  name: logginglogsink-sample-org
spec:
  organizationRef:
    # Replace "${ORG_ID?}" with the numeric ID for your organization
    external: "${ORG_ID?}"
  destination:
    storageBucketRef:
      # StorageBucket names must be globally unique. Replace ${PROJECT_ID?} with your project ID.
      name: ${PROJECT_ID?}-logginglogsink-dep-org
  filter: resource.type="bigquery_project" AND logName:"cloudaudit.googleapis.com"
---
apiVersion: storage.cnrm.cloud.google.com/v1beta1
kind: StorageBucket
metadata:
  annotations:
    cnrm.cloud.google.com/force-destroy: "true"
  # StorageBucket names must be globally unique. Replace ${PROJECT_ID?} with your project ID.
  name: ${PROJECT_ID?}-logginglogsink-dep-org

Project Sink

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogSink
metadata:
  name: logginglogsink-sample-project
spec:
  projectRef:
    name: logginglogsink-dep-project
  uniqueWriterIdentity: true
  destination:
    pubSubTopicRef:
      name: logginglogsink-dep-project
  filter: resource.type="bigquery_project" AND logName:"cloudaudit.googleapis.com"
---
apiVersion: pubsub.cnrm.cloud.google.com/v1beta1
kind: PubSubTopic
metadata:
  name: logginglogsink-dep-project
---
apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
kind: Project
metadata:
  name: logginglogsink-dep-project
spec:
  name: Config Connector Sample
  organizationRef:
    # Replace "${ORG_ID?}" with the numeric ID for your organization
    external: "${ORG_ID?}"
  billingAccountRef:
    # Replace "${BILLING_ACCOUNT_ID?}" with the numeric ID for your billing account
    external: "${BILLING_ACCOUNT_ID?}"