Managing log views on your log buckets

Log views let you control who has access to the logs within your log buckets. Using the Logs Router and Managing log buckets, you can centralize or subdivide your log storage based on your needs. Custom log views provide you with an advanced and granular way to control access to the logs in those log buckets.

For example, consider a scenario in which you store all of your organization's logs in a central project. Because log buckets can contain logs from multiple projects, you might want to control which projects different users can view logs from. Using custom log views, you can give one user access to logs only from a single project, while you give another user access to logs from all the projects.

Cloud Logging automatically creates the _AllLogs view for every bucket, which shows all logs. Cloud Logging also creates a view for the _Default bucket called _Default. The _Default view for the _Default bucket shows all logs except Data Access audit logs. The _AllLogs and _Default views are not editable.

The following instructions explain how to create, view, update, and delete Logs Views. Managing log views involves performing the following actions:

1. Using the gcloud command-line tool or API to create the view.
2. Setting the Identity and Access Management (IAM) permissions through the Google Cloud Console or through the gcloud command-line tool.

Before you begin

Before creating a log view, complete the following steps:

• If you haven't done so already, create a new log bucket and route logs to the bucket.

• Determine which logs you want to include in the view.

• Ensure you have either of the following roles:

  • roles/logging.admin

  • roles/logging.configWriter

• If you haven't done so already, install the Cloud SDK.

  Note: The gcloud commands in this guide might not run properly in Cloud Shell, so run them in a local terminal.

When creating a log view, be aware of the following conditions:

• The filter for a log view can contain the following:

  • A log source using the source function

  • A log ID using the log_id function

  • A valid resource type using the resource.type= FIELD_NAME

• The filter for a log view cannot contain OR operators.

• You can create a maximum of 10 log views per log bucket.

Creating a log view

To create a log view, run the following command, replacing the parts in bold with your own information:

gcloud logging views create VIEW_ID \
  --log-filter="resource.type=gce_instance" --bucket=BUCKET_NAME \
  --location=LOCATION --description="Log view for the central log bucket for Compute Engine instance"

List the views for your bucket to confirm that your view was created:

gcloud logging views list --bucket=BUCKET_NAME --location=LOCATION

Adding users to a log view

To add users to a view to let them access the logs, complete the following steps.

gcloud

1. Get the project's IAM policy and write it to a local file in JSON format:

   gcloud projects get-iam-policy PROJECT_ID --format json > output.json
   

2. Add an IAM condition that lets the user read from the bucket you created. For example:

   {
     "bindings": [
       {
         "members": [
           "[e-mail]"
         ],
         "role": "roles/logging.viewAccessor",
         "condition": {
             "title": "Bucket reader condition example",
             "description": "Grants logging.viewAccessor role to user [e-mail] for the [VIEW_ID] log view.",
             "expression":
               "resource.name == \"projects/[PROJECT_ID]/locations/[LOCATION]/buckets/[BUCKET_NAME]/views/[VIEW_ID]\""
         }
       }
     ],
     "etag": "BwWd_6eERR4=",
     "version": 3
   }

   Note: If you aren't already using IAM Conditions in your policy, then the version may need to be changed. Be sure to specify version 3. For information on policy versions, refer to the IAM documentation for Understanding policies.

3. Update the IAM policy:

   gcloud projects set-iam-policy PROJECT_ID output.json
   

Console

1. In the Cloud Console for the project where you created the bucket, go to the IAM page.

   Go to the IAM page

2. Click Add.

3. In the New member field, add the user's email account.

4. In the Select a role drop-down menu, select Logs Views Accessor.

   This role provides users with read access to all views. To limit user access to a specific view, add a condition based on the resource name.

   1. Click Add condition.

   2. Enter a Title and Description for the condition.

   3. In the Condition type drop-down menu, select Resource > Name.

   4. In the Operator drop-down menu, select is.

   5. In the Value field, enter the ID of the log view, including the full path to the view.

      For example:

      projects/PROJECT_ID/locations/LOCATION/buckets/BUCKET_NAME/views/VIEW_ID

   6. Click Save to add the condition.

5. Click Save to set the permissions.

For more information, see IAM Conditions overview.

Updating a log view

To update a log view, run the following command, replacing the parts in bold with your own information:

gcloud logging views update VIEW_ID \
  --log-filter="resource.type=gce_instance" --bucket=NEW_BUCKET_NAME \
  --location=LOCATION --description="New description for the log view"

List the views for your bucket to confirm that your view was updated:

gcloud logging views list --bucket=NEW_BUCKET_NAME --location=LOCATION

You can't update the _Default and _AllLogs views.

Deleting a log view

To delete a log view, run the following command, replacing the parts in bold with your own information:

gcloud logging views delete VIEW_ID \
  --bucket=BUCKET_NAME --location=LOCATION

List the views for your bucket to confirm that your view was deleted:

gcloud logging views list --bucket=BUCKET_NAME --location=LOCATION

Viewing information about a log view

To describe a log view, run the following command, replacing the parts in bold with your own information:

gcloud logging views describe VIEW_ID \
  --bucket=BUCKET_NAME --location=LOCATION

Viewing logs associated with a log view

To view logs in a log view, ensure you have the roles/logging.viewAccessor role for the log view.

Go to the Logs Explorer.

Go to Logs Explorer

Click Refine scope to display the Refine scope panel. From here, you can select the log bucket and log view you want to use to view your logs.

For more information, refer to the Logs Explorer documentation.

What's next

Go to the Logs Explorer to verify that the view you created provides access to the correct logs.

Go to Logs Explorer