Regionalize your logs

This page describes how to store your logs in a Cloud Logging bucket in a designated region.

For conceptual information on logs data location, see Understand data regions.

Tip: If you want to automatically apply a particular storage region to the new _Default and _Required buckets created in your organization, you can configure a default resource location.

This guide walks through this process using the example of redirecting all logs to the europe-west1 region. This process involves the following steps:

1. Create a log bucket in the designated region for storing the logs.

2. Redirect the _Default sink to route the logs to the new log bucket.

3. Search for logs in the Logs Explorer.

4. (Optional) Update the log retention period.

Before you begin

To complete the steps in this guide, you need to know the following:

• In which Google Cloud project do you want to store the logs? In this guide, we use a Cloud project called logs-test-project.

• What is the name and location of the log bucket in which you want to store the logs? In this guide, the bucket name is region-1-logs-bucket, and the location is europe-west1.

  When you create your log bucket, you can choose to store your logs in any of the following regions:

Americas

Region name	Region description
northamerica-northeast1	Montréal
northamerica-northeast2	Toronto
southamerica-east1	São Paulo
southamerica-west1	Santiago
us-central1	Iowa
us-east1	South Carolina
us-east4	North Virginia
us-east5	Columbus
us-south1	Dallas
us-west1	Oregon
us-west2	Los Angeles
us-west3	Salt Lake City
us-west4	Las Vegas

Asia Pacific

Region name	Region description
asia-east1	Taiwan
asia-east2	Hong Kong
asia-northeast1	Tokyo
asia-northeast2	Osaka
asia-northeast3	Seoul
asia-south1	Mumbai
asia-south2	Delhi
asia-southeast1	Singapore
asia-southeast2	Jakarta
australia-southeast1	Sydney
australia-southeast2	Melbourne

Europe

Region name	Region description
europe-central2	Warsaw
europe-north1	Finland
europe-southwest1	Madrid
europe-west1	Belgium
europe-west2	London
europe-west3	Frankfurt
europe-west4	Netherlands
europe-west6	Zurich
europe-west8	Milan
europe-west9	Paris

Middle East

Region name	Region description
me-west1	Tel Aviv

Other

Region name	Region description
eu	Logs stored in data centers within the European Union; no additional redundancy guarantees
us	Logs stored in data centers within the United States; no additional redundancy guarantees
global	Logs stored in any data center in the world; no additional redundancy guarantees

• Which logs do you want to include? In this guide, we include all logs routed by the _Default sink.

Note: Error Reporting is a global service built on Cloud Logging and doesn't analyze logs stored in regional log buckets, logs that are routed to other projects, or logs stored in log buckets that use customer-managed encryption keys.

Create the log bucket

Log buckets store the logs that are routed from other Google Cloud projects, folders, or organizations. For more information, see Configure log buckets.

To create the bucket in the Cloud project that you want to store logs in, complete the following steps:

1. Open the Google Cloud console in the Cloud project you're using to store the logs.

   Go to Google Cloud console

2. In a terminal, run the following command to create a bucket, replacing the parts in bold with your own information:

    gcloud logging buckets create region-1-logs-bucket \
      --location=europe-west1 \
      --project=logs-test-project
   

   Note: After you create your bucket, you can't change your bucket's region.

3. Verify that the bucket was created:

   gcloud logging buckets list --project=logs-test-project
   

Redirect the _Default logs sink

You route logs to a log bucket by creating a sink. A sink includes a filter, which selects which log entries to export through the sink, and a destination. In this guide, we update the existing _Default sink to route logs to our bucket, region-1-logs-bucket.

Note: Redirecting the _Default sink ensures that all future logs go into the regionalized log bucket rather than the _Default bucket, which is global. You can't change the _Required sink, with the logs going into a different global bucket.

To update the sink, run the following command, replacing the parts in bold with your own information:

gcloud logging sinks update _Default \
  logging.googleapis.com/projects/logs-test-project/locations/europe-west1/buckets/region-1-logs-bucket \
  --log-filter='NOT LOG_ID("cloudaudit.googleapis.com/activity") AND NOT
    LOG_ID("externalaudit.googleapis.com/activity") AND NOT
    LOG_ID("cloudaudit.googleapis.com/system_event") AND NOT
    LOG_ID("externalaudit.googleapis.com/system_event") AND NOT
    LOG_ID("cloudaudit.googleapis.com/access_transparency") AND NOT
    LOG_ID("externalaudit.googleapis.com/access_transparency")' \
  --description="Updated the _Default sink to route logs to the europe-west1 region"

Note: The log-filter shown in the command is the default filter for the _Default sink. The _Required sink routes these logs, so the _Default sink routes all other logs besides these to avoid overlap.

Create a log entry to test your sink

To verify that you updated the sink properly, complete the following steps:

1. Send a test log message to your regionalized bucket using the gcloud logging write command. For example:

   gcloud logging write TEST_LOG_NAME "Test to route logs to region-1-logs-bucket" --project=logs-test-project
   

2. After a few minutes, view your log entry in Logs Explorer:

   Go to Logs Explorer

3. In the Log field pane, select the Global resource type.

4. Your test log entry displays in the Query results panel.

Search logs in the Google Cloud console

After setting the permissions in the previous section, go to the Google Cloud console and complete the following steps:

1. From the Logging menu for the project you're using to store the logs, select Logs Explorer.

   Go to Logs Explorer

2. Select Refine Scope.

3. On the Refine scope panel, select Scope by storage.

4. Select region-1-logs-bucket.

5. Click Apply.

6. The Logs Explorer refreshes to show logs from your bucket.

   For information on using the Logs Explorer, refer to Using the Logs Explorer.

[Optional] Updating the bucket's log retention period

To change the retention period for your logs in your bucket, run the following command:

gcloud logging buckets update region-1-logs-bucket \
  --location=europe-west1 --project=logs-test-project \
  --retention-days=14

Next steps

• View all the Google Cloud services available in locations worldwide.

• Explore additional location-based concepts, such as zones, that apply to other Google Cloud services.

• Read the following whitepapers that provide best practices for data governance:

  • Logs data: A step by step guide for overcoming common compliance challenges

  • Data governance: Principles for securing and managing logs