This page describes how Cloud Logging stores your log entries.
Logs buckets are the containers in your Google Cloud projects that store and organize your logs data.
For each Google Cloud project, Logging automatically
creates two logs buckets:
_Default. All logs generated in
the project are stored in the
_Default logs buckets, which
live in the project that the logs are generated in:
_Required: This bucket holds Admin Activity audit logs, System Event audit logs, and Access Transparency logs, and retains them for 400 days. You aren't charged for the logs stored in
_Required, and the retention period of the logs stored here cannot be modified. You cannot delete this bucket.
_Default: This bucket holds all other ingested logs in a Google Cloud project except for the logs held in the
_Requiredbucket. Standard Cloud Logging pricing applies to these logs. Log entries held in the
_Defaultbucket are retained for 30 days, unless you apply custom retention rules. You can't delete this bucket, but you can disable the
_Defaultlog sink that routes logs to this bucket
For these buckets, Logging automatically creates log sinks named
_Default that route logs to the corresponding buckets.
In addition to the automatically provided buckets, you can create custom logs buckets in any Google Cloud project. By applying log sinks to your custom logs buckets, you can route any subset of your logs to any logs bucket, letting you choose which Google Cloud project your logs are stored in and which other logs are stored with them.
Logs buckets only have regional availability, including those created in the
With custom buckets and the
_Default bucket, you can configure custom
retention periods for different logs.
For more information on how Cloud Logging routes and stores your logs data, see Logs Router overview.
Cloud Logging retains different types of logs for a certain amount of time before they're deleted. The following retention periods apply to logs data:
|Logs bucket||Log types||Default retention||Custom retention|
||Admin Activity audit logs, System Event audit logs,
and Access Transparency logs
|400 days||Not configurable
||All other ingested logs||30 days||1 day to 3650 days|
You can configure Cloud Logging to retain the logs in the
bucket between 1 day and
Retention is configured at the bucket level and applies to all the logs in
To update the retention period for the
_Default logs bucket, do the following:
gcloud command, adjusting
gcloud beta logging buckets update _Default --location=global --retention-days=[RETENTION_DAYS]
For example, to retain the logs in the
_Default bucket for a year, enter
the following command:
gcloud beta logging buckets update _Default --location=global --retention-days=365
Google Cloud Console currently doesn't support customizing logs retention.
There are currently no additional charges for extending logs data retention longer than the default retention periods.
When you create your Logs Bucket, you can set the region in which you want to store your logs data. You can select one of the following regions:
In addition to these regions, you also have the option to set the location to
global, which means that you don't specify where your logs are physically
Stopping logs ingestion
To learn how to stop ingesting logs into your Google Cloud project, see Stopping logs ingestion.
For information on addressing common use cases with Logs Buckets, refer to the following documentation: