Storing logs

This page describes how Cloud Logging stores your log entries.

Logs buckets

Logs buckets are the containers in your Google Cloud projects that store and organize your logs data.

Overview

For each Google Cloud project, Logging automatically creates two logs buckets: _Required and _Default. All logs generated in the project are stored in the _Required and _Default logs buckets, which live in the project that the logs are generated in:

  • _Required: This bucket holds Admin Activity audit logs, System Event audit logs, and Access Transparency logs, and retains them for 400 days. You aren't charged for the logs stored in _Required, and the retention period of the logs stored here cannot be modified. You cannot delete this bucket.

  • _Default: This bucket holds all other ingested logs in a Google Cloud project except for the logs held in the _Required bucket. Standard Cloud Logging pricing applies to these logs. Log entries held in the _Default bucket are retained for 30 days, unless you apply custom retention rules. You can't delete this bucket, but you can disable the _Default log sink that routes logs to this bucket

For these buckets, Logging automatically creates log sinks named _Required and _Default that route logs to the corresponding buckets.

In addition to the automatically provided buckets, you can create custom logs buckets in any Google Cloud project. By applying log sinks to your custom logs buckets, you can route any subset of your logs to any logs bucket, letting you choose which Google Cloud project your logs are stored in and which other logs are stored with them.

Logs buckets only have regional availability, including those created in the global region.

With custom buckets and the _Default bucket, you can configure custom retention periods for different logs.

For more information on how Cloud Logging routes and stores your logs data, see Logs Router overview.

Logs retention

Cloud Logging retains different types of logs for a certain amount of time before they're deleted. The following retention periods apply to logs data:

Logs bucket Log types Default retention Custom retention
_Required Admin Activity audit logs, System Event audit logs,
and Access Transparency logs
400 days Not configurable
_Default All other ingested logs 30 days 1 day to 3650 days

Custom retention

You can configure Cloud Logging to retain the logs in the _Default logs bucket between 1 day and 3650 days.

Retention is configured at the bucket level and applies to all the logs in the _Default bucket.

To update the retention period for the _Default logs bucket, do the following:

GCLOUD

Run this gcloud command, adjusting [RETENTION_DAYS]:

gcloud beta logging buckets update _Default --location=global --retention-days=[RETENTION_DAYS]

For example, to retain the logs in the _Default bucket for a year, enter the following command:

gcloud beta logging buckets update _Default --location=global --retention-days=365

CONSOLE

Google Cloud Console currently doesn't support customizing logs retention.

Pricing

There are currently no additional charges for extending logs data retention longer than the default retention periods.

Regionalization

When you create your Logs Bucket, you can set the region in which you want to store your logs data. Setting the location to global means that it is not specified where the logs are physically stored.

What's next

For information on addressing common use cases with Logs Buckets, refer to the following documentation: