This page describes how Cloud Logging stores your log entries.
Logs buckets
Logs buckets are the containers in your Google Cloud projects that store and organize your logs data.
Overview
For each Google Cloud project, Logging automatically
creates two logs buckets: _Required
and _Default
. All logs generated in
the project are stored in the _Required
and _Default
logs buckets, which
live in the project that the logs are generated in:
_Required
: This bucket holds Admin Activity audit logs, System Event audit logs, and Access Transparency logs, and retains them for 400 days. You aren't charged for the logs stored in_Required
, and the retention period of the logs stored here cannot be modified. You cannot delete this bucket._Default
: This bucket holds all other ingested logs in a Google Cloud project except for the logs held in the_Required
bucket. Standard Cloud Logging pricing applies to these logs. Log entries held in the_Default
bucket are retained for 30 days, unless you apply custom retention rules. You can't delete this bucket, but you can disable the_Default
log sink that routes logs to this bucket
For these buckets, Logging automatically creates log sinks named
_Required
and _Default
that route logs to the corresponding buckets.
In addition to the automatically provided buckets, you can create custom logs buckets in any Google Cloud project. By applying log sinks to your custom logs buckets, you can route any subset of your logs to any logs bucket, letting you choose which Google Cloud project your logs are stored in and which other logs are stored with them.
Logs buckets only have regional availability, including those created in the
global
region.
With custom buckets and the _Default
bucket, you can configure custom
retention periods for different logs.
For more information on how Cloud Logging routes and stores your logs data, see Logs Router overview.
Logs retention
Cloud Logging retains different types of logs for a certain amount of time before they're deleted. The following retention periods apply to logs data:
Logs bucket | Log types | Default retention | Custom retention |
---|---|---|---|
_Required |
Admin Activity audit logs, System Event audit logs, and Access Transparency logs |
400 days | Not configurable |
_Default |
All other ingested logs | 30 days | 1 day to 3650 days |
Custom retention
You can configure Cloud Logging to retain the logs in the _Default
logs
bucket between 1 day and
3650 days.
Retention is configured at the bucket level and applies to all the logs in
the _Default
bucket.
To update the retention period for the _Default
logs bucket, do the following:
GCLOUD
Run this gcloud
command, adjusting
[RETENTION_DAYS]:
gcloud beta logging buckets update _Default --location=global --retention-days=[RETENTION_DAYS]
For example, to retain the logs in the _Default
bucket for a year, enter
the following command:
gcloud beta logging buckets update _Default --location=global --retention-days=365
CONSOLE
Google Cloud Console currently doesn't support customizing logs retention.
Pricing
There are currently no additional charges for extending logs data retention longer than the default retention periods.
Regionalization
When you create your Logs Bucket, you can choose to store your logs in any of the following regions:
asia-east1
europe-west1
us-central1
us-east1
us-west1
In addition to these regions, you also have the option to set the location to
global
, which means that you don't specify where your logs are physically
stored.
Stopping logs ingestion
To learn how to stop ingesting logs into your Google Cloud project, see Stopping logs ingestion.
What's next
For information on addressing common use cases with Logs Buckets, refer to the following documentation:
Aggregate your organization's log into a central Logs Bucket.
Configure multi-tenant logging for Google Kubernetes Engine (GKE) clusters