Storing logs

This page describes how Cloud Logging stores your log entries.

Logs buckets

Logs buckets are the containers in your Google Cloud projects that store and organize your logs data.

Overview

For each Google Cloud project, Logging automatically creates two logs buckets: _Required and _Default. All logs generated in the project are stored in the _Required and _Default logs buckets, which live in the project that the logs are generated in:

• _Required: This bucket holds Admin Activity audit logs, System Event audit logs, and Access Transparency logs, and retains them for 400 days. You aren't charged for the logs stored in _Required, and the retention period of the logs stored here cannot be modified. You cannot delete this bucket.

• _Default: This bucket holds all other ingested logs in a Google Cloud project except for the logs held in the _Required bucket. Standard Cloud Logging pricing applies to these logs. Log entries held in the _Default bucket are retained for 30 days, unless you apply custom retention rules. You can't delete this bucket, but you can disable the _Default log sink that routes logs to this bucket

For these buckets, Logging automatically creates log sinks named _Required and _Default that route logs to the corresponding buckets.

In addition to the automatically provided buckets, you can create custom logs buckets in any Google Cloud project. By applying log sinks to your custom logs buckets, you can route any subset of your logs to any logs bucket, letting you choose which Google Cloud project your logs are stored in and which other logs are stored with them.

Logs buckets only have regional availability, including those created in the global region.

With custom buckets and the _Default bucket, you can configure custom retention periods for different logs.

For more information on how Cloud Logging routes and stores your logs data, see Logs Router overview.

Logs retention

Cloud Logging retains different types of logs for a certain amount of time before they're deleted. The following retention periods apply to logs data:

Logs bucket	Log types	Default retention	Custom retention
_Required	Admin Activity audit logs, System Event audit logs, and Access Transparency logs	400 days	Not configurable
_Default	All other ingested logs	30 days	1 day to 3650 days

Custom retention

You can configure Cloud Logging to retain the logs in the _Default logs bucket between 1 day and 3650 days.

Retention is configured at the bucket level and applies to all the logs in the _Default bucket.

To update the retention period for the _Default logs bucket, do the following:

GCLOUD

Run this gcloud command, adjusting [RETENTION_DAYS]:

gcloud beta logging buckets update _Default --location=global --retention-days=[RETENTION_DAYS]

For example, to retain the logs in the _Default bucket for a year, enter the following command:

gcloud beta logging buckets update _Default --location=global --retention-days=365

CONSOLE

Google Cloud Console currently doesn't support customizing logs retention.

Pricing

Note: Effective March 31, 2021, storage costs will apply to all chargeable logs retained longer than the default retention periods at the rate of $.01 per GiB per month (or fraction thereof). For details, see Logs storage pricing.

There are currently no additional charges for extending logs data retention longer than the default retention periods.

Regionalization

When you create your Logs Bucket, you can choose to store your logs in any of the following regions:

• asia-east1
• europe-west1
• us-central1
• us-east1
• us-west1

In addition to these regions, you also have the option to set the location to global, which means that you don't specify where your logs are physically stored.

Note: Once you create your bucket, you can't change your bucket's region. If you need a bucket in a different region, you must create a new bucket in that region, redirect the appropriate sinks to the new bucket, and then delete the old bucket.

Stopping logs ingestion

To learn how to stop ingesting logs into your Google Cloud project, see Stopping logs ingestion.

What's next

For information on addressing common use cases with Logs Buckets, refer to the following documentation:

• Aggregate your organization's log into a central Logs Bucket.

• Configure multi-tenant logging for Google Kubernetes Engine (GKE) clusters