This page provides basic information about the categories of logs that are available in Cloud Logging, as well as next steps for viewing and managing logs.
Categories of logs
Logging receives, indexes, and stores log entries from many sources, including Google Cloud, VM instances running the Logging agent, and other cloud services providers.
The following sections categorize the kinds of logs supported by Cloud Logging.
Google Cloud platform logs
Google Cloud platform logs are service-specific logs that can help you debug and troubleshoot issues, as well as better understand the Google Cloud services you're using.
The Google Cloud platform logs visible to you in Cloud Logging vary, depending on which Google Cloud resources you're using in your Google Cloud project or organization.
To learn more about the available Google Cloud platform logs, go to Using platform logs.
Note that some Google Cloud platform logs are sent by an agent.
VPC Flow Logs record a sample of network flows sent from and received by VM instances. For details, see Using VPC Flow Logs.
Cloud Logging provides two kinds of security-related logs, Cloud Audit Logs and Access Transparency logs; details are as follows.
Cloud Audit Logs includes three types of audit logs: Admin Activity, Data Access, and System Event. Cloud Audit Logs provide audit trails of administrative changes and data accesses of your Google Cloud resources.
For a list of Google Cloud services that write audit logs, see Google services with audit logs.
For more information about audit logging, see Cloud Audit Logs.
Access Transparency logs
Access Transparency provides you with logs of actions taken by Google staff when accessing your Google Cloud content. Access Transparency logs can help you track compliance with your organization's legal and regulatory requirements.
For a list of Google Cloud services that write Access Transparency logs, see Google services with Access Transparency logs.
For more information, including how to enable Access Transparency logs, see Access Transparency.
Multi-cloud and hybrid-cloud logs
Cloud Logging can ingest logs arriving from other cloud services providers, including Microsoft Azure and Amazon Web Services (AWS). These logs are called "multi-cloud" logs.
Cloud Logging also supports logs from your on-premises infrastructure and apps. If extending Cloud Logging to include your on-premises resources, the logs that are received by Cloud Logging are known as "hybrid-cloud" logs.
For details on how to ingest logs from your on-premises or other cloud sources, see Logging on-premises resources.
Using and managing logs
The following sections provide basic information about using and managing logs in Cloud Logging.
Log entry structure
Cloud Logging represents logs using a single data
LogEntry, which defines certain common data for all log
entries as well as the payloads that Google Cloud services can include.
Every log entry is characterized by the following information:
- A log name. This includes the identifier of the Google Cloud project, folder, or organization that contains the log entry and the identifier of the log type, [LOG_ID].
- The resource from which the log entry originated. This consists of a resource type from the Monitored resource list and corresponding label values that identify a specific instance.
- A timestamp.
- A payload, which can be represented as one of
jsonPayload, or (for some Google Cloud services)
By examining the [LOG_ID] string in each log entry's
you can generally tell which aforementioned log category that the log entry
- If [LOG_ID] contains
cloudaudit.googleapis.com, it is a Cloud Audit Logs or Access Transparency log entry.
- If [LOG_ID] is prefixed by
serviceName.googleapis.com, it is a platform log entry.
- If [LOG_ID] has no service prefix, it is most likely a user log entry.
For more information about log entry contents, see the Logging API
reference for the
There are several ways to view your log entries:
- To read log entries using the Google Cloud Console, see Using the Logs Explorer.
- To read log entries through the Logging API, see the
- To read log entries using the
gcloudcommand-line tool, see Reading log entries.
You can control how your log entries are routed and stored. The Logs Router checks each log entry against existing rules to determine which log entries to discard, which log entries to store in Cloud Logging, and which log entries to include in exports to other destinations.
For details, see Logs Router overview.
Log entries are stored in logs buckets for a specified length of time and are then deleted. For more information, see Storing logs.
For information on logs pricing, see Logging pricing.