Available Logs

This page provides information about the logs in Stackdriver Logging and about their structure.

Stackdriver Logging receives, indexes, and stores log entries from many sources, including Google Cloud Platform, Amazon Web Services, VM instances running the Stackdriver Logging fluentd agent, and user applications. All log entries in Stackdriver Logging are represented using a single data type, LogEntry, which defines certain common data for all log entries as well as carrying individual payloads. Stackdriver Logging can also export log entries to Google Cloud Storage, Google Cloud Pub/Sub, and Google BigQuery.

The LogEntry type

Every log entry in Stackdriver Logging is an object of type LogEntry that is characterized by the following information:

  • The project or organization that owns the log entry.
  • The resource to which the log entry applies. This consists of a resource type from the Monitored Resource List and additional values that denote a specific instance.
  • A log name.
  • A timestamp.
  • A payload, which can be a textPayload, a jsonPayload, or (for GCP services) a protoPayload.

For more information about log entry contents, see the LogEntry type in the Stackdriver Logging API.

Audit logs

Google Cloud Audit Logging has two logs:

  • Admin Activity, cloudaudit.googleapis.com/activity, called activity in the Logs Viewer
  • Data Access, cloudaudit.googleapis.com/data_access, called data_access in the Logs Viewer

Google Cloud Platform services write these logs to help you answer the question of "who did what, where, and when?" within your Google Cloud Platform projects.

Following are some characteristics of the audit log entries:

  • Audit log entries have type LogEntry, as do all other Stackdriver Logging log entries.

  • Each audit log entry includes the monitored resource to which it applies. You can find audit logs in the Logs Viewer's resource selector menu under multiple names: BigQuery, GCE instance, etc.

  • The payload of each audit log entry is an object of type AuditLog, a protocol buffer.

  • The audit log entry's payload has a field, serviceData, that some services use to hold additional information.

  • All Admin Activity audit log entries are written to the log cloudaudit.googleapis.com/activity. Each log entry contains a monitored resource that identifies the resource whose activity is audited.

Audit logs cannot be deleted and are not subject to the same retention policy as other logs. For more information, see Audit Logging.

Agent logs

The Stackdriver Logging agent is a fluentd-based process that can run on supported VM instances. The agent sends system and third-party logs on the VM instance to Stackdriver Logging, where they appear as separate logs. For more information, see Logs From the Logging Agent.

Logs available in Stackdriver Logging

The logs available in Stackdriver Logging can vary depending on which resources you are using in your project. Following is an incomplete list of products that send logs to Stackdriver Logging. With each product entry is a link to more information about the logs, the monitored resource type that is used in the product's log entries, whether the product writes audit logs, and whether the product has VM instances that can run the Stackdriver Logging agent.

Product Log details Resource type Audit logs Agent logs
App Engine (standard) logs info gae_app Yes
App Engine (flexible) logs info gae_app Yes
Cloud Key Management Service logs info kms_* Yes
Compute Engine logs info gce_* Yes

Send feedback about...

Stackdriver Logging