Available Logs

This page provides information about the logs in Stackdriver Logging and about their structure.

Stackdriver Logging receives, indexes, and stores log entries from many sources, including Google Cloud Platform, Amazon Web Services, VM instances running the Stackdriver Logging fluentd agent, and user applications. All log entries in Stackdriver Logging are represented using a single data type, LogEntry, which defines certain common data for all log entries as well as carrying individual payloads. Stackdriver Logging can also export log entries to Google Cloud Storage, Google Cloud Pub/Sub, and Google BigQuery.

The LogEntry type

Every log entry in Stackdriver Logging is an object of type LogEntry that is characterized by the following information:

  • The project or organization that owns the log entry.
  • The resource to which the log entry applies. This consists of a resource type from the Monitored Resource List and additional values that denote a specific instance.
  • A log name.
  • A timestamp.
  • A payload, which can be a textPayload, a jsonPayload, or (for GCP services) a protoPayload.

For more information about log entry contents, see the LogEntry type in the Stackdriver Logging API.

Audit logs

Google Cloud Audit Logging has two logs:

  • Admin Activity, cloudaudit.googleapis.com/activity, called activity in the Logs Viewer
  • Data Access, cloudaudit.googleapis.com/data_access, called data_access in the Logs Viewer

Google Cloud Platform services write these logs to help you answer the question of "who did what, where, and when?" within your Google Cloud Platform projects.

Following are some characteristics of the audit log entries:

  • Audit log entries have type LogEntry, as do all other Stackdriver Logging log entries.

  • Each audit log entry includes the monitored resource to which it applies. You can find audit logs in the Logs Viewer's resource selector menu under multiple names: BigQuery, GCE instance, etc.

  • The payload of each audit log entry is an object of type AuditLog, a protocol buffer.

  • The audit log entry's payload has a field, serviceData, that some services use to hold additional information.

  • All Admin Activity audit log entries are written to the log cloudaudit.googleapis.com/activity. Each log entry contains a monitored resource that identifies the resource whose activity is audited.

Audit logs cannot be deleted and are not subject to the same retention policy as other logs. For more information, see Audit Logging.

Agent logs

The Stackdriver Logging agent is a fluentd-based process that can run on supported VM instances. The agent sends system and third-party logs on the VM instance to Stackdriver Logging, where they appear as separate logs. For more information, see Default Logging Agent logs.

Logs available in Stackdriver Logging

The logs available in Stackdriver Logging can vary depending on which Google Cloud Platform resources you are using in your project. To learn more, visit the Google Cloud Platform Documentation Home and select the appropriate product or service.

Was this page helpful? Let us know how we did:

Send feedback about...

Stackdriver Logging