This page provides information about the logs in Stackdriver Logging and about their structure.
Stackdriver Logging receives, indexes, and stores log entries from many
sources, including Google Cloud Platform, Amazon Web Services, VM instances
running the Stackdriver Logging fluentd agent, and
All log entries in Stackdriver Logging are represented using a single data
LogEntry, which defines certain common data
for all log entries as well as carrying individual payloads.
Stackdriver Logging can also export log entries to Google Cloud Storage,
Google Cloud Pub/Sub, and Google BigQuery.
The LogEntry type
Every log entry in Stackdriver Logging is an object of type
LogEntry that is characterized by the following information:
- The project or organization that owns the log entry.
- The resource to which the log entry applies. This consists of a resource type from the Monitored Resource List and additional values that denote a specific instance.
- A log name.
- A timestamp.
- A payload, which can be a textPayload, a jsonPayload, or (for GCP services) a protoPayload.
Google Cloud Audit Logging has two logs:
- Admin Activity,
activityin the Logs Viewer
- Data Access,
data_accessin the Logs Viewer
Google Cloud Platform services write these logs to help you answer the question of "who did what, where, and when?" within your Google Cloud Platform projects.
Following are some characteristics of the audit log entries:
Audit log entries have type LogEntry, as do all other Stackdriver Logging log entries.
Each audit log entry includes the monitored resource to which it applies. You can find audit logs in the Logs Viewer's resource selector menu under multiple names: BigQuery, GCE instance, etc.
The payload of each audit log entry is an object of type
AuditLog, a protocol buffer.
The audit log entry's payload has a field,
serviceData, that some services use to hold additional information.
All Admin Activity audit log entries are written to the log
cloudaudit.googleapis.com/activity. Each log entry contains a monitored resource that identifies the resource whose activity is audited.
Audit logs cannot be deleted and are not subject to the same retention policy as other logs. For more information, see Audit Logging.
The Stackdriver Logging agent is a fluentd-based process that can run on supported VM instances. The agent sends system and third-party logs on the VM instance to Stackdriver Logging, where they appear as separate logs. For more information, see Logs From the Logging Agent.
Logs available in Stackdriver Logging
The logs available in Stackdriver Logging can vary depending on which resources you are using in your project. Following is an incomplete list of products that send logs to Stackdriver Logging. With each product entry is a link to more information about the logs, the monitored resource type that is used in the product's log entries, whether the product writes audit logs, and whether the product has VM instances that can run the Stackdriver Logging agent.
|Product||Log details||Resource type||Audit logs||Agent logs|
|App Engine (standard)||logs info||
|App Engine (flexible)||logs info||
|Cloud Key Management Service||logs info||
|Compute Engine||logs info||