This page provides information about the logs in Stackdriver Logging and about their structure.
Stackdriver Logging receives, indexes, and stores log entries from many
sources, including Google Cloud Platform, Amazon Web Services, VM instances
running the Stackdriver Logging fluentd agent, and
All log entries in Stackdriver Logging are represented using a single data
LogEntry, which defines certain common data
for all log entries as well as carrying individual payloads.
Stackdriver Logging can also export log entries to Google Cloud Storage,
Google Cloud Pub/Sub, and Google BigQuery.
The LogEntry type
Every log entry in Stackdriver Logging is an object of type
LogEntry that is characterized by the following information:
- The project or organization that owns the log entry.
- The resource to which the log entry applies. This consists of a resource type from the Monitored Resource List and additional values that denote a specific instance.
- A log name.
- A timestamp.
- A payload, which can be a textPayload, a jsonPayload, or (for GCP services) a protoPayload.
Google Cloud Audit Logging has three logs:
- Admin Activity,
activityin the Logs Viewer
- Data Access,
data_accessin the Logs Viewer
- System Event,
system_eventin the Logs Viewer
Google Cloud Platform services write these logs to help you answer the question of "who did what, where, and when?" within your Google Cloud Platform projects.
Following are some characteristics of the audit log entries:
Audit log entries have type LogEntry, as do all other Stackdriver Logging log entries.
Each audit log entry includes the monitored resource to which it applies. You can find audit logs in the Logs Viewer's resource selector menu under multiple names: BigQuery, GCE instance, etc.
The payload of each audit log entry is an object of type
AuditLog, a protocol buffer.
The audit log entry's payload has a field,
serviceData, that some services use to hold additional information.
All Admin Activity audit log entries are written to the log
cloudaudit.googleapis.com/activity. Each log entry contains a monitored resource that identifies the resource whose activity is audited.
Audit logs cannot be deleted and are not subject to the same retention policy as other logs. For more information, see Audit Logging.
The Stackdriver Logging agent is a fluentd-based process that can run on supported VM instances. The agent sends system and third-party logs on the VM instance to Stackdriver Logging, where they appear as separate logs. For more information, see Default Logging Agent logs.
Logs available in Stackdriver Logging
The logs available in Stackdriver Logging can vary depending on which Google Cloud Platform resources you are using in your project. To learn more, visit the Google Cloud Platform Documentation Home and select the appropriate product or service.