antisaWiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
{{tag>google bigquery log}}

====== Query Google cloud logs ======
Login to [[https://console.cloud.google.com|Google console cloud]] and select the project from dropdown list and find the "Logging" product in hamburger menu (it's pinned here in the scrot, you will need to scroll down)

{{:wiki:screenshots:google_cloud_menu.png?200|}}

This should open the logs explorer, where you need to select the **Resource** from the dropdown. 

{{:wiki:screenshots:google_cloud_logging.png?600|}}

For example to search access from IPs to BigQuery dataset choose //BigQuery dataset// then use a query, example

<code>
resource.type="bigquery_dataset"
logName=("projects/my-test-project/logs/cloudaudit.googleapis.com%2Factivity" OR "projects/my-test-project/logs/cloudaudit.googleapis.com%2Fdata_access")
-"BigQuery Data Transfer Service"
protoPayload.methodName="google.cloud.bigquery.v2.JobService.InsertJob"
-(protoPayload.requestMetadata.callerSuppliedUserAgent="Mozilla/5.0 (compatible; Google-Apps-Script),gzip(gfe)")
-(protoPayload.requestMetadata.callerIp="1.1.1.1")
-(protoPayload.requestMetadata.callerSuppliedUserAgent="Mozilla/5.0 (compatible; Google-Apps-Script; beanserver; +https://script.google.com),gzip(gfe)")
(protoPayload.resourceName="projects/my-test-project/datasets/test_raw_data/tables/TABLE_1")
timestamp>"2022-05-1" AND timestamp <"2022-05-2"
</code>

This will show logs that **don't** have //callerIp// set to 1.1.1.1 ("-" before parenthesis) among other filters set.

====== Tested on ======
  * Google cloud console access on May 5th 2022.

====== See also ======

====== References ======
  * https://cloud.google.com/logging/docs/view/building-queries