User Tools

Site Tools


wiki:query_google_cloud_logs

Query Google cloud logs

Login to Google console cloud and select the project from dropdown list and find the “Logging” product in hamburger menu (it's pinned here in the scrot, you will need to scroll down)

This should open the logs explorer, where you need to select the Resource from the dropdown.

For example to search access from IPs to BigQuery dataset choose BigQuery dataset then use a query, example

resource.type="bigquery_dataset"
logName=("projects/my-test-project/logs/cloudaudit.googleapis.com%2Factivity" OR "projects/my-test-project/logs/cloudaudit.googleapis.com%2Fdata_access")
-"BigQuery Data Transfer Service"
protoPayload.methodName="google.cloud.bigquery.v2.JobService.InsertJob"
-(protoPayload.requestMetadata.callerSuppliedUserAgent="Mozilla/5.0 (compatible; Google-Apps-Script),gzip(gfe)")
-(protoPayload.requestMetadata.callerIp="1.1.1.1")
-(protoPayload.requestMetadata.callerSuppliedUserAgent="Mozilla/5.0 (compatible; Google-Apps-Script; beanserver; +https://script.google.com),gzip(gfe)")
(protoPayload.resourceName="projects/my-test-project/datasets/test_raw_data/tables/TABLE_1")
timestamp>"2022-05-1" AND timestamp <"2022-05-2"

This will show logs that don't have callerIp set to 1.1.1.1 (“-” before parenthesis) among other filters set.

Tested on

  • Google cloud console access on May 5th 2022.

See also

References

wiki/query_google_cloud_logs.txt · Last modified: 2022/08/11 13:03 by antisa

Except where otherwise noted, content on this wiki is licensed under the following license: CC0 1.0 Universal
CC0 1.0 Universal Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki