Log Sink

Docs > DDSQL Reference > Data Directory > Log Sink

A Log Sink in Google Cloud is a resource that exports log entries from Cloud Logging to a chosen destination such as Cloud Storage, BigQuery, or Pub/Sub. It allows you to route and store logs outside of Cloud Logging for long-term retention, advanced analysis, or integration with other systems.

gcp.logging_log_sink

Fields

ID	Type	Data Type	Description
_key	core	string
ancestors	core	array<string>
bigquery_options	core	json	Optional. Options that affect sinks exporting data to BigQuery.
create_time	core	timestamp	Output only. The creation timestamp of the sink.This field may not be present for older sinks.
datadog_display_name	core	string
description	core	string	Optional. A description of this sink.The maximum length of the description is 8000 characters.
destination	core	string	Required. The export destination: "storage.googleapis.com/[GCS_BUCKET]" "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]" "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]" "logging.googleapis.com/projects/[PROJECT_ID]" "logging.googleapis.com/projects/[PROJECT_ID]/locations/[LOCATION_ID]/buckets/[BUCKET_ID]" The sink's writer_identity, set when the sink is created, must have permission to write to the destination or else the log entries are not exported. For more information, see Exporting Logs with Sinks (https://cloud.google.com/logging/docs/api/tasks/exporting-logs).
disabled	core	bool	Optional. If set to true, then this sink is disabled and it does not export any log entries.
exclusions	core	json	Optional. Log entries that match any of these exclusion filters will not be exported.If a log entry is matched by both filter and one of exclusions it will not be exported.
filter	core	string	Optional. An advanced logs filter (https://cloud.google.com/logging/docs/view/advanced-queries). The only exported log entries are those that are in the resource owning the sink and that match the filter.For example:logName="projects/[PROJECT_ID]/logs/[LOG_ID]" AND severity>=ERROR
include_children	core	bool	Optional. This field applies only to sinks owned by organizations and folders. If the field is false, the default, only the logs owned by the sink's parent resource are available for export. If the field is true, then log entries from all the projects, folders, and billing accounts contained in the sink's parent resource are also available for export. Whether a particular log entry from the children is exported depends on the sink's filter expression.For example, if this field is true, then the filter resource.type=gce_instance would export all Compute Engine VM instance log entries from all projects in the sink's parent.To only export entries from certain child projects, filter on the project part of the log name:logName:("projects/test-project1/" OR "projects/test-project2/") AND resource.type=gce_instance
labels	core	array<string>
name	core	string	Optional. The client-assigned sink identifier, unique within the project.For example: "my-syslog-errors-to-pubsub".Sink identifiers are limited to 100 characters and can include only the following characters: upper and lower-case alphanumeric characters, underscores, hyphens, periods.First character has to be alphanumeric.
organization_id	core	string
output_version_format	core	string	Deprecated. This field is unused.
parent	core	string
project_id	core	string
project_number	core	string
resource_name	core	string	Output only. The resource name of the sink. "projects/[PROJECT_ID]/sinks/[SINK_NAME] "organizations/[ORGANIZATION_ID]/sinks/[SINK_NAME] "billingAccounts/[BILLING_ACCOUNT_ID]/sinks/[SINK_NAME] "folders/[FOLDER_ID]/sinks/[SINK_NAME] For example: projects/my_project/sinks/SINK_NAME
tags	core	hstore
update_time	core	timestamp	Output only. The last update timestamp of the sink.This field may not be present for older sinks.
writer_identity	core	string	Output only. An IAM identity—a service account or group—under which Cloud Logging writes the exported log entries to the sink's destination. This field is either set by specifying custom_writer_identity or set automatically by sinks.create and sinks.update based on the value of unique_writer_identity in those methods.Until you grant this identity write-access to the destination, log entry exports from this sink will fail. For more information, see Granting Access for a Resource (https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource). Consult the destination service's documentation to determine the appropriate IAM roles to assign to the identity.Sinks that have a destination that is a log bucket in the same project as the sink cannot have a writer_identity and no additional permissions are required.