This document describes the data model used by Cloud Logging.The data model specifies the format in which your log data is stored. Italso determines the dimensions over which you can query your log data.

Data model

In Cloud Logging, alog is a named collection of individual entries.You can query your data by the name of the log. Logs are composedof entries that conform to theLogEntry structure.

Each log entry records status or describes a specific event, such asthe creation of a virtual machine instance, and minimally consists of thefollowing:

• A timestamp that indicates either when the event took place or when it wasreceived by Cloud Logging.
• Information about the source of the log entry. This source is calledthemonitored resource. Examples of monitored resources include individualCompute Engine instances and Google Kubernetes Engine containers.For a complete listing of monitored resource types, seeMonitored resources and services.

• A payload which must be one of the following:

  • textPayload: These payloads are formatted as a single string.
  • jsonPayload: These payloads arestructured, so you canquery by key-value pairs.We recommend that applications always write structured log data.
  • protoPayload: These payloads follow the format of a proto file and thefields are formatted as JSON.

• The name of the log to which it belongs. The name of a log includes the fullpath of the resource to which the log entries belong, followed by anidentifier. The following are examples of log names:

  • projects/my-project/logs/stdout
  • projects/my-project/compute.googleapis.com/activity

You can write queries that retrieve only those log entries where the value ofaLogEntry field matches some criteria. For example, you can display onlythose log entries whoseseverity field has the value ofERROR.

Log entry types

Audit logs andAccess Transparency provideinformation necessary to satisfy compliance regulations.Audit logs provide information about administrative activitiesand accesses within your Google Cloud resources.Access Transparency logs record actions taken by Google Cloudstaff when accessing your Google Cloud content. For a list of supportedservices, seeGoogle Cloud services with audit logsandGoogle Cloud services with Access Transparency logs.

The following type of log entries are stored in the_Required log bucket in the Google Cloud project,billing account, folder, or organization in which they originate:

• Admin Activity audit logs
• System Event audit logs
• Google Workspace Admin Audit logs
• Enterprise Groups Audit logs
• Login Audit logs

• Access Transparency logs

All other log entries that originate in a Google Cloud project, billing account,folder, or organization are stored in the_Default log bucket. However, you can change whichlog entries are stored in this log bucket.

What's next

• Store log data.
• Route log data.
• Query and view logs overview.