Cloud Logging: Log Router, Buckets and Sinks

GCP Basics · Operations – Cloud Monitoring, Alerting, Cloud Logging and Audit Logs · Lesson 3 of 5

Every log entry passes through the Log Router, where sinks send it to log buckets, BigQuery, Cloud Storage or Pub/Sub; exclusions cut cost, and retention is set per bucket.

Cloud Logging collects logs from Google Cloud services, the Ops Agent and your apps (anything written to stdout on Cloud Run and GKE). Every entry passes through the Log Router.

flowchart LR
  SRC["Logs from services, VMs, apps"] --> LR["Log Router"]
  LR -- "_Required sink" --> REQ["_Required bucket<br/>audit, 400 days"]
  LR -- "_Default sink<br/>minus exclusions" --> DEF["_Default bucket<br/>30 days by default"]
  LR -- "sink audit-to-bq" --> BQ["BigQuery dataset"]
  LR -- "sink archive" --> GCS["Cloud Storage<br/>long-term archive"]
  LR -- "sink siem" --> PS["Pub/Sub to SIEM"]
  %% step SRC: Logs arrive from Google Cloud services, the Ops Agent and application stdout.
  %% step LR: The Log Router checks every sink’s filter and sends a copy to each matching destination.
  %% step REQ: The _Required bucket keeps Admin Activity and System Event audit logs for 400 days at no charge; you cannot change it.
  %% step DEF: Everything else goes to _Default unless an exclusion filter drops it; retention is configurable.
  %% step BQ: A sink to BigQuery makes logs queryable with SQL alongside other data.
  %% step GCS: A sink to Cloud Storage keeps cheap archives for years.
  %% step PS: A Pub/Sub sink streams logs to a SIEM or other tools.

Buckets and retention

Bucket	Retention	Notes
`_Required`	400 days, fixed	Admin Activity, System Event, Access Transparency; free
`_Default`	30 days by default, 1–3650 days	Billed for storage beyond 30 days
User-defined buckets	Your choice	Regional location, CMEK, Log Analytics (SQL)

Sinks

Destinations: log bucket (same or other project), BigQuery, Cloud Storage, Pub/Sub, another Google Cloud project.
Each sink has a writer identity (a service account); grant it write access on the destination, e.g. BigQuery Data Editor.
Aggregated sinks on a folder or organization with --include-children collect logs from every project, for central security logging.
Exclusion filters drop noisy, low-value logs (health checks, debug) before they are stored, saving money.

Querying

The Logs Explorer uses the Logging query language:

resource.type="cloud_run_revision"
resource.labels.service_name="web"
severity>=ERROR
timestamp>="2026-11-06T00:00:00Z"

Log Analytics lets you run SQL over upgraded buckets; log-based metrics turn queries into charts and alerts. Write structured (JSON) logs from apps so fields like orderId are searchable.

gcloud logging read 'resource.type="cloud_run_revision" AND severity>=ERROR' --limit=20 --freshness=1h
gcloud logging sinks create audit-to-bq bigquery.googleapis.com/projects/dl-sec/datasets/audit_logs   --organization=111122223333 --include-children --log-filter='logName:"cloudaudit.googleapis.com"'
gcloud logging buckets update _Default --location=global --retention-days=90

Command	Meaning
`gcloud logging sinks list`	Sinks in the project
`gcloud logging sinks describe audit-to-bq --organization=… --format="value(writerIdentity)"`	Identity to grant on the destination
`gcloud logging metrics create payment_failed --log-filter='…'`	Log-based metric

Traps: a new sink delivers nothing until its writer identity has permission on the destination; sinks only route new logs, not history; excluded logs are gone for good.