Google Cloud fields

Module for handling logs from Google Cloud.

googlecloud

Fields from Google Cloud logs.

destination.instance

If the destination of the connection was a VM located on the same VPC, this field is populated with VM instance details. In a Shared VPC configuration, project_id corresponds to the project that owns the instance, usually the service project.

googlecloud.destination.instance.project_id

ID of the project containing the VM.

type: keyword

googlecloud.destination.instance.region

Region of the VM.

type: keyword

googlecloud.destination.instance.zone

Zone of the VM.

type: keyword

destination.vpc

If the destination of the connection was a VM located on the same VPC, this field is populated with VPC network details. In a Shared VPC configuration, project_id corresponds to that of the host project.

googlecloud.destination.vpc.project_id

ID of the project containing the VM.

type: keyword

googlecloud.destination.vpc.vpc_name

VPC on which the VM is operating.

type: keyword

googlecloud.destination.vpc.subnetwork_name

Subnetwork on which the VM is operating.

type: keyword

source.instance

If the source of the connection was a VM located on the same VPC, this field is populated with VM instance details. In a Shared VPC configuration, project_id corresponds to the project that owns the instance, usually the service project.

googlecloud.source.instance.project_id

ID of the project containing the VM.

type: keyword

googlecloud.source.instance.region

Region of the VM.

type: keyword

googlecloud.source.instance.zone

Zone of the VM.

type: keyword

source.vpc

If the source of the connection was a VM located on the same VPC, this field is populated with VPC network details. In a Shared VPC configuration, project_id corresponds to that of the host project.

googlecloud.source.vpc.project_id

ID of the project containing the VM.

type: keyword

googlecloud.source.vpc.vpc_name

VPC on which the VM is operating.

type: keyword

googlecloud.source.vpc.subnetwork_name

Subnetwork on which the VM is operating.

type: keyword

audit

Fields for Google Cloud audit logs.

googlecloud.audit.type

Type property.

type: keyword

authentication_info

Authentication information.

googlecloud.audit.authentication_info.principal_email

The email address of the authenticated user making the request.

type: keyword

googlecloud.audit.authentication_info.authority_selector

The authority selector specified by the requestor, if any. It is not guaranteed that the principal was allowed to use this authority.

type: keyword

googlecloud.audit.authorization_info

Authorization information for the operation.

type: array

googlecloud.audit.method_name

The name of the service method or operation. For API calls, this should be the name of the API method. For example, google.datastore.v1.Datastore.RunQuery.

type: keyword

googlecloud.audit.num_response_items

The number of items returned from a List or Query API method, if applicable.

type: long

request

The operation request.

googlecloud.audit.request.proto_name

Type property of the request.

type: keyword

googlecloud.audit.request.filter

Filter of the request.

type: keyword

googlecloud.audit.request.name

Name of the request.

type: keyword

googlecloud.audit.request.resource_name

Name of the request resource.

type: keyword

request_metadata

Metadata about the request.

googlecloud.audit.request_metadata.caller_ip

The IP address of the caller.

type: ip

googlecloud.audit.request_metadata.caller_supplied_user_agent

The user agent of the caller. This information is not authenticated and should be treated accordingly.

type: keyword

googlecloud.audit.resource_name

The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. For example, shelves/SHELF_ID/books.

type: keyword

resource_location

The location of the resource.

googlecloud.audit.resource_location.current_locations

Current locations of the resource.

type: keyword

googlecloud.audit.service_name

The name of the API service performing the operation. For example, datastore.googleapis.com.

type: keyword

status

The status of the overall operation.

googlecloud.audit.status.code

The status code, which should be an enum value of google.rpc.Code.

type: integer

googlecloud.audit.status.message

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.

type: keyword

firewall

Fields for Google Cloud Firewall logs.

rule_details

Description of the firewall rule that matched this connection.

googlecloud.firewall.rule_details.priority

The priority for the firewall rule.

type: long

googlecloud.firewall.rule_details.action

Action that the rule performs on match.

type: keyword

googlecloud.firewall.rule_details.direction

Direction of traffic that matches this rule.

type: keyword

googlecloud.firewall.rule_details.reference

Reference to the firewall rule.

type: keyword

googlecloud.firewall.rule_details.source_range

List of source ranges that the firewall rule applies to.

type: keyword

googlecloud.firewall.rule_details.destination_range

List of destination ranges that the firewall applies to.

type: keyword

googlecloud.firewall.rule_details.source_tag

List of all the source tags that the firewall rule applies to.

type: keyword

googlecloud.firewall.rule_details.target_tag

List of all the target tags that the firewall rule applies to.

type: keyword

googlecloud.firewall.rule_details.ip_port_info

List of ip protocols and applicable port ranges for rules.

type: array

googlecloud.firewall.rule_details.source_service_account

List of all the source service accounts that the firewall rule applies to.

type: keyword

googlecloud.firewall.rule_details.target_service_account

List of all the target service accounts that the firewall rule applies to.

type: keyword

vpcflow

Fields for Google Cloud VPC flow logs.

googlecloud.vpcflow.reporter

The side which reported the flow. Can be either SRC or DEST.

type: keyword

googlecloud.vpcflow.rtt.ms

Latency as measured (for TCP flows only) during the time interval. This is the time elapsed between sending a SEQ and receiving a corresponding ACK and it contains the network RTT as well as the application related delay.

type: long