Coralogix offers a number of different approaches for collecting logs from your Google Cloud environments including using GCP Log Explorer and Google Cloud Storage.
The tutorial describes how to configure a Logs router to send logs to a Pub/Sub topic and deliver them to Coralogix using a push subscription on the topic.
The main advantage of using a push subscription is that it avoids running any additional software (i.e. functions) in your GCP account which can contribute to operational overhead and costs.
Logging
and Pub/Sub
servicesWhen you create your subscription, you will need to set the correct Endpoint URL using the following parameters:
domain
– Your domain can be found by matching your Coralogix account URL to the table here.key
– Your private key can be found in your Coralogix account under Settings>Send Your Data. Learn more about your private key.application
(optional) – overrides the default application namesubsystem
(optional) – overrides the default subsystem namecomputer
(optional) – sets the computer name (otherwise there is no computer name)log_message
(optional): controls how GCP Audit logs are transformed
LogEntry
if not specifiedPayload
: parse only payload field content of the log entry as log textLogEntry
: parse whole log entry, for example:{ "spanId": "abcdefghijk", "severity": "INFO", ... "jsonPayload": { ... }, ... "receiveTimestamp": "2023-02-27T10:16:23.544899312Z", "timestamp": "2023-02-27T10:16:20.035098Z", }
To configure the ingestion of GCP log data to Coralogix, we will first create a new topic in Google Cloud Pub/Sub. Then we will configure the topic as a sink in the logs router and configure a subscription to push the data to Coralogix.
Pub/Sub
/ Topics
and create a Topic
Logging
/ Logs Router
and create a Sink
Pub/Sub
/ Subscriptions
and create a Subscription
Need help?
Our world-class customer success team is available 24/7 to walk you through your setup and answer any questions that may come up.
Feel free to reach out to us via our in-app chat or by sending us an email at [email protected].