Google Cloud Storage Audit

Install Integration

Export Logs to Google Pub/Sub

Ensure that you have Cloud Storage Audit Logs configured in GCP (opens in a new tab).

Now we can filter the logs as needed, by clicking on the service name and choosing Show matching entries as shown below.

Create A Sink

To export the logs choose Create sink as shown below.

You will be then be prompted for:

• Sink details (enter a name)
• Sink destination (choose Cloud Pub/Sub topic creating a new topic if needed)
• Choose logs to include in sink (this will have a filter applied already if you filtered the logs above)

Choose Create sink to continue.

Create Google Pub/Sub

Locate your newly created Pub/Sub topic (opens in a new tab) and choose Create subscription.

Enter a suitable Subscription ID and leave the delivery type as pull.

We don't need to change anything further at this stage, scroll to the bottom and choose CREATE to create the Subscription.

Create Service Account

Now in service accounts (opens in a new tab), choose the project you're working with.

Then select CREATE SERVICE ACCOUNT, this account will be used to retrieve logs from the Pub/Sub and send them to Logit.io.

Name the service account and in step 2 add the role Pub/Sub Subscriber as shown below, then choose DONE.

Now choose Manage keys as shown below.

Then choose ADD KEY > Create new key, choosing the recommended JSON format. This will download the JSON key to your machine ready to use in the next step.

Configuring Logstash

To start pulling logs and metrics from the Google Cloud Platform to your Stack you need to configure a Google Cloud Platform Input on your Logit.io Stack.

Launch Logit.io to view your logs

Data should now have been sent to your Stack.

If you don't see take a look at How to diagnose no data in Stack below for how to diagnose common issues.