Google Cloud Workspace Configuration

Install Integration

GCP Workspace

Google Workspace encompasses a suite of cloud-based computing tools, productivity applications, and collaborative solutions developed and offered by Google. Sending logs from Google Workspace to Logit.io can be achieved through the utilization of Filebeat and the Google Reports API.

1. Set Up a Service Account:

• Follow the official Google Workspace tutorial (opens in a new tab) for IAM-based service account setup.

2. Grant Admin SDK API Access:

• Enable access to the following APIs and services:
  • Admin SDK (opens in a new tab)
  • People API or Contacts API.
  • Google Workspace Migrate API
  • Gmail API
  • Google Calendar API
  • Google Drive API
  • Groups Migration API
  • Groups Settings API
  • Google Sheets API
  • Tasks API

3. Delegate Domain-Wide Authority to Your Service Account:

• Open your Google Workspace Admin console (opens in a new tab).
• Navigate to Main menu > Security > API controls.
• In the Domain-wide delegation pane, select Manage Domain Wide Delegation.
• If the option is not visible, switch to a super-admin Google Workspace account.
• Access Manage Domain Wide Delegation and click Add new.
  • Fill in the details:
    • Client ID: Found in the service account's details under Unique ID and in the client_id field of the auto-downloaded credentials file.
    • OAuth Scopes: Enter the admin's API.
  • Click Authorize to confirm your changes.

Install Filebeat

cd 'C:\Program Files\filebeat'

.\install-service-filebeat.ps1

PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-filebeat.ps1

.\install-service-filebeat.ps1

PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-filebeat.ps1

Update Your Configuration File

The configuration file below is pre-configured to send data to your Logit.io Stack via Logstash.

Copy the configuration file below and overwrite the contents of filebeat.yml.

For version 7.16+ and above, use the configuration below:

fields:
  type: google_workspace
 
# ============================== Filebeat modules ==============================
filebeat.modules:
- module: google_workspace
saml:
  enabled: true
  var.jwt_file: "./credentials_file.json"
  var.delegated_account: "[email protected]"
user_accounts:
  enabled: true
  var.jwt_file: "./credentials_file.json"
  var.delegated_account: "[email protected]"
login:
  enabled: true
  var.jwt_file: "./credentials_file.json"
  var.delegated_account: "[email protected]"
admin:
  enabled: true
  var.jwt_file: "./credentials_file.json"
  var.delegated_account: "[email protected]"
drive:
  enabled: true
  var.jwt_file: "./credentials_file.json"
  var.delegated_account: "[email protected]"
groups:
  enabled: true
  var.jwt_file: "./credentials_file.json"
  var.delegated_account: "[email protected]"
 
# ================================== Outputs ===================================
# ------------------------------ Logstash Output -------------------------------
output.logstash:
    hosts: ["@logstash.host:@logstash.sslPort"]
    loadbalance: true
    ssl.enabled: true
 
# ================================= Processors =================================
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

If you're running Filebeat 7 add this code block to the end. Otherwise, you can leave it out.

# ... For Filebeat 7 only ...
 
- if:
    has_fields: ['gsuite']
  then:
  - rename:
      fields:
      - from: "source"
        to: "gsuite_source"
- rename:
    fields:
    - from: "agent"
      to: "filebeat_agent"
    ignore_missing: true
- rename:
    fields:
    - from: "log.file.path"
      to: "source"
    ignore_missing: true
- add_id: ~
 
filebeat.registry.path: /var/lib/filebeat

Validate your YAML

It's a good idea to run the configuration file through a YAML validator to rule out indentation errors, clean up extra characters, and check if your YAML file is valid. Yamllint.com (opens in a new tab) is a great choice.

Validate configuration

cd <EXTRACTED_ARCHIVE>
.\@beatname.exe -e -c @beatname.yml

Start filebeat

Start-Service filebeat

Check Logit.io for your logs

Data should now have been sent to your Stack.

If you don't see take a look at How to diagnose no data in Stack below for how to diagnose common issues.

How to diagnose no data in Stack

If you don't see data appearing in your Stack after following the steps, visit the Help Centre guide for steps to diagnose no data appearing in your Stack or Chat to support now.