Google Cloud Platform logs

Quickly ingest your GCP logs

Create a project and pub/sub
Within Google Cloud, create a new project. Give your project a descriptive name like "RunReveal". Your organization and Location will be your organization's. Make note of the project ID.
Within that project navigate to pub/sub and under Topics click Create topic. Give your topic a descriptive name like "RunReveal" and click Create. Make note of your topic ID.
On your new pub sub, click "Create Subscription"
Give the Subscription ID a name like "RunReveal" and select Push as the Delivery Type.
Run the following command to create a GCP source, and paste the webhook URL into the Delivery Endpoint URL.
$ runreveal sources gcp add        
{
     "id": "2daaaaafgapzgaqasdfasdfasdf",
     "workspaceID": "2asdfasdfasdfasdfasdfasdf",
     "name": "gcp",
     "displayName": "",
     "type": "gcplogs",
     "settings": {
         "webhookID": "xxxxxxxxxxxxxxxxxxxxx",
         "webhookURL": "https://api.runreveal.com/sources/gcplogs/webhook/xxxxxxxxxxxxxxxxxxxxx"
     }
 }
Click save.
Create a sink
1.Search for Logs Explorer.
2.Click on Logs Explorer and then navigate to Log Router.
3.Click Create Sink. Give your sink a descriptive name like "RunReveal"
4.Select the sink service as Cloud Pub/Sub topic
5.Fill in the PROJECT_ID and TOPIC_ID and click Next
​
6.Select "Include logs ingested by this organization and all child resources"
7.Click Next, followed by Create Sink
Verify it's working
You should start to see logs flowing to your GCP log source.
You can validate that your gcp log source is receiving logs by searching for them using the runreveal logs repl.
$ runreveal logs
rr> select * from runreveal_logs where sourceType='gcplogs' limit 1;
​

ALB logs

Okta Security Logs

Last modified 4mo ago