Aggregated log collection

[RobK]

What line do I put in my inclusion filter from the log sink, if I want all the audit logs from all projects in an organisation? (the option "Include logs ingested by this organisation and all child resources" is selected)

[mkoes]

You can use a substring match:

logName:"cloudaudit.googleapis.com"


There are some other useful sample filters in our docs:
https://cloud.google.com/logging/docs/view/query-library#security-filters

[RobK]

Thanks Mary, it looks like I had the one which is in the document 
log_id("cloudaudit.googleapis.com/activity")
For some reason the entry I'm looking for, which I can see via log explorer, I can't seem to find in our SIEM.

[RobK]

Is there any action to be taken when you want to export the protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey" events via pub/sub?

[RobK]

We located the issue. It was related to the amount of different fields in the GCP audit logs.