Cannot access Google Workspace logs from GCP Logs explorer

[swarada_jalukar]

Hi community,

I am trying to view the Google Workspace logs in the GCP console. I can view the logs for Admin activities, Login, SAML, Cloud Identity, and OAuth2. But, I am unable to view the logs from my GDrive, Classroom, Gmail, Meet, Sites, Keep, etc in the Log Explorer.

Can someone help me here?

[Alia_Sam]

Ran into this exact issue a few months ago, turns out the missing logs (like Drive, Classroom, Gmail) aren't pushed to Cloud Logging by default. What you’re seeing (Admin, Login) is part of the Audit Logs that GCP surfaces automatically, but for Workspace app-specific logs, you’ll need to enable Google Workspace logs export to BigQuery or Pub/Sub first.

Here’s what worked for us:
1. In the Google Admin console, go to Reporting -> Audit log settings (under Security).
2. From there, you can connect logs to BigQuery - Drive, Gmail, Meet, and others are supported.
3. Once exported, you can query them directly in BigQuery or route them to Pub/Sub and then into GCP Logging with some custom setup (Dataflow or custom ingestion)

[swarada_jalukar]

Hey @Alia_Sam ,

Thanks for the response! Can you please help me with the exact steps to route the Big Query exported logs to Pub/Sub topic in the GCP console?

[swarada_jalukar]

@Alia_Sam can you please help here?