Cannot access Google Workspace logs from GCP Logs explorer

[swarada_jalukar]

Hi community,

I am trying to view the Google Workspace logs in the GCP console. I can view the logs for Admin activities, Login, SAML, Cloud Identity, and OAuth2. But, I am unable to view the logs from my GDrive, Classroom, Gmail, Meet, Sites, Keep, etc in the Log Explorer.

Can someone help me here?

[Alia_Sam]

Ran into this exact issue a few months ago, turns out the missing logs (like Drive, Classroom, Gmail) aren't pushed to Cloud Logging by default. What you’re seeing (Admin, Login) is part of the Audit Logs that GCP surfaces automatically, but for Workspace app-specific logs, you’ll need to enable Google Workspace logs export to BigQuery or Pub/Sub first.

Here’s what worked for us:
1. In the Google Admin console, go to Reporting -> Audit log settings (under Security).
2. From there, you can connect logs to BigQuery - Drive, Gmail, Meet, and others are supported.
3. Once exported, you can query them directly in BigQuery or route them to Pub/Sub and then into GCP Logging with some custom setup (Dataflow or custom ingestion)

[swarada_jalukar]

Hey @Alia_Sam ,

Thanks for the response! Can you please help me with the exact steps to route the Big Query exported logs to Pub/Sub topic in the GCP console?

[swarada_jalukar]

@Alia_Sam can you please help here?

[Alia_Sam]

Hi, sure:

First, ensure that your Workspace logs are already landing in BigQuery, you should have a dataset with tables (such as Drive, Gmail, Meet).

Then:
1. In the GCP console, go to Pub/Sub and create a new topic, this is where your logs will go.
2. Head over to BigQuery, find the table with your logs, click Export, and select Stream to Pub/Sub.
3. Pick your topic, choose JSON format (easier to handle later), and save. From that point on, new rows from your table will automatically stream into your Pub/Sub topic.

In my case, we had Dataflow picking up from Pub/Sub afterwards, but if you just need to collect logs, you can leave it at that.