Cloud Logging Complete Guide (2026)

Cloud Logging is GCP's unified log management service that automatically collects, searches, and analyzes logs from every GCP service. Powerful search via Logging Query Language (LQL), flexible routing through Log Router, and compliance support via Audit Logs are its core capabilities.

Core Components

Log Entry: A single log record
Log Bucket: Log storage location (_Default / _Required / Custom)
Log Sink (Log Router): Log routing rules
Log View: Filtered view within a Bucket (RBAC)
Log-based Metric: Metrics generated from logs

Log Bucket Types

Bucket	Retention	Use Case
_Default	30 days (configurable, up to 10 years)	Default log destination
_Required	400 days (fixed)	Admin Activity / System Event / Policy Denied
Custom	1 day to 10 years	Long-term retention, Log Analytics

Logging Query Language (LQL) Examples

# Errors from one service
resource.type="cloud_run_revision"
resource.labels.service_name="my-api"
severity>=ERROR

# A specific JSON field
jsonPayload.user_id="user-123"
jsonPayload.duration_ms>1000

# Time range
timestamp>="2026-05-01T00:00:00Z"
timestamp<="2026-05-31T23:59:59Z"

# Negation with AND/OR
severity=(ERROR OR CRITICAL)
NOT textPayload:"health check"

# A specific operation in the audit log
protoPayload.methodName="storage.buckets.delete"
protoPayload.authenticationInfo.principalEmail="[email protected]"

Audit Logs Types

Type	Description	Pricing
Admin Activity	Resource changes (always on, cannot be disabled)	Free
Data Access	Data reads / writes (must be enabled)	$0.50/GiB
System Event	System operations initiated by Google	Free
Policy Denied	IAM / VPC SC denials	Free

Log Router (Sink) Patterns

BigQuery Sink: Export logs to BigQuery and analyze with SQL
Cloud Storage Sink: Long-term archive (cheap with the Archive class)
Pub/Sub Sink: Real-time integration to Dataflow / SIEM
Log Bucket Sink: Forward to a Bucket in a different Project / Region
Exclude Filter: Exclude unwanted logs before ingestion (cost reduction)

Log-based Metric Examples

# Counter: number of ERROR logs
filter: 'resource.type="cloud_run_revision" severity>=ERROR'
metric_kind: DELTA
value_type: INT64

# Distribution: API response time
filter: 'jsonPayload.event="api_request"'
value_extractor: 'EXTRACT(jsonPayload.duration_ms)'

Pricing

Item	Price
Ingestion	$0.50/GiB
Storage (beyond 30 days)	$0.01/GiB/month
Free tier	50 GiB of monthly ingestion
Log Router	Free (destination charges like BigQuery are separate)
Log Analytics	Free (Storage is billed separately)

Log Analytics

Released in 2022; queries logs using the BigQuery engine
Complex analytics and JOINs using standard SQL
Create a Custom Bucket with Log Analytics enabled
Free (Storage charged at the standard rate)

Comparison with Other Clouds

Item	Cloud Logging	CloudWatch Logs	Azure Monitor Logs
Query language	LQL	CloudWatch Logs Insights	KQL
Retention	30 days to 10 years	1 day to indefinite	4 days to 2 years (+ Archive)
Ingestion price	$0.50/GiB	$0.50/GiB	$2.30/GB
Long-term analytics	Log Analytics (BQ)	S3 export	Workspace

Best Practices

Use Exclude Filters to drop noisy logs like health checks
Use a BigQuery Sink for long-term retention (cheap and SQL-queryable)
Integrate with SIEM via a Pub/Sub Sink to any destination
Standardize on structured logging (jsonPayload)
Set severity correctly (INFO / WARNING / ERROR / CRITICAL)
Combine with Sensitive Data Protection to detect PII

What is the log retention period in Cloud Logging?

_Default Bucket = 30 days, _Required Bucket = 400 days (Audit Logs). Custom Buckets can retain logs for up to 10 years.

What is the log query language?

Logging Query Language (LQL). It uses a SQL-like syntax to filter by resource.type, severity, jsonPayload, and more.

What is a Log-based Metric?

Automatically generates Counter / Distribution metrics from logs. Example: convert ERROR log counts into a time-series metric and wire it up to alerts.

What can you do with Log Router (Sink)?

Routes logs to BigQuery / Cloud Storage / Pub/Sub / another Log Bucket. Essential for long-term analytics, SIEM integration, and cost optimization.

How many types of Audit Logs are there?

Admin Activity (always on), Data Access (must be enabled), System Event (always on), and Policy Denied (always on). Data Access generates by far the largest volume.

What is the pricing model?

Ingestion $0.50/GiB, storage $0.01/GiB/month (after 30 days). Includes 50 GiB of free monthly ingestion. Audit Admin Activity and System Event logs are free.

How does it compare to AWS CloudWatch Logs / Azure Monitor Logs?

GCP wins on LQL power; AWS uses CloudWatch Logs Insights; Azure uses KQL. GCP's strength is the combination of automatic GKE / Cloud Run collection plus LQL.

Can I send logs via OpenTelemetry?

Yes. Send logs to Cloud Logging via the OpenTelemetry Collector to avoid vendor lock-in on the application side.

Check what you learned with practice questions

Practice with certification-focused question sets

Go to the GCP exam prep page

Author

NicheeLab Editorial Team

NicheeLab editorial team focused on data engineering and cloud certification learning. Content is structured around practical study needs and official exam domains.

Cloud Logging Complete Guide: LQL, Log Router, Audit Logs & Retention