I’m trying to understand if it’s possible to consume Google Workspace logs through Google Cloud Platform.
From the article below, I see that Workspace logs can be routed to GCP, but only for limited services like Admin, Enterprise Groups, Login, OAuth, and SAML.
I wanted to check if it is possible to send all Google Workspace audit logs (from the Admin SDK Reports / Audit API) to GCP, or if only these limited log types are supported.
My goal is to collect both GCP and Google Workspace logs using a single connection.
Has anyone done this before or knows if this is supported?
Just curious to confirm if your query relates to Application Integration (Google Cloud Solution for automating business processes via visual workflows)? If so, please elaborate on the specific automation or integration flow you’re building so the community can share some guidance.
Otherwise, I advise reviewing these other forums for more tailored answers:
Thanks for the response @AlexET to clarify our use case, we need to consume audit data from all Google Workspace services, and unify those logs with GCP audit logs into a single pipeline for downstream processing (SIEM / analytics).
We understand that Google Workspace supports exporting only a limited subset of audit logs to Cloud Logging, which can then be routed to Pub/Sub. However, this does not currently cover the full set of audit events available via the Admin SDK Reports API (Drive, Gmail, Calendar, Chat, Devices, etc.).
Our goal is to unify all Workspace audit data and GCP audit data behind a Pub/Sub based ingestion layer.
That said, Application Integration could help you route the missing logs, you can create an intergration to read data from Admin SDK Reports API on a regular basis and send it to the destination of your choice.
