Cloud setup GCP logs
This document explain how one can setup Google Cloud Platform to forward its cloud resource logs from a particular GCP project into Google Pubsub topic so that is available for Loki promtail to consume.
This document assumes, that reader have
gcloud installed and have required permissions(as mentioned in #[Roles and Permission] section)
Roles and Permission
User should have following roles to complete the setup.
Setup Pubsub Topic
Google Pubsub Topic will act as the queue to persist log messages which then can be read from
$ gcloud pubsub topics create $TOPIC_ID
$ gcloud pubsub topics create cloud-logs
Setup Log Router
We create a log sink to forward cloud logs into pubsub topic created before
$ gcloud logging sinks create $SINK_NAME $SINK_LOCATION $OPTIONAL_FLAGS
$ gcloud logging sinks create cloud-logs pubsub.googleapis.com/projects/my-project/topics/cloud-logs \ --log-filter='resource.type=("gcs_bucket")' \ --description="Cloud logs"
Above command also adds
log-filter option which represents what type of logs should get into the destination
For more information on adding
log-filter refer this document
We cover more advanced
Create Pubsub subscription for Loki
We create subscription for the pubsub topic we create above and
promtail uses this subscription to consume log messages.
$ gcloud pubsub subscriptions create cloud-logs --topic=$TOPIC_ID \ --ack-deadline=$ACK_DEADLINE \ --message-retention-duration=$RETENTION_DURATION \
$ gcloud pubsub subscriptions create cloud-logs --topic=pubsub.googleapis.com/projects/my-project/topics/cloud-logs \ --ack-deadline=10s \ --message-retention-duration=7d \
For more fine grained options, refer to the
gcloud pubsub subscriptions --help
ServiceAccount for Promtail
We need a service account with following permissions.
This enables promtail to read log entries from the pubsub subscription created before.
Sometimes you may wish to clear the pending pubsub queue containing logs.
These messages stays in Pubsub Subscription until they’re acknowledged. The following command removes log messages without needing to be consumed via promtail or any other pubsub consumer.
gcloud pubsub subscriptions seek <subscription-path> --time=<yyyy-mm-ddThh:mm:ss>
To delete all the old messages until now, set
--time to current time.
gcloud pubsub subscriptions seek projects/my-project/subscriptions/cloud-logs --time=$(date +%Y-%m-%dT%H:%M:%S)
So far we’ve covered admitting GCS bucket logs into Loki, but often one may need to add multiple cloud resource logs and may also need to exclude unnecessary logs. The following is a more complex example.
We use the
log-filter option to include logs and the
exclusion option to exclude them.
Include following cloud resource logs
- GCS bucket
- HTTP Load balancer
And we exclude specific HTTP load balancer logs based on payload and status code.
$ gcloud logging sinks create cloud-logs pubsub.googleapis.com/projects/my-project/topics/cloud-logs \ --log-filter='resource.type=("gcs_bucket OR k8s_cluster OR service_account OR iam_role OR api OR audited_resource OR http_load_balancer")' \ --description="Cloud logs" \ --exclusion='name=http_load_balancer,filter=<<EOF resource.type="http_load_balancer" ( ( jsonPayload.statusDetails=("byte_range_caching" OR "websocket_closed") ) OR ( http_request.status=(101 OR 206) ) ) EOF
Related Loki video resources
Logging with Loki: Essential configuration settings
This webinar focuses on Loki configuration, picking up where we left off at the end of the Intro to Loki webinar.