1 // Copyright 2018 Google LLC.
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
7 // http://www.apache.org/licenses/LICENSE-2.0
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
18 package google.logging.v2;
20 import "google/api/annotations.proto";
21 import "google/protobuf/empty.proto";
22 import "google/protobuf/field_mask.proto";
23 import "google/protobuf/timestamp.proto";
25 option cc_enable_arenas = true;
26 option csharp_namespace = "Google.Cloud.Logging.V2";
27 option go_package = "google.golang.org/genproto/googleapis/logging/v2;logging";
28 option java_multiple_files = true;
29 option java_outer_classname = "LoggingConfigProto";
30 option java_package = "com.google.logging.v2";
31 option php_namespace = "Google\\Cloud\\Logging\\V2";
33 // Service for configuring sinks used to export log entries out of
35 service ConfigServiceV2 {
37 rpc ListSinks(ListSinksRequest) returns (ListSinksResponse) {
38 option (google.api.http) = {
39 get: "/v2/{parent=*/*}/sinks"
40 additional_bindings { get: "/v2/{parent=projects/*}/sinks" }
41 additional_bindings { get: "/v2/{parent=organizations/*}/sinks" }
42 additional_bindings { get: "/v2/{parent=folders/*}/sinks" }
43 additional_bindings { get: "/v2/{parent=billingAccounts/*}/sinks" }
48 rpc GetSink(GetSinkRequest) returns (LogSink) {
49 option (google.api.http) = {
50 get: "/v2/{sink_name=*/*/sinks/*}"
51 additional_bindings { get: "/v2/{sink_name=projects/*/sinks/*}" }
52 additional_bindings { get: "/v2/{sink_name=organizations/*/sinks/*}" }
53 additional_bindings { get: "/v2/{sink_name=folders/*/sinks/*}" }
54 additional_bindings { get: "/v2/{sink_name=billingAccounts/*/sinks/*}" }
58 // Creates a sink that exports specified log entries to a destination. The
59 // export of newly-ingested log entries begins immediately, unless the sink's
60 // `writer_identity` is not permitted to write to the destination. A sink can
61 // export log entries only from the resource owning the sink.
62 rpc CreateSink(CreateSinkRequest) returns (LogSink) {
63 option (google.api.http) = {
64 post: "/v2/{parent=*/*}/sinks"
66 additional_bindings { post: "/v2/{parent=projects/*}/sinks" body: "sink" }
68 post: "/v2/{parent=organizations/*}/sinks"
71 additional_bindings { post: "/v2/{parent=folders/*}/sinks" body: "sink" }
73 post: "/v2/{parent=billingAccounts/*}/sinks"
79 // Updates a sink. This method replaces the following fields in the existing
80 // sink with values from the new sink: `destination`, and `filter`.
81 // The updated sink might also have a new `writer_identity`; see the
82 // `unique_writer_identity` field.
83 rpc UpdateSink(UpdateSinkRequest) returns (LogSink) {
84 option (google.api.http) = {
85 put: "/v2/{sink_name=*/*/sinks/*}"
88 put: "/v2/{sink_name=projects/*/sinks/*}"
92 put: "/v2/{sink_name=organizations/*/sinks/*}"
96 put: "/v2/{sink_name=folders/*/sinks/*}"
100 put: "/v2/{sink_name=billingAccounts/*/sinks/*}"
103 additional_bindings {
104 patch: "/v2/{sink_name=projects/*/sinks/*}"
107 additional_bindings {
108 patch: "/v2/{sink_name=organizations/*/sinks/*}"
111 additional_bindings {
112 patch: "/v2/{sink_name=folders/*/sinks/*}"
115 additional_bindings {
116 patch: "/v2/{sink_name=billingAccounts/*/sinks/*}"
122 // Deletes a sink. If the sink has a unique `writer_identity`, then that
123 // service account is also deleted.
124 rpc DeleteSink(DeleteSinkRequest) returns (google.protobuf.Empty) {
125 option (google.api.http) = {
126 delete: "/v2/{sink_name=*/*/sinks/*}"
127 additional_bindings { delete: "/v2/{sink_name=projects/*/sinks/*}" }
128 additional_bindings { delete: "/v2/{sink_name=organizations/*/sinks/*}" }
129 additional_bindings { delete: "/v2/{sink_name=folders/*/sinks/*}" }
130 additional_bindings {
131 delete: "/v2/{sink_name=billingAccounts/*/sinks/*}"
136 // Lists all the exclusions in a parent resource.
137 rpc ListExclusions(ListExclusionsRequest) returns (ListExclusionsResponse) {
138 option (google.api.http) = {
139 get: "/v2/{parent=*/*}/exclusions"
140 additional_bindings { get: "/v2/{parent=projects/*}/exclusions" }
141 additional_bindings { get: "/v2/{parent=organizations/*}/exclusions" }
142 additional_bindings { get: "/v2/{parent=folders/*}/exclusions" }
143 additional_bindings { get: "/v2/{parent=billingAccounts/*}/exclusions" }
147 // Gets the description of an exclusion.
148 rpc GetExclusion(GetExclusionRequest) returns (LogExclusion) {
149 option (google.api.http) = {
150 get: "/v2/{name=*/*/exclusions/*}"
151 additional_bindings { get: "/v2/{name=projects/*/exclusions/*}" }
152 additional_bindings { get: "/v2/{name=organizations/*/exclusions/*}" }
153 additional_bindings { get: "/v2/{name=folders/*/exclusions/*}" }
154 additional_bindings { get: "/v2/{name=billingAccounts/*/exclusions/*}" }
158 // Creates a new exclusion in a specified parent resource.
159 // Only log entries belonging to that resource can be excluded.
160 // You can have up to 10 exclusions in a resource.
161 rpc CreateExclusion(CreateExclusionRequest) returns (LogExclusion) {
162 option (google.api.http) = {
163 post: "/v2/{parent=*/*}/exclusions"
165 additional_bindings {
166 post: "/v2/{parent=projects/*}/exclusions"
169 additional_bindings {
170 post: "/v2/{parent=organizations/*}/exclusions"
173 additional_bindings {
174 post: "/v2/{parent=folders/*}/exclusions"
177 additional_bindings {
178 post: "/v2/{parent=billingAccounts/*}/exclusions"
184 // Changes one or more properties of an existing exclusion.
185 rpc UpdateExclusion(UpdateExclusionRequest) returns (LogExclusion) {
186 option (google.api.http) = {
187 patch: "/v2/{name=*/*/exclusions/*}"
189 additional_bindings {
190 patch: "/v2/{name=projects/*/exclusions/*}"
193 additional_bindings {
194 patch: "/v2/{name=organizations/*/exclusions/*}"
197 additional_bindings {
198 patch: "/v2/{name=folders/*/exclusions/*}"
201 additional_bindings {
202 patch: "/v2/{name=billingAccounts/*/exclusions/*}"
208 // Deletes an exclusion.
209 rpc DeleteExclusion(DeleteExclusionRequest) returns (google.protobuf.Empty) {
210 option (google.api.http) = {
211 delete: "/v2/{name=*/*/exclusions/*}"
212 additional_bindings { delete: "/v2/{name=projects/*/exclusions/*}" }
213 additional_bindings { delete: "/v2/{name=organizations/*/exclusions/*}" }
214 additional_bindings { delete: "/v2/{name=folders/*/exclusions/*}" }
215 additional_bindings {
216 delete: "/v2/{name=billingAccounts/*/exclusions/*}"
222 // Describes a sink used to export log entries to one of the following
223 // destinations in any project: a Cloud Storage bucket, a BigQuery dataset, or a
224 // Cloud Pub/Sub topic. A logs filter controls which log entries are
225 // exported. The sink must be created within a project, organization, billing
226 // account, or folder.
228 // Available log entry formats. Log entries can be written to
229 // Logging in either format and can be exported in either format.
230 // Version 2 is the preferred format.
232 // An unspecified format version that will default to V2.
233 VERSION_FORMAT_UNSPECIFIED = 0;
235 // `LogEntry` version 2 format.
238 // `LogEntry` version 1 format.
242 // Required. The client-assigned sink identifier, unique within the
243 // project. Example: `"my-syslog-errors-to-pubsub"`. Sink identifiers are
244 // limited to 100 characters and can include only the following characters:
245 // upper and lower-case alphanumeric characters, underscores, hyphens, and
249 // Required. The export destination:
251 // "storage.googleapis.com/[GCS_BUCKET]"
252 // "bigquery.googleapis.com/projects/[PROJECT_ID]/datasets/[DATASET]"
253 // "pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_ID]"
255 // The sink's `writer_identity`, set when the sink is created, must
256 // have permission to write to the destination or else the log
257 // entries are not exported. For more information, see
258 // [Exporting Logs With Sinks](/logging/docs/api/tasks/exporting-logs).
259 string destination = 3;
262 // An [advanced logs filter](/logging/docs/view/advanced_filters). The only
263 // exported log entries are those that are in the resource owning the sink and
264 // that match the filter. For example:
266 // logName="projects/[PROJECT_ID]/logs/[LOG_ID]" AND severity>=ERROR
269 // Deprecated. The log entry format to use for this sink's exported log
270 // entries. The v2 format is used by default and cannot be changed.
271 VersionFormat output_version_format = 6 [deprecated = true];
273 // Output only. An IAM identity—a service account or group—under
274 // which Logging writes the exported log entries to the sink's
275 // destination. This field is set by
276 // [sinks.create](/logging/docs/api/reference/rest/v2/projects.sinks/create)
278 // [sinks.update](/logging/docs/api/reference/rest/v2/projects.sinks/update),
279 // based on the setting of `unique_writer_identity` in those methods.
281 // Until you grant this identity write-access to the destination, log entry
282 // exports from this sink will fail. For more information,
283 // see [Granting access for a
284 // resource](/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource).
285 // Consult the destination service's documentation to determine the
286 // appropriate IAM roles to assign to the identity.
287 string writer_identity = 8;
289 // Optional. This field applies only to sinks owned by organizations and
290 // folders. If the field is false, the default, only the logs owned by the
291 // sink's parent resource are available for export. If the field is true, then
292 // logs from all the projects, folders, and billing accounts contained in the
293 // sink's parent resource are also available for export. Whether a particular
294 // log entry from the children is exported depends on the sink's filter
295 // expression. For example, if this field is true, then the filter
296 // `resource.type=gce_instance` would export all Compute Engine VM instance
297 // log entries from all projects in the sink's parent. To only export entries
298 // from certain child projects, filter on the project part of the log name:
300 // logName:("projects/test-project1/" OR "projects/test-project2/") AND
301 // resource.type=gce_instance
302 bool include_children = 9;
304 // Deprecated. This field is ignored when creating or updating sinks.
305 google.protobuf.Timestamp start_time = 10 [deprecated = true];
307 // Deprecated. This field is ignored when creating or updating sinks.
308 google.protobuf.Timestamp end_time = 11 [deprecated = true];
311 // The parameters to `ListSinks`.
312 message ListSinksRequest {
313 // Required. The parent resource whose sinks are to be listed:
315 // "projects/[PROJECT_ID]"
316 // "organizations/[ORGANIZATION_ID]"
317 // "billingAccounts/[BILLING_ACCOUNT_ID]"
318 // "folders/[FOLDER_ID]"
321 // Optional. If present, then retrieve the next batch of results from the
322 // preceding call to this method. `pageToken` must be the value of
323 // `nextPageToken` from the previous response. The values of other method
324 // parameters should be identical to those in the previous call.
325 string page_token = 2;
327 // Optional. The maximum number of results to return from this request.
328 // Non-positive values are ignored. The presence of `nextPageToken` in the
329 // response indicates that more results might be available.
333 // Result returned from `ListSinks`.
334 message ListSinksResponse {
336 repeated LogSink sinks = 1;
338 // If there might be more results than appear in this response, then
339 // `nextPageToken` is included. To get the next set of results, call the same
340 // method again using the value of `nextPageToken` as `pageToken`.
341 string next_page_token = 2;
344 // The parameters to `GetSink`.
345 message GetSinkRequest {
346 // Required. The resource name of the sink:
348 // "projects/[PROJECT_ID]/sinks/[SINK_ID]"
349 // "organizations/[ORGANIZATION_ID]/sinks/[SINK_ID]"
350 // "billingAccounts/[BILLING_ACCOUNT_ID]/sinks/[SINK_ID]"
351 // "folders/[FOLDER_ID]/sinks/[SINK_ID]"
353 // Example: `"projects/my-project-id/sinks/my-sink-id"`.
354 string sink_name = 1;
357 // The parameters to `CreateSink`.
358 message CreateSinkRequest {
359 // Required. The resource in which to create the sink:
361 // "projects/[PROJECT_ID]"
362 // "organizations/[ORGANIZATION_ID]"
363 // "billingAccounts/[BILLING_ACCOUNT_ID]"
364 // "folders/[FOLDER_ID]"
366 // Examples: `"projects/my-logging-project"`, `"organizations/123456789"`.
369 // Required. The new sink, whose `name` parameter is a sink identifier that
370 // is not already in use.
373 // Optional. Determines the kind of IAM identity returned as `writer_identity`
374 // in the new sink. If this value is omitted or set to false, and if the
375 // sink's parent is a project, then the value returned as `writer_identity` is
376 // the same group or service account used by Logging before the
377 // addition of writer identities to this API. The sink's destination must be
378 // in the same project as the sink itself.
380 // If this field is set to true, or if the sink is owned by a non-project
381 // resource such as an organization, then the value of `writer_identity` will
382 // be a unique service account used only for exports from the new sink. For
383 // more information, see `writer_identity` in
384 // [LogSink][google.logging.v2.LogSink].
385 bool unique_writer_identity = 3;
388 // The parameters to `UpdateSink`.
389 message UpdateSinkRequest {
390 // Required. The full resource name of the sink to update, including the
391 // parent resource and the sink identifier:
393 // "projects/[PROJECT_ID]/sinks/[SINK_ID]"
394 // "organizations/[ORGANIZATION_ID]/sinks/[SINK_ID]"
395 // "billingAccounts/[BILLING_ACCOUNT_ID]/sinks/[SINK_ID]"
396 // "folders/[FOLDER_ID]/sinks/[SINK_ID]"
398 // Example: `"projects/my-project-id/sinks/my-sink-id"`.
399 string sink_name = 1;
401 // Required. The updated sink, whose name is the same identifier that appears
402 // as part of `sink_name`.
406 // [sinks.create](/logging/docs/api/reference/rest/v2/projects.sinks/create)
407 // for a description of this field. When updating a sink, the effect of this
408 // field on the value of `writer_identity` in the updated sink depends on both
409 // the old and new values of this field:
411 // + If the old and new values of this field are both false or both true,
412 // then there is no change to the sink's `writer_identity`.
413 // + If the old value is false and the new value is true, then
414 // `writer_identity` is changed to a unique service account.
415 // + It is an error if the old value is true and the new value is
416 // set to false or defaulted to false.
417 bool unique_writer_identity = 3;
419 // Optional. Field mask that specifies the fields in `sink` that need
420 // an update. A sink field will be overwritten if, and only if, it is
421 // in the update mask. `name` and output only fields cannot be updated.
423 // An empty updateMask is temporarily treated as using the following mask
424 // for backwards compatibility purposes:
425 // destination,filter,includeChildren
426 // At some point in the future, behavior will be removed and specifying an
427 // empty updateMask will be an error.
429 // For a detailed `FieldMask` definition, see
430 // https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.FieldMask
432 // Example: `updateMask=filter`.
433 google.protobuf.FieldMask update_mask = 4;
436 // The parameters to `DeleteSink`.
437 message DeleteSinkRequest {
438 // Required. The full resource name of the sink to delete, including the
439 // parent resource and the sink identifier:
441 // "projects/[PROJECT_ID]/sinks/[SINK_ID]"
442 // "organizations/[ORGANIZATION_ID]/sinks/[SINK_ID]"
443 // "billingAccounts/[BILLING_ACCOUNT_ID]/sinks/[SINK_ID]"
444 // "folders/[FOLDER_ID]/sinks/[SINK_ID]"
446 // Example: `"projects/my-project-id/sinks/my-sink-id"`.
447 string sink_name = 1;
450 // Specifies a set of log entries that are not to be stored in
451 // Logging. If your project receives a large volume of logs, you might be able
452 // to use exclusions to reduce your chargeable logs. Exclusions are processed
453 // after log sinks, so you can export log entries before they are excluded.
454 // Audit log entries and log entries from Amazon Web Services are never
456 message LogExclusion {
457 // Required. A client-assigned identifier, such as
458 // `"load-balancer-exclusion"`. Identifiers are limited to 100 characters and
459 // can include only letters, digits, underscores, hyphens, and periods.
462 // Optional. A description of this exclusion.
463 string description = 2;
466 // An [advanced logs filter](/logging/docs/view/advanced_filters)
467 // that matches the log entries to be excluded. By using the
468 // [sample function](/logging/docs/view/advanced_filters#sample),
469 // you can exclude less than 100% of the matching log entries.
470 // For example, the following filter matches 99% of low-severity log
471 // entries from load balancers:
473 // `"resource.type=http_load_balancer severity<ERROR sample(insertId, 0.99)"`
476 // Optional. If set to True, then this exclusion is disabled and it does not
477 // exclude any log entries. You can use
478 // [exclusions.patch](/logging/docs/reference/v2/rest/v2/projects.exclusions/patch)
479 // to change the value of this field.
483 // The parameters to `ListExclusions`.
484 message ListExclusionsRequest {
485 // Required. The parent resource whose exclusions are to be listed.
487 // "projects/[PROJECT_ID]"
488 // "organizations/[ORGANIZATION_ID]"
489 // "billingAccounts/[BILLING_ACCOUNT_ID]"
490 // "folders/[FOLDER_ID]"
493 // Optional. If present, then retrieve the next batch of results from the
494 // preceding call to this method. `pageToken` must be the value of
495 // `nextPageToken` from the previous response. The values of other method
496 // parameters should be identical to those in the previous call.
497 string page_token = 2;
499 // Optional. The maximum number of results to return from this request.
500 // Non-positive values are ignored. The presence of `nextPageToken` in the
501 // response indicates that more results might be available.
505 // Result returned from `ListExclusions`.
506 message ListExclusionsResponse {
507 // A list of exclusions.
508 repeated LogExclusion exclusions = 1;
510 // If there might be more results than appear in this response, then
511 // `nextPageToken` is included. To get the next set of results, call the same
512 // method again using the value of `nextPageToken` as `pageToken`.
513 string next_page_token = 2;
516 // The parameters to `GetExclusion`.
517 message GetExclusionRequest {
518 // Required. The resource name of an existing exclusion:
520 // "projects/[PROJECT_ID]/exclusions/[EXCLUSION_ID]"
521 // "organizations/[ORGANIZATION_ID]/exclusions/[EXCLUSION_ID]"
522 // "billingAccounts/[BILLING_ACCOUNT_ID]/exclusions/[EXCLUSION_ID]"
523 // "folders/[FOLDER_ID]/exclusions/[EXCLUSION_ID]"
525 // Example: `"projects/my-project-id/exclusions/my-exclusion-id"`.
529 // The parameters to `CreateExclusion`.
530 message CreateExclusionRequest {
531 // Required. The parent resource in which to create the exclusion:
533 // "projects/[PROJECT_ID]"
534 // "organizations/[ORGANIZATION_ID]"
535 // "billingAccounts/[BILLING_ACCOUNT_ID]"
536 // "folders/[FOLDER_ID]"
538 // Examples: `"projects/my-logging-project"`, `"organizations/123456789"`.
541 // Required. The new exclusion, whose `name` parameter is an exclusion name
542 // that is not already used in the parent resource.
543 LogExclusion exclusion = 2;
546 // The parameters to `UpdateExclusion`.
547 message UpdateExclusionRequest {
548 // Required. The resource name of the exclusion to update:
550 // "projects/[PROJECT_ID]/exclusions/[EXCLUSION_ID]"
551 // "organizations/[ORGANIZATION_ID]/exclusions/[EXCLUSION_ID]"
552 // "billingAccounts/[BILLING_ACCOUNT_ID]/exclusions/[EXCLUSION_ID]"
553 // "folders/[FOLDER_ID]/exclusions/[EXCLUSION_ID]"
555 // Example: `"projects/my-project-id/exclusions/my-exclusion-id"`.
558 // Required. New values for the existing exclusion. Only the fields specified
559 // in `update_mask` are relevant.
560 LogExclusion exclusion = 2;
562 // Required. A nonempty list of fields to change in the existing exclusion.
563 // New values for the fields are taken from the corresponding fields in the
564 // [LogExclusion][google.logging.v2.LogExclusion] included in this request.
565 // Fields not mentioned in `update_mask` are not changed and are ignored in
568 // For example, to change the filter and description of an exclusion,
569 // specify an `update_mask` of `"filter,description"`.
570 google.protobuf.FieldMask update_mask = 3;
573 // The parameters to `DeleteExclusion`.
574 message DeleteExclusionRequest {
575 // Required. The resource name of an existing exclusion to delete:
577 // "projects/[PROJECT_ID]/exclusions/[EXCLUSION_ID]"
578 // "organizations/[ORGANIZATION_ID]/exclusions/[EXCLUSION_ID]"
579 // "billingAccounts/[BILLING_ACCOUNT_ID]/exclusions/[EXCLUSION_ID]"
580 // "folders/[FOLDER_ID]/exclusions/[EXCLUSION_ID]"
582 // Example: `"projects/my-project-id/exclusions/my-exclusion-id"`.