Second-Party Triggers with Cloud Logging
Many Google Cloud Platform events are logged in Cloud Audit Logs. You can filter these logs and forward them to Pub/Sub topics using sinks. These Pub/Sub topics can then send notifications that trigger Cloud Functions. This allows you to create custom events from any Google Cloud Platform service that produces audit logs.
Configuration
To run the sample below, you'll need a Pub/Sub topic and a Cloud Logging sink. The sample uses them to forward Cloud Audit Logs to a Cloud Function.
Event structure
Like all Pub/Sub-triggered functions, functions triggered by
Cloud log entries receive a PubsubMessage
object whose data
parameter is a base64
-encoded string. For Cloud log
events, decoding this value returns the relevant log entry as a JSON string.
Sample code
You can use a Pub/Sub-triggered function like the one below to detect and respond to exported Cloud logs:
Node.js
Python
Go
Java
Deploying a function
Use the command below to deploy the function:
Node.js
gcloud functions deploy processLogEntry \ --runtime nodejs20 \
--trigger-topic YOUR_PUBSUB_TOPIC
Use the --runtime
flag to specify the runtime ID of a
supported Node.js version to run
your function.
Python
gcloud functions deploy process_log_entry \ --runtime python312 \
--trigger-topic YOUR_PUBSUB_TOPIC
Use the --runtime
flag to specify the runtime ID of a
supported Python version to run
your function.
Go
gcloud functions deploy ProcessLogEntry \ --runtime go121 \
--trigger-topic YOUR_PUBSUB_TOPIC
Use the --runtime
flag to specify the runtime ID of a
supported Go version to run
your function.
Java
gcloud functions deploy java-log-function \ --entry-point StackdriverLogging \ --runtime java17 \ --memory 512MB \
--trigger-topic YOUR_PUBSUB_TOPIC
Use the --runtime
flag to specify the runtime ID of a
supported Java version to run
your function.
Triggering a function
When a Cloud log entry that matches one of your filters is created, you should see corresponding log entries for your function:
Method: METHOD Resource: projects/YOUR_GCLOUD_PROJECT/... Initiator: YOUR_EMAIL_ADDRESS