GCP logs and events

• Latest Dynatrace
• Explanation
• Updated on Oct 29, 2026

Dynatrace ingests Google Cloud logs and audit events from Cloud Logging using a forwarding pipeline deployed to your Google Cloud environment. The pipeline runs in your own infrastructure, giving you full control over what is forwarded and at what cost.

Architecture

Log and event forwarding uses the following pipeline:

Cloud Logging → log sink → Pub/Sub topic → Dataflow job → Grail

Deployment

The onboarding Terraform deploys the Pub/Sub topic and subscriptions, the supporting Secret Manager secret and Cloud Storage buckets, and the Dataflow job, and connects them to Dynatrace. It does not create log sinks. You create the log sinks yourself and point them at the Pub/Sub topic. For step-by-step deployment instructions, see Via Terraform or Via gcloud CLI and dtctl.

The Dataflow job runs as a streaming job in your Google Cloud project and incurs costs (see Cost considerations). It sends logs to your environment's data acquisition endpoint, https://<environment-id>.da.dynatrace.com. If you restrict outbound traffic from your Google Cloud network, allow this host.

Log types collected

Dynatrace collects the following log types from Cloud Logging:

Log sinks

A log sink routes log entries from Cloud Logging to the Pub/Sub topic. Dynatrace doesn't create log sinks for you. You create a project-level sink in each project whose logs you want to forward, and point it at the Pub/Sub topic dt-logs-<id>, where <id> is the ID of your monitoring configuration. The topic lives in the service account project. Sinks in other monitored projects can use the same topic, and Dynatrace accepts the logs they send.

A project-level sink exports only the logs of its own project. The pipeline doesn't forward the logs of a project that has no sink, even if you monitor that project.

Create log sinks

Run the following steps for each project whose logs you want to forward. Replace the placeholders:

You need roles/logging.configWriter on SOURCE_PROJECT, and permission to change the IAM policy of the topic in SA_PROJECT (for example, roles/pubsub.admin).

Change or remove a sink

To change what a sink forwards, update its inclusion filter in the Google Cloud Console or with gcloud logging sinks update. Don't change the sink destination (the Pub/Sub topic), because that breaks the forwarding pipeline.

Terraform doesn't know about your sinks, so terraform destroy doesn't remove them. If you remove the forwarding pipeline, also remove your sinks. Otherwise a sink keeps writing to a topic that no longer exists.

GCP IAM requirements

The onboarding Terraform creates all log forwarding resources in the service account project. The pipeline requires the following IAM bindings. Terraform creates all of them except the first one, which you grant when you create a log sink:

The bundle grants roles/secretmanager.secretAccessor on the project instead of on the single secret that holds the Log Ingest token. Granting it on the secret would require the account that runs Terraform to hold roles/secretmanager.admin.

If you need to rotate the Dynatrace Log Ingest token used by the Dataflow job, update the token in your deployed Dataflow configuration and re-run Terraform. See Manage your GCP connections for details.

Find logs in Dynatrace

Query GCP logs via DQL in Notebooks or Logs.

Query by cloud provider

fetch logs
| filter cloud.provider == "gcp"
| sort timestamp desc
| limit 50

Query by project and log type

fetch logs
| filter cloud.provider == "gcp"
  and gcp.project.id == "my-project-id"
  and contains(gcp.log.id, "cloudaudit")
| sort timestamp desc

Query Admin Activity audit logs

fetch logs
| filter cloud.provider == "gcp"
  and gcp.log.id == "cloudaudit.googleapis.com/activity"
| fields timestamp, gcp.project.id, gcp.resource.type, content
| sort timestamp desc

Query Data Access audit logs

fetch logs
| filter cloud.provider == "gcp"
  and gcp.log.id == "cloudaudit.googleapis.com/data_access"
| fields timestamp, gcp.project.id, audit.identity, audit.action, audit.result, service.name
| sort timestamp desc

Query by severity

fetch logs
| filter cloud.provider == "gcp"
  and loglevel == "ERROR"
| summarize count=count(), by: {gcp.project.id, gcp.resource.type}
| sort count desc

Signals in context

Logs carry these attributes:

Example log record (GCE guest agent):

{
  "timestamp": "2026-09-14T12:51:23.053000000Z",
  "cloud.provider": "gcp",
  "gcp.project.id": "my-project",
  "gcp.resource.type": "gce_instance",
  "gcp.log.id": "GCEGuestAgent",
  "gcp.logName": "projects/my-project/logs/GCEGuestAgent",
  "gcp.location": "europe-central2-c",
  "gcp.region": "europe-central2",
  "gcp.zone": "europe-central2-c",
  "gcp.resource_labels.instance_id": "8969141140234854598",
  "gcp.resource_labels.project_id": "my-project",
  "gcp.resource_labels.zone": "europe-central2-c",
  "severity": "INFO",
  "loglevel": "INFO",
  "status": "INFO",
  "message": "Completed adding/removing routes for aliases, forwarded IP and target-instance IPs",
  "content": "{\"localTimestamp\":\"2026-09-14T12:51:23.0539Z\",\"message\":\"Completed adding/removing routes for aliases, forwarded IP and target-instance IPs\"}",
  "dt.openpipeline.source": "da-gcp-pubsub",
  "dt.smartscape_source.id": "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE-A1B2C3D4E5F6G7H8",
  "dt.smartscape_source.type": "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
}

Enrichment timing

Enrichment requires the resource to be already discovered with up-to-date label and tag data. Logs arriving before discovery or before the latest labels and tags are available are ingested without enrichment. Label changes propagate within minutes; tag changes can take up to one hour. Use OpenPipeline rules to set defaults for missing attributes or drop unenriched records.

Cost considerations

Dynatrace pricing

Ingested logs count toward your Dynatrace log ingest consumption. See the Dynatrace rate card for current log ingest rates.

Google Cloud pricing

The log forwarding pipeline runs in your Google Cloud project and can cause charges for the following Google Cloud services:

For details and current rates, see the Google Cloud pricing pages.