Sazabi
Log sourcesConnect your account

Google Cloud

Connect your Google Cloud account so Sazabi can provision a Cloud Logging sink, Pub/Sub topic, and pull subscription for each project you select.

About

Google Cloud logs flow through Pub/Sub: a Cloud Logging sink routes log entries to a Pub/Sub topic, and a pull subscription feeds Sazabi. Connecting your GCP account lets Sazabi set up that entire pipeline — sink, topic, and subscription — in your project automatically, using a service account key you provide.

Google Cloud also has a Send to an endpoint path where you create the sink, topic, and subscription yourself and run your own OpenTelemetry Collector. See Google Cloud endpoint page for that setup.

GCP bills for Pub/Sub message delivery (and any egress); Sazabi does not. High-volume log projects can incur meaningful Pub/Sub costs on your GCP bill. Use log sink filters to forward only the logs you need. See Pub/Sub pricing.

Prerequisites

  • A GCP service account with the following IAM roles on each target project:
    • roles/serviceusage.serviceUsageAdmin
    • roles/logging.configWriter
    • roles/pubsub.admin
    • roles/browser
  • Permission to create a service account key (JSON format) for that service account.
  • The Service Usage API enabled on the project. Sazabi uses this API to enable the others, but it cannot enable itself — if it is disabled, enable it manually and wait about a minute before retrying.

If your organization enforces a Domain Restricted Sharing org policy (iam.allowedPolicyMemberDomains), an Organization Policy Administrator must relax it for the target project before Sazabi can grant the Cloud Logging sink's writer identity access to Pub/Sub. Without this, the log stream setup fails at the final step.

Set up in the dashboard

Grant the service account IAM roles

In the Google Cloud Console, select or create a service account and grant it the four roles listed in Prerequisites on the target project.

Enable the Service Usage API on the project if it is not already enabled.

Create and download a service account key

In the Google Cloud Console, open the service account, go to the Keys tab, and choose Add key > Create new key > JSON. Download the JSON file.

Alternatively, using the gcloud CLI:

gcloud iam service-accounts keys create sazabi-key.json \
  --iam-account=YOUR_SERVICE_ACCOUNT_EMAIL

Connect in Sazabi

Go to Settings > Log streams, click Add source, and select Google Cloud. Select Service account as the setup method. Paste the contents of the service account key JSON file into the key field, then click Connect.

Sazabi enables the required APIs and verifies access by listing projects accessible to the service account.

Add log streams

After the connection is confirmed, click Add log stream to open the project picker. Sazabi lists all active GCP projects accessible to the service account. Select the projects you want to forward. For each project, Sazabi creates a Pub/Sub topic, a Cloud Logging sink, and a pull subscription automatically.

Set up with the CLI

You can also connect the Google Cloud log source with the Sazabi CLI (installed and authenticated — see CLI reference).

Create a managed connection by passing the downloaded service account key JSON as the serviceAccountKey metadata field. Load the key file into the metadata so the JSON is embedded as a string:

sazabi log-sources create gcp --mode managed \
  --metadata "$(jq -n --rawfile k /path/to/service-account-key.json '{serviceAccountKey: $k}')"

Sazabi validates the service account credentials against Google Cloud and creates the log source; note the log source ID it prints.

Add a log stream — one per GCP project — with sazabi log-streams create, passing the GCP project ID in --config:

sazabi log-streams create --log-source-id <log-source-id> \
  --config '{"gcpProjectId":"<your GCP project ID>"}'

Run sazabi log-sources list to confirm the source and its streams.

Verify

Write a test log entry in a connected GCP project — for example invoke a Cloud Function or deploy to Cloud Run.

Open the Intake page in the Sazabi dashboard and confirm records attributed to the Google Cloud source appear. Logs travel through Cloud Logging and Pub/Sub, so they typically appear within a few minutes of the log event.

Troubleshooting

"Service account cannot access any active GCP projects" — Verify the service account has roles/browser on at least one project, and that the service account key JSON was pasted in full without truncation.

"Service Usage API has not been used / is disabled" — Enable the Service Usage API in the Google Cloud Console for the project, wait about a minute, then retry the connection.

Log stream setup fails at the final step — Your organization likely has a Domain Restricted Sharing org policy (iam.allowedPolicyMemberDomains). An Organization Policy Administrator must relax the policy for the project so Sazabi can grant the Cloud Logging sink's writer identity access to the Pub/Sub topic.

GCP metrics and traces are not supported — This log source covers Cloud Logging entries only. Cloud Monitoring metrics and traces are not forwarded.

Further reading

Intake

See per-source ingestion volume and health in the Intake page.

Google Cloud (send to an endpoint)

Run your own OpenTelemetry Collector against a Pub/Sub subscription.

Log sources

Browse the full log source catalog.

On this page

AboutPrerequisitesSet up in the dashboardGrant the service account IAM rolesCreate and download a service account keyConnect in SazabiAdd log streamsSet up with the CLIVerifyTroubleshootingFurther reading