Google Cloud
Set up your own Cloud Logging sink, Pub/Sub topic, and OpenTelemetry Collector to forward GCP logs to Sazabi without connecting a service account.
About
Forward Google Cloud Logging entries — from Cloud Functions, Cloud Run, GKE, Compute Engine, and other GCP services — into Sazabi by managing your own Pub/Sub pipeline and OpenTelemetry Collector.
Google Cloud also has a Connect your account path where Sazabi provisions the sink, Pub/Sub topic, and pull subscription automatically. See Google Cloud account connection page for that setup.
GCP bills for Pub/Sub message delivery and any egress; Sazabi does not. High-volume log projects can incur meaningful Pub/Sub charges on your GCP bill. Use log sink filters to forward only the logs you need. See Pub/Sub pricing.
Prerequisites
- A GCP project with Cloud Logging enabled.
- IAM permissions to create log sinks (
roles/logging.configWriteror equivalent grantinglogging.sinks.create) and to set IAM policy on Pub/Sub topics (roles/pubsub.adminor equivalent grantingpubsub.topics.setIamPolicy). - An OpenTelemetry Collector deployment using the
opentelemetry-collector-contribdistribution (for example on a GCE instance, GKE pod, or Cloud Run service) with access to pull from a Pub/Sub subscription. - The collector's service account must have
roles/pubsub.subscriberon the Pub/Sub subscription.
The googlecloudpubsub receiver requires the googlecloudlogentry_encoding
extension. Without it, the receiver cannot decode Cloud Logging entries.
Set up in the dashboard
Create a Pub/Sub topic and subscription
In your GCP project, create a Pub/Sub topic (for example sazabi-logs) and a pull subscription on it (for example sazabi-logs-sub). Your OpenTelemetry Collector will poll this subscription.
Create a Cloud Logging sink
Create a Cloud Logging sink that routes log entries to the Pub/Sub topic you created. After creating the sink, grant the sink's service account writer identity the roles/pubsub.publisher role on the topic so Cloud Logging can publish to it.
Grant the collector IAM access
Ensure the service account your OpenTelemetry Collector runs as has roles/pubsub.subscriber on the Pub/Sub subscription. Without this role the collector cannot read messages from the subscription.
Configure the OpenTelemetry Collector
Add the following to your collector configuration. Replace YOUR_GCP_PROJECT_ID with your project ID and use your intake URL (shown above) as the OTLP HTTP endpoint.
extensions:
googlecloudlogentry_encoding:
receivers:
googlecloudpubsub:
project: YOUR_GCP_PROJECT_ID
subscription: projects/YOUR_GCP_PROJECT_ID/subscriptions/sazabi-logs-sub
encoding: googlecloudlogentry_encoding
exporters:
otlp_http:
endpoint: <your intake URL>
service:
extensions: [googlecloudlogentry_encoding]
pipelines:
logs:
receivers: [googlecloudpubsub]
exporters: [otlp_http]Deploy the collector
Deploy or restart the OpenTelemetry Collector with the updated configuration. Confirm there are no startup errors in the collector process log before proceeding.
Set up with the CLI
You can also register the Google Cloud log source with the Sazabi CLI (installed and authenticated — see CLI reference).
Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):
sazabi log-sources create gcp --mode connectionlessThe command prints the intake URL for the new source — copy the whole URL and point your sender at it using the configuration shown above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources list to see every log source in the project.
Verify
Write a test log entry in your GCP project — for example invoke a Cloud Function, deploy to Cloud Run, or write an entry with the Logging API. Open the Intake page in the Sazabi dashboard and confirm records attributed to the Google Cloud source appear. Logs travel through Cloud Logging, Pub/Sub, and the collector before reaching Sazabi, so they typically appear within a few minutes of the log event.
Troubleshooting
No logs appear after several minutes — Check the OpenTelemetry Collector logs for errors on the googlecloudpubsub receiver or otlp_http exporter. Confirm the subscription has undelivered messages in the GCP console, which indicates the sink is writing to the topic but the collector is not pulling.
Collector fails to start with a missing extension error — The googlecloudpubsub receiver requires the googlecloudlogentry_encoding extension. Make sure it is listed under both extensions: and service.extensions: in your collector config.
Sink writer identity cannot publish to the topic — After creating the log sink, GCP assigns a sink-specific service account as the writer identity. You must grant that service account roles/pubsub.publisher on the Pub/Sub topic; it is not automatically granted.
GCP metrics and traces are not supported — This log source covers Cloud Logging entries only. Cloud Monitoring metrics and traces are not forwarded through this pipeline.