This page describes the firewall policy rules logging structure in
Cloud Logging. When a firewall rule with logging enabled applies to traffic
to or from a virtual machine (VM) instance, Cloud Logging creates a log
entry. Log records appear in the JSON payload field of a
Logging
LogEntry.
Firewall log records consist of base fields, which are the core fields of every log record, and an optional metadata fields. To reduce storage costs, you can exclude metadata fields.
Some log fields can contain other fields as values. For example, the
connection field uses the IpConnection format, which includes the source and
destination IP address and port, and the protocol, in a single field.
The following table describes the log fields supported for Cloud Next Generation Firewall policy rules, such as hierarchical, global, and regional, excluding legacy fields such as network tags and service accounts, which are unsupported for Cloud NGFW policies.
| Field | Description | Field type: base or optional metadata |
|---|---|---|
connection |
IpConnection 5-Tuple describing the source and destination IP address, source and destination port, and IP protocol of this connection. |
Base |
disposition |
Indicates whether the connection was ALLOWED,
DENIED, or INTERCEPTED. |
Base |
rule_details |
RuleDetails Firewall policy rule details. The log format is {folder tier index}/firewallPolicy:{firewall policy ID} or
network:{network name}/firewallPolicy:{firewall policy ID}
based on the scope of the policy. |
Base |
instance |
InstanceDetails VM instance details. In a Shared VPC configuration, project_id corresponds to that of the service project. |
Metadata |
load_balancer_details |
LoadBalancingDetails Details of the internal Application Load Balancer or internal proxy Network Load Balancer to which the firewall policy rule applies. When the target of a firewall rule is one of these load balancers, the instance field is omitted. |
Metadata |
vpc |
VpcDetails VPC network details. In a Shared VPC configuration, project_id corresponds to that of the host project. |
Metadata |
remote_instance |
InstanceDetails If the remote endpoint of the connection was a VM located in the Compute Engine, this field is populated with VM instance details. |
Metadata |
remote_vpc |
VpcDetails If the remote endpoint of the connection was a VM that is located in a VPC network, this field is populated with the network details. |
Metadata |
remote_location |
GeographicDetails If the remote endpoint of the connection was external to the VPC network, this field is populated with available location metadata. |
Metadata |
IpConnection
| Field | Type |
|---|