Access flow logs

This page describes how to access flow logs by using Cloud Logging.

Access flow logs in the Logs Explorer

VPC Flow Logs writes logs to the Google Cloud project of the log reporter. You can view flow logs in the Logs Explorer. VPC Flow Logs uses the following logs to collect log entries:

  • The networkmanagement.googleapis.com/vpc_flows log collects log entries for Virtual Private Cloud (VPC) networks, subnets, VLAN attachments for Cloud Interconnect, and Cloud VPN tunnels.
  • The compute.googleapis.com/vpc_flows log collects log entries for subnets. This log is generated only if you enabled VPC Flow Logs for subnets by using the Compute Engine API.

Configure IAM

To configure access control for logging, see the access control guide for Logging.

View flow logs by using resource filters

To view flow logs in a Google Cloud project by using resource filters, see the following sections. You can also view these logs by using Logs Explorer queries, as described in Filter flow logs by using queries.

View flow logs for all configurations (networkmanagement.googleapis.com/vpc_flows)

  1. In the Google Cloud console, go to the Logs Explorer page.

    Go to Logs Explorer

  2. Click All resources.

  3. In the Select resource list, click VPC Flow Logs Config and then click Apply.

View flow logs for a specific configuration (networkmanagement.googleapis.com/vpc_flows)

  1. In the Google Cloud console, go to the Logs Explorer page.

    Go to Logs Explorer

  2. Click All resources.

  3. In the Select resource list, click VPC Flow Logs Config and select the VPC Flow Logs configuration that you want to view.

  4. Click Apply.

View flow logs for all configurations (compute.googleapis.com/vpc_flows)

Follow these steps if you enabled VPC Flow Logs by using the Compute Engine API.

  1. In the Google Cloud console, go to the Logs Explorer page.

    Go to Logs Explorer

  2. Click All resources.

  3. In the Select resource list, click Subnetwork and then click Apply.

  4. Click All log names.

  5. In the Select log names list, find Compute Engine, click vpc_flows, and then click Apply.

View flow logs for a specific subnet (compute.googleapis.com/vpc_flows)

Follow these steps if you enabled VPC Flow Logs by using the Compute Engine API.

  1. In the Google Cloud console, go to the Logs Explorer page.

    Go to Logs Explorer

  2. Click All resources.

  3. In the Select resource list, click Subnetwork.

  4. In the Subnetwork ID list, select the subnet and then click Apply.

  5. Click All log names.

  6. In the Select log names list, find Compute Engine, click vpc_flows, and then click Apply.

Filter flow logs by using queries

To view flow logs in a Google Cloud project by using Logs Explorer queries, do the following.

  1. In the Google Cloud console, go to the Logs Explorer page.

    Go to Logs Explorer

  2. If you don't see the query editor field in the Query pane, click the Show query toggle.

  3. In the query editor field, enter a query:

    • For example, to view flow logs for a specific source Cloud VPN tunnel, enter the following query:

      resource.type="vpc_flow_logs_config"
logName="projects/PROJECT_ID/logs/networkmanagement.googleapis.com%2Fvpc_flows"
jsonPayload.reporter="SRC_GATEWAY"
labels.target_resource_name="projects/PROJECT_NUMBER/regions/REGION/vpnTunnels/NAME"

      Replace the following: