> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Logging

> Reference for the Tracecat Google Cloud Logging integration: registered actions, required secrets, expected inputs, and example workflow usage.

## List log entries

Action ID: `tools.google_cloud_logging.list_log_entries`

Lists Cloud Logging entries from projects, folders, organizations, billing accounts, or specific log views. Use `log_id()` filters for the `cloudaudit.googleapis.com` `activity`, `data_access`, `system_event`, and `policy` audit log IDs. Reading Data Access audit logs requires the `logging.privateLogEntries.list` IAM permission.

Reference: [https://cloud.google.com/logging/docs/reference/v2/rest/v2/entries/list](https://cloud.google.com/logging/docs/reference/v2/rest/v2/entries/list)

### Secrets

Optional secrets:

* `google_cloud_logging_oauth`: OAuth token `GOOGLE_CLOUD_LOGGING_USER_TOKEN`.
* `google_cloud_logging_oauth`: OAuth token `GOOGLE_CLOUD_LOGGING_SERVICE_TOKEN`.
* `google_oauth`: OAuth token `GOOGLE_SERVICE_TOKEN`.
* `google_api`: required values `GOOGLE_API_CREDENTIALS`; optional values `GOOGLE_API_SUBJECT`.

### Input fields

<ParamField path="resourceNames" type="array[string]" required>
  Names of one or more parent resources from which to retrieve log entries. Supported values include `projects/PROJECT_ID`, `organizations/ORGANIZATION_ID`, `billingAccounts/BILLING_ACCOUNT_ID`, `folders/FOLDER_ID`, and full log-view resource names. A request can specify at most 100 resources.
</ParamField>

<ParamField path="filter" type="string | null">
  A Logging query-language filter that chooses which log entries to return. An empty filter matches all log entries in `resourceNames`. The maximum filter length is 20,000 characters. To select Admin Activity audit logs, use `log_id("cloudaudit.googleapis.com/activity")`; use the corresponding `data_access`, `system_event`, or `policy` log ID for the other audit-log types. Include a `timestamp` range to improve query performance.

  Default: `null`.
</ParamField>

<ParamField path="orderBy" type="string | null">
  Result order. The permitted values are `timestamp asc` and `timestamp desc`. Google recommends `timestamp desc` when listing recently ingested entries.

  Default: `null`.
</ParamField>

<ParamField path="pageSize" type="integer | null">
  Maximum number of results to return from this request. The default is 50. A negative value is rejected.

  Default: `null`.
</ParamField>

<ParamField path="pageToken" type="string | null">
  `nextPageToken` from the preceding response. Keep every other request field identical when retrieving the next page.

  Default: `null`.
</ParamField>