Collect Apigee logs

This document describes how you can collect Apigee logs by enabling Google Cloud telemetry ingestion to Google Security Operations and how log fields of Apigee logs map to Google Security Operations Unified Data Model (UDM) fields.

For more information, see Data ingestion to Google Security Operations .

A typical deployment consists of Apigee logs enabled for ingestion to Google Security Operations. Each customer deployment might differ from this representation and might be more complex.

The deployment contains the following components:

• Google Cloud: The Google Cloud services and products from which you collect logs.

• Apigee logs: The Apigee logs that are enabled for ingestion to Google Security Operations.

• Google Security Operations: Google Security Operations retains and analyzes the logs from Apigee.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the GCP_APIGEE_X ingestion label.

Before you begin

• Ensure that all systems in the deployment architecture are configured in the UTC time zone.

• Before starting, confirm that you have either Log Collection with MessageLogging Policy or (Legacy) Log Collection with ServiceCallout Policy set up.

• To setup up Log Collection with MessageLogging Policy, follow the steps in the Apigee Google Cloud Integration guide .

Configure Google Cloud to ingest Apigee logs

To ingest Apigee logs to Google Security Operations, follow the steps on the Ingest Google Cloud logs to Google Security Operations page.

If you encounter issues when you ingest Apigee logs, contact Google Security Operations support .

Supported Apigee log formats

The Apigee parser supports logs in JSON format.

Supported Apigee Sample Logs

• JSON

   {
      "insertId": "12wnv8zf7np8nh",
      "jsonPayload": {
        "proxy.name": "myproxy",
        "app.name": "",
        "environment.name": "test-env",
        "system.region.name": "us-west1",
        "developer.email": "",
        "target.country": "",
        "request.content-length": "",
        "client.state": "",
        "response.status.code": "200",
        "request.content-type": "",
        "response.content-type": "application/xml; charset\u003dutf-8",
        "proxy.revision": "6",
        "response.content-length": "141",
        "proxy.proxyendpoint.name": "default",
        "organization.name": "test-dummy-57377",
        "error.state": "",
        "error": "false",
        "fault.name": "",
        "client.locality": "",
        "target.state": "",
        "proxy.pathsuffix": "",
        "client.port": "50386",
        "system.uuid": "7f2fde33-5f39-4866-a073-e6c31a4664e2",
        "target.scheme": "https",
        "request.user-agent": "curl/8.5.0",
        "target.locality": "",
        "messageid": "f8093238-2f51-42ab-ae44-dec9f451c7474",
        "target.port": "443",
        "target.ip": "198.51.100.0",
        "apiproduct.name": "",
        "request.url": "https://",
        "request.x-cloud-trace-context": "e3d3fea1742455ede2dad1d975361511/11739831648342702971",
        "request.httpversion": "1.1",
        "target.host": "mocktarget.apigee.net",
        "target.url": "https://mocktarget.apigee.net/xml",
        "proxy.basepath": "/myproxy",
        "target.cn": "mocktarget.apigee.net",
        "client.country": "",
        "client.cn": "",
        "cachehit": "",
        "target.organization": "",
        "client.ip": "198.51.100.0",
        "system.timestamp": "1754652492121",
        "request.host": "",
        "request.verb": "GET",
        "request.x-b3-traceid": "31339f721d4be35ff2932fa471979252",
        "client.scheme": "https",
        "error.message": ""
      },
      "resource": {
        "type": "api",
        "labels": {
          "project_id": "test-dummy-57377",
          "version": "",
          "location": "",
          "method": "",
          "service": ""
        }
      },
      "timestamp": "2025-08-08T11:28:12.203938277Z",
      "severity": "INFO",
      "logName": "projects/test-dummy-57377/logs/apigee-secops-integration-test-env",
      "receiveTimestamp": "2025-08-08T11:28:12.203938277Z"
    } 
  

Field mapping reference

This section explains how the Google SecOps parser maps Apigee logs fields to Google Security Operations Unified Data Model (UDM) fields.

Field mapping reference: GCP_APIGEE_X Log Collection with MessageLogging Policy logs

The following table lists the log fields of the GCP_APIGEE_X Log Collection with MessageLogging Policy log type and their corresponding UDM fields.

Field mapping reference: GCP_APIGEE_X Log Collection with ServiceCallout Policy logs

The following table lists the log fields of the GCP_APIGEE_X (Legacy) Log Collection with ServiceCallout Policy log type and their corresponding UDM fields.

What's next

• Data ingestion to Google Security Operations

Need more help? Get answers from Community members and Google SecOps professionals.