Collect Cloud Load Balancing logs

This document describes how you can collect Cloud Load Balancing logs by enabling Google Cloud telemetry ingestion to Google Security Operations and how log fields map to Google Security Operations Unified Data Model (UDM) fields. This document also lists the supported Cloud Load Balancing version.

For more information, see Data ingestion to Google Security Operations .

A typical deployment consists of Cloud Load Balancing logs enabled for ingestion to Google Security Operations. Each customer deployment might differ from this representation and might be more complex.

The deployment contains the following components:

• Google Cloud: The Google Cloud services and products from which you collect logs.

• Cloud Load Balancing logs: The Cloud Load Balancing logs that are enabled for ingestion to Google Security Operations.

• Google Security Operations: Google Security Operations retains and analyzes the logs from Cloud Load Balancing.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the GCP_LOADBALANCING ingestion label.

Before you begin

• Ensure that you are using Cloud Load Balancing version 1.

• Ensure that all systems in the deployment architecture are configured in the UTC time zone.

Configure Google Cloud to ingest Cloud Load Balancing logs

To ingest Cloud Load Balancing logs to Google Security Operations, follow the steps on the Ingest Google Cloud logs to Google Security Operations page.

If you encounter issues when you ingest Cloud Load Balancing logs, contact Google Security Operations support .

Supported Google Cloud Load Balancing log formats

The Google Cloud Load Balancing parser supports logs in JSON format.

Supported Google Cloud Load Balancing sample logs

• JSON:

   {
    "httpRequest": {
      "latency": "0.058927s",
      "referer": "http://dummy_referer/console/",
      "remoteIp": "198.51.100.1",
      "requestMethod": "GET",
      "requestSize": "257",
      "requestUrl": "https://34.1.0.35/console/",
      "responseSize": "1467",
      "status": 302,
      "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/192.168.51.1 Safari/537.36"
    },
    "insertId": "1vzs264g1u90hp5",
    "jsonPayload": {
      "@type": "type.googleapis.com/google.cloud.loadbalancing.type.LoadBalancerLogEntry",
      "statusDetails": "handled_by_identity_aware_proxy"
    },
    "logName": "projects/prj-p-shared-base-327317/logs/requests",
    "receiveTimestamp": "2022-01-11T13:01:35.721191239Z",
    "resource": {
      "labels": {
        "backend_service_name": "dummy-service",
        "forwarding_rule_name": "fe-p-siemplify-01",
        "project_id": "dummyproject_id",
        "target_proxy_name": "dummy-proxy",
        "url_map_name": "dummy-url",
        "zone": "global"
      },
      "type": "http_load_balancer"
    },
    "severity": "INFO",
    "spanId": "9ced8a16edbf8818",
    "timestamp": "2022-01-11T13:01:34.487354Z",
    "trace": "projects/prj-p-shared-base-327317/traces/82254a9f2b743f83c0c0543c0ece2b1a"
  } 
  

Field mapping reference

This section explains how the Google Security Operations parser maps Google Cloud Load Balancing fields to Google Security Operations Unified Data Model (UDM) fields.

Field mapping reference: GCP_LOADBALANCING log fields to UDM fields

The following table lists the log fields of the GCP_LOADBALANCING log type and their corresponding UDM fields.

What's next

• Data ingestion to Google Security Operations

Need more help? Get answers from Community members and Google SecOps professionals.