Supported editions for this feature: Frontline Standard; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus. Compare your edition
You can export Google Workspace logs and usage reports to Google BigQuery. With BigQuery, you can:
- Analyze individual activity information for Admin console, Google Calendar, Devices, Gmail, Google Drive, Login, Google Groups, oAuth Tokens, and SAML Audit logs, and any updates to the Reports API.
- Build reports across apps by combining activity reports with usage data from other apps used in your organization.
- Perform advanced searches on Google Workspace activity by adding organization directory data into BigQuery.
- Report aggregated usage metrics for user accounts, Drive, Chrome OS, Classroom, Calendar, Google Meet, device management, Gmail, and any updates to the Reports API.
- Create custom reporting and dashboards using analytics tools like Looker Studio and third-party visualization partners that are integrated with BigQuery.
Data availability
You can gather and aggregate information about:
- Usage reports—All users in the domain, regardless of license, for usage tables.
- Audit logs
- Drive and Device log data can be exported for individual users. For domains that have Cloud Identity Premium or an Enterprise edition and other subscriptions (for example Workspace Business, Business Plus), Drive and Device log data can be exported for all users, not just the users with Cloud Identity Premium or Enterprise licenses.
- For other logs (Admin, Calendar, Groups) data is exported for all users. (This is true for all editions.)
This data is available in one BigQuery dataset with 2 aggregate tables: activity_ and usage_. Each table has one table for every day the export is successful.
Inside the dataset, there are two tables with two different formats:
- Activity (activity_) tables—Activity tables contain all the logs data currently available for reports. To read a description of each record, go to Reports API Activities.
Note: Email logs search is available through a different feature in your Admin console. - Usage (usage_) tables—Usage tables contain data related to Google Workspace service usage across your account. They are aggregated statistics about your domain. To read a description of each record, go to Reports API: Customer Usage Parameters.
Note: You can share Google Workspace audit logs with Google Cloud. For more information, go to Share data with Google Cloud services.
Field introduced during a BigQuery export
| Table | Field | Description |
| usage | upload_time_sec |
Every row has an upload_time_sec field that is updated when the BigQuery export process runs approximately daily. The system might update a row for a particular date value every day for up to 30 days after the first date. This allows the system to correct the fields while processing the data sources that contribute to the fields in that row. For every update, the upload_time_sec field is also updated simultaneously. |
Next steps
To get started with BigQuery for reporting logs, you need to:
