GCP Pub/Sub (log sink)
Google Cloud logs streamed through a Cloud Logging sink onto a Pub/Sub subscription. Carries whatever the sink's filter selects — audit, Data Access, VPC flow, firewall, GKE — for a whole organisation, with the subscription as the cursor.
- Connector id:
gcp_pubsub - Category: cloud
- Authentication: OAuth
Configuration
| Field | Label | Type | Required | Default | Notes |
|---|---|---|---|---|---|
project_id | Project ID (of the subscription) | string | yes | — | The project the Pub/Sub subscription lives in, which may differ from the projects the sink reads. |
subscription_id | Subscription ID | string | yes | — | A pull subscription on the topic your log sink publishes to. Push subscriptions are not read by this connector. |
service_account_json | Service account JSON key | secret | yes | — | encrypted at rest · Needs roles/pubsub.subscriber on the subscription. Paste the entire key file; it is encrypted at rest by the credential vault. |
ack_deadline_seconds | Acknowledgement deadline (seconds) | number | no | 120 | Recorded for the setup guide and compared against the subscription at test time. Messages stay unacknowledged until ingest confirms them, so the deadline has to cover a poll and the push that follows it — not just the poll. AiSOC stops pulling once it has spent half the deadline, and a message whose deadline lapses first is redelivered and de-duplicated rather than lost. |
service_account_json is encrypted at rest by the credential vault before the row is written, and decrypted only at poll time. The value is never logged and never returned by the API — a read of the saved connector shows the field as set, not its contents. See credential vault.
Setup
- In the console, go to Connectors → Add connector and pick GCP Pub/Sub (log sink).
- Fill in the fields above and run Test connection. The test is read-only and does not save anything.
- Save. Polling starts on a jittered schedule within about a minute; the connector row shows
last_synconce the first poll completes.
last_sync stays emptyThe first poll is the honest signal that the credential works. A connector that saves cleanly and never syncs usually means the credential lacks a scope the vendor requires for reads — check the connectors service log for the vendor's own error, which is passed through verbatim rather than summarised.
Vendor-specific setup notes go here: which console page issues the credential, which scopes to grant, rate limits, and anything the schema cannot express. This section is preserved when the page is regenerated.