GCP logs on your buckets, searchable in seconds.
Cloud Logging's retention pricing and log-sink exports mean most teams already ship their high-volume GCP logs to GCS and lose the ability to search them. CtrlB indexes those exports where they land.
Audit Logs
GKE
VPC
Cloud RunLOG ROUTER · SINKS
no second destination · no re-export
Priced per question
An investigation is never one query
The export is queryable — that was never the problem. The problem is that a scan-priced engine charges for the whole window every time you narrow the search, so the sixth refinement costs exactly what the first one did.
every refinement reads the window again — the table does not remember the last question
Worked example, not a benchmark: one investigation of six refinements against an 18-month audit export of 3.8 TB.
Cloud Logging sinksThe export to GCS was the right cost call. Search shouldn't require a second destination.
Data access audit logs are the highest-value source — and the first ones teams sink to cold storage because retention pricing makes keeping them in Logging untenable. CtrlB indexes what your sink already writes.
BigQuery · full scanone query spans every project that feeds the bucket
What the sink costs you
Data access audit logs are the highest-value and highest-volume source, and retention pricing makes keeping them a difficult argument.
The usual answer is a log sink to GCS, which solves cost and removes searchability in the same move.
Querying the export means BigQuery loads or full scans, priced by bytes and measured in minutes.
GKE container logs are voluminous and repetitive, so they get sampled at exactly the wrong time.
What changes
The GCS bucket your sink already writes to becomes the searchable lake — no second destination and no re-export.
Point queries against audit and flow logs return in seconds instead of minutes, without a per-scan bill.
Data access audit logging stays on, because keeping it is storage rather than retention pricing.
GKE logs and metrics keep per-pod identity, since dimensions are columns rather than billable series.
How it works
Leave your sinks exactly as they are. Indexes write into the same bucket, and queries span every project that feeds it.
existing sink config untouched
Keep your existing sink
Cloud Logging sinks already export to GCS. Leave them exactly as they are and point CtrlB at the destination bucket.
minutes · priced per TB
sub-second
Index where it lands
Compact inverted indexes are written into the same bucket, so a needle query reads an index rather than scanning the export.
one query spans every project that feeds the bucket
Query across projects
Sinks from many projects into one bucket become one searchable history, with project as a dimension.
The shape of a GCP log survives the trip
Audit entries arrive deeply nested, with repeated blocks and ajsonPayloadthat differs per service. A destination with a declared schema has to flatten that or drop it. Here the structure is the index.
Repeated fields stay repeated and nested objects stay nested, so a leaf nobody planned for — a user agent, a permission, a label added last quarter — is a filter the moment you think of it.
Anything the Log Router can reach
There is no per-service connector to wait for. If a service writes to Cloud Logging, a sink can export it and CtrlB can index it where it lands — including services you turn on after the bucket already exists.
Audit LogsGKEVPC
Load BalancingCloud Run
Compute Engine
Cloud Functions
App Engine
Cloud SQL
Spanner
Firestore
Pub/Sub
Cloud Armor
Cloud CDN
IAM
Cloud DNS
Cloud NAT
Secret ManagerIcons are Google’s official Google Cloud product icons, shown unmodified.
What you get
Audit logs in full
VPC flow logs
GKE workloads
Organisation-wide sinks
Your project, your bucket
Multi-cloud
“CtrlB gives us real-time visibility into our logistics systems — I can see critical events as they unfold. It’s now woven into how we operate every day at GoComet.” — Ayush Lodhi, CTO & Co-Founder.
See what changed for GoCometQuestions
No. If a sink already exports to GCS, CtrlB indexes that bucket. Collection stays exactly as configured.
BigQuery is a strong analytical engine but log search is a different access pattern. CtrlB's inverted indexes make point lookups sub-second without loading or scanning the whole export.
That is usually the first thing teams turn back on, since the cost becomes GCS storage rather than log retention pricing.
Yes. Aggregated sinks across many projects land as one searchable history with project and folder as dimensions.
Put it on your own bucket and see.
Point a source at CtrlB, keep everything else where it is, and compare the same investigation side by side.