# GCP logs on your buckets, searchable in seconds.

Cloud Logging's retention pricing and log-sink exports mean most teams already ship their high-volume GCP logs to GCS and lose the ability to search them. CtrlB indexes those exports where they land.

## Metadata

- **Canonical HTML**: https://ctrlb.ai/solutions/google-cloud
- **Section**: Solutions — Google Cloud

## At a glance

| Figure | What it refers to |
|--------|-------------------|
| Log sinks | Index what they already write |
| In place | Indexes land in your GCS bucket |
| Data access | Audit logs affordable to keep on |
| GKE | Per-pod dimensions preserved |

## What the sink costs you

- Data access audit logs are the highest-value and highest-volume source, and retention pricing makes keeping them a difficult argument.
- The usual answer is a log sink to GCS, which solves cost and removes searchability in the same move.
- Querying the export means BigQuery loads or full scans, priced by bytes and measured in minutes.
- GKE container logs are voluminous and repetitive, so they get sampled at exactly the wrong time.

## What changes

- The GCS bucket your sink already writes to becomes the searchable lake — no second destination and no re-export.
- Point queries against audit and flow logs return in seconds instead of minutes, without a per-scan bill.
- Data access audit logging stays on, because keeping it is storage rather than retention pricing.
- GKE logs and metrics keep per-pod identity, since dimensions are columns rather than billable series.

## How it works

1. **Keep your existing sink** — Cloud Logging sinks already export to GCS. Leave them exactly as they are and point CtrlB at the destination bucket.
2. **Index where it lands** — Compact inverted indexes are written into the same bucket, so a needle query reads an index rather than scanning the export.
3. **Query across projects** — Sinks from many projects into one bucket become one searchable history, with project as a dimension.

## Capabilities

- **Audit logs in full**: Admin activity and data access events retained for years at GCS pricing.
- **VPC flow logs**: Network telemetry stays complete instead of being sampled to fit a budget.
- **GKE workloads**: Container logs and per-pod metrics with the pod dimension intact.
- **Organisation-wide sinks**: Aggregated exports across projects and folders index as one lake.
- **Your project, your bucket**: Data and indexes stay in the project and region you choose.
- **Multi-cloud**: GCP sits in the same lake as AWS and Azure, queried together.

## FAQ

**Do we change our log sinks?**

No. If a sink already exports to GCS, CtrlB indexes that bucket. Collection stays exactly as configured.

**How does this compare to BigQuery for logs?**

BigQuery is a strong analytical engine but log search is a different access pattern. CtrlB's inverted indexes make point lookups sub-second without loading or scanning the whole export.

**Can we keep data access audit logs on?**

That is usually the first thing teams turn back on, since the cost becomes GCS storage rather than log retention pricing.

**Does it handle organisation-level sinks?**

Yes. Aggregated sinks across many projects land as one searchable history with project and folder as dimensions.

Markdown mirror: fetch `/solutions/google-cloud.md` for this page as plain Markdown.