Configure VPC Flow Logs (original) (raw)

Skip to main content

This page explains how to configure VPC Flow Logs. It assumes that you are familiar with the concepts described inVPC Flow Logs andAbout VPC Flow Logs records.

Before you begin

Configure at least one of the following:

For more information about which API to use to enable VPC Flow Logs for subnets, seeChoose how to enable VPC Flow Logs for a subnet.

Set up the Google Cloud CLI

Skip this step if you don't plan to use the gcloud CLI to configure VPC Flow Logs.

In the Google Cloud console, activate Cloud Shell.

Activate Cloud Shell

At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

Enable VPC Flow Logs

You enable VPC Flow Logs for a resource by creating a VPC Flow Logs configuration. VPC Flow Logs lets you create configurations at the organization and project levels:

You can add more than one VPC Flow Logs configuration per resource. Each configuration generates a separate set of flow logs. If you associate a resource with multiple VPC Flow Logs configurations and their scope overlaps, your logging information might containduplicate logs.

You can also modify the amount of information written to logging. For more information about the parameters that you can control, seeLog sampling and processing.

Enable VPC Flow Logs for a subnet

When you enable VPC Flow Logs for a subnet, you enable logging for all VMs in the subnet.

Choose how to enable VPC Flow Logs for a subnet

You can use the Network Management API or the Compute Engine API to enable VPC Flow Logs for subnets. Because the Network Management API offers more options for enabling VPC Flow Logs, we recommend that you use the Network Management API.

The Network Management API provides feature parity with the Compute Engine API—all options for configuring VPC Flow Logs for subnets that are available in the Compute Engine API are supported in the Network Management API.

For existing VPC Flow Logs configurations that are managed by the Compute Engine API, consider the following:

Enable VPC Flow Logs for a subnet (Network Management API)

This section describes how to enable VPC Flow Logs for a subnet by using the Network Management API (recommended).

Console

  1. In the Google Cloud console, go to the VPC networks page.
    Go to VPC networks
  2. On the Subnets in current project tab, select one or more subnets and then clickManage flow logs.
  3. In Manage flow logs, click Add new configuration.
  4. Do one of the following:
    • If you selected one subnet, in the Configurations — Subnetssection, click Add a configuration.
    • If you selected multiple subnets, in the Configure VPC Flow Logssection, select Network Management API.
  5. For Name, enter a name for the new VPC Flow Logs configuration.
  6. Optional: Adjust the Aggregation interval and any of the settings in the Advanced settings section:
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 100% means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  7. Click Save.

gcloud

To enable VPC Flow Logs for a subnet, use thegcloud network-management vpc-flow-logs-configs create command.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

In the gcloud CLI, set your project to the Google Cloud project ID of the subnet and run one of the following commands:

To set the optional parameters in a custom configuration, replace the following:

API

To enable VPC Flow Logs for a subnet, use theprojects.locations.vpcFlowLogsConfigs.create method.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

To create a default VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME { "subnet": "SUBNET" }

To create a custom VPC Flow Logs configuration, specify each parameter that you want to customize.

For example, to customize the aggregation interval, filtering, secondary sampling rate, and metadata parameters when creating a VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME { "subnet": "SUBNET", "aggregationInterval": "AGGREGATION_INTERVAL", "filterExpr": "FILTER_EXPRESSION", "flowSampling": SAMPLING_RATE, "metadata": "LOGGING_METADATA" }

Replace the following:

Enable VPC Flow Logs for a subnet (Compute Engine API)

This section describes how to enable VPC Flow Logs for a subnet by using the Compute Engine API. You can enable VPC Flow Logs when you create a subnet or for an existing subnet.

We recommend that youenable VPC Flow Logs for a subnet by using the Network Management API.

Enable VPC Flow Logs when you create a subnet

Console

  1. In the Google Cloud console, go to the VPC networks page.
    Go to VPC networks
  2. Click the network where you want to add a subnet.
  3. Click Add subnet.
  4. For Flow logs, select On.
  5. Optional: Adjust the Aggregation interval and any of the following settings in the Advanced settings section:
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 50% means that half of entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  6. Populate other fieldsas appropriate.
  7. Click Add.

gcloud

Run the following command:

gcloud compute networks subnets create SUBNET_NAME
--enable-flow-logs
[--logging-aggregation-interval=AGGREGATION_INTERVAL]
[--logging-flow-sampling=SAMPLING_RATE]
[--logging-filter-expr=FILTER_EXPRESSION]
[--logging-metadata=LOGGING_METADATA]
[--logging-metadata-fields=METADATA_FIELDS]
[other flags as needed]

Replace the following:

API

Enable VPC Flow Logs when you create a new subnet.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks { "logConfig": { "aggregationInterval": "AGGREGATION_INTERVAL", "flowSampling": SAMPLING_RATE, "filterExpr": EXPRESSION, "metadata": METADATA_SETTING, "metadataFields": METADATA_FIELDS, "enable": true }, "ipCidrRange": "IP_RANGE", "network": "NETWORK_URL", "name": "SUBNET_NAME" }

Replace the following:

For more information, see thesubnetworks.insert method.

Terraform

You can use a Terraform moduleto create a custom mode VPC network and subnets.

The following example creates three subnets as follows:

To learn how to apply or remove a Terraform configuration, seeBasic Terraform commands.

Enable VPC Flow Logs for an existing subnet

Console

  1. In the Google Cloud console, go to the VPC networks page.
    Go to VPC networks
  2. On the Subnets in current project tab, select one or more subnets and then clickManage flow logs.
  3. In Manage flow logs, click Add new configuration.
  4. Do one of the following:
    • If you selected one subnet, in the**Configurations - Subnets (Compute Engine API)**section, click Add a configuration.
    • If you selected multiple subnets, in the Configure VPC Flow Logssection, select Compute Engine API.
  5. Optional: Adjust the Aggregation interval and any of the following settings in the Advanced settings section:
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 50% means that half of entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  6. Click Save.

gcloud

Run the following command:

gcloud compute networks subnets update SUBNET_NAME
--enable-flow-logs
[--logging-aggregation-interval=AGGREGATION_INTERVAL]
[--logging-flow-sampling=SAMPLING_RATE]
[--logging-filter-expr=FILTER_EXPRESSION]
[--logging-metadata=LOGGING_METADATA]
[--logging-metadata-fields=METADATA_FIELDS]
[other flags as needed]

Replace the following:

API

Enable VPC Flow Logs for an existing subnet.

PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME { "logConfig": { "enable": true ...other logging fields. }, "fingerprint": "SUBNET_FINGERPRINT" }

Replace the following:

For more information, see thesubnetworks.patch method.

Enable VPC Flow Logs for a VLAN attachment

Console

  1. In the Google Cloud console, go to the Interconnect page.
    Go to Interconnect
  2. In the VLAN attachments tab, select one or more VLAN attachments and then clickManage flow logsin the selection bar at the top of the list.
  3. In Manage flow logs, click Add new configuration.
  4. For Name, enter a name for the new VPC Flow Logs configuration.
  5. Optional: Adjust the Aggregation interval and any of the settings in the Advanced settings section:
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 100% means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  6. Click Save.

gcloud

To enable VPC Flow Logs for a VLAN attachment, use thegcloud network-management vpc-flow-logs-configs create command.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

In the gcloud CLI, set your project to the Google Cloud project ID of the VLAN attachment and run one of the following commands:

To set the optional parameters in a custom configuration, replace the following:

Terraform

You can use a Terraform moduleto create a VPC Flow Logs configuration for a VLAN attachment.

The following code block creates a default VPC Flow Logs configuration.

The preceding example assumes that the name of thegoogle_compute_interconnect_attachment resource is attachment. For a full example of this configuration, see the terraform-docs-samples repository.

The following code block creates a VPC Flow Logs configuration where:

The preceding example assumes that the name of thegoogle_compute_interconnect_attachment resource is attachment. For a full example of this configuration, see the terraform-docs-samples repository.

To learn how to apply or remove a Terraform configuration, seeBasic Terraform commands.

API

To enable VPC Flow Logs for a VLAN attachment, use theprojects.locations.vpcFlowLogsConfigs.create method.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

To create a default VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME { "interconnectAttachment": "VLAN_ATTACHMENT" }

To create a custom VPC Flow Logs configuration, specify each parameter that you want to customize.

For example, to customize the aggregation interval, filtering, secondary sampling rate, and metadata parameters when creating a VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME { "interconnectAttachment": "VLAN_ATTACHMENT", "aggregationInterval": "AGGREGATION_INTERVAL", "filterExpr": "FILTER_EXPRESSION", "flowSampling": SAMPLING_RATE, "metadata": "LOGGING_METADATA" }

Replace the following:

Enable VPC Flow Logs for a Cloud VPN tunnel

Console

  1. In the Google Cloud console, go to the VPN page.
    Go to VPN
  2. In the Cloud VPN tunnels tab, select one or more Cloud VPN tunnels and then clickManage flow logs in the selection bar at the top of the list.
  3. In Manage flow logs, click Add new configuration.
  4. For Name, enter a name for the new VPC Flow Logs configuration.
  5. Optional: Adjust the Aggregation interval and any of the settings in the Advanced settings section:
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 100% means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  6. Click Save.

gcloud

To enable VPC Flow Logs for a Cloud VPN tunnel, use thegcloud network-management vpc-flow-logs-configs create command.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

In the gcloud CLI, set your project to the Google Cloud project ID of the Cloud VPN tunnel and run one of the following commands:

To set the optional parameters in a custom configuration, replace the following:

Terraform

You can use a Terraform moduleto create a VPC Flow Logs configuration for a Cloud VPN tunnel.

The following code block creates a default VPC Flow Logs configuration.

The preceding example assumes that the name of thegoogle_compute_vpn_tunnel resource is tunnel. For a full example of this configuration, see the terraform-docs-samples repository.

The following code block creates a VPC Flow Logs configuration where:

The preceding example assumes that the name of thegoogle_compute_vpn_tunnel resource is tunnel. For a full example of this configuration, see the terraform-docs-samples repository.

To learn how to apply or remove a Terraform configuration, seeBasic Terraform commands.

API

To enable VPC Flow Logs for a Cloud VPN tunnel, use theprojects.locations.vpcFlowLogsConfigs.create method.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

To create a default VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME { "vpnTunnel": "VPN_TUNNEL" }

To create a custom VPC Flow Logs configuration, specify each parameter that you want to customize.

For example, to customize the aggregation interval, filtering, secondary sampling rate, and metadata parameters when creating a VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME { "vpnTunnel": "VPN_TUNNEL", "aggregationInterval": "AGGREGATION_INTERVAL", "filterExpr": "FILTER_EXPRESSION", "flowSampling": SAMPLING_RATE, "metadata": "LOGGING_METADATA" }

Replace the following:

Enable VPC Flow Logs for a VPC network

To enable VPC Flow Logs for all subnets, VLAN attachments, and Cloud VPN tunnels in a VPC network, do the following.

Console

  1. In the Google Cloud console, go to the VPC networks page.
    Go to VPC networks
  2. In the Networks in current project tab, select one or more networks and then clickManage flow logs at the top of the list.
  3. In Manage flow logs, click Add new configuration.
  4. For Name, enter a name for the new VPC Flow Logs configuration.
  5. Optional: Adjust the Aggregation interval and any of the settings in the Advanced settings section:
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 100% means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  6. Click Save.

gcloud

To enable VPC Flow Logs for a VPC network, use thegcloud network-management vpc-flow-logs-configs create command.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

In the gcloud CLI, set your project to the Google Cloud project ID of the VPC network and run one of the following commands:

To set the optional parameters in a custom configuration, replace the following:

API

To enable VPC Flow Logs for a VPC network, use the projects.locations.vpcFlowLogsConfigs.create method.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

To create a default VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME { "network": "NETWORK" }

To create a custom VPC Flow Logs configuration, specify each parameter that you want to customize.

For example, to customize the aggregation interval, filtering, secondary sampling rate, and metadata parameters when creating a VPC Flow Logs configuration, include the following parameters in your API request:

POST https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME { "network": "NETWORK", "aggregationInterval": "AGGREGATION_INTERVAL", "filterExpr": "FILTER_EXPRESSION", "flowSampling": SAMPLING_RATE, "metadata": "LOGGING_METADATA" }

Replace the following:

Enable VPC Flow Logs for an organization

To enable VPC Flow Logs for all subnets, VLAN attachments, and Cloud VPN tunnels in all VPC networks in an organization, do the following.

Console

  1. In the Google Cloud console, go to the VPC Flow Logs page.
    Go to VPC Flow Logs
  2. Click Add VPC Flow Logs configuration and then clickAdd a configuration for the organization.
  3. For Name, enter a name for the new VPC Flow Logs configuration.
  4. Optional: Adjust the Aggregation interval and any of the settings in the Advanced settings section:
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include cross-project annotations. By default, Cross-project metadata annotations is selected. For more information, see Cross-project annotations.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 100% means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  5. Click Save.

gcloud

To enable VPC Flow Logs for an organization, use thegcloud network-management vpc-flow-logs-configs create command.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

API

To enable VPC Flow Logs for an organization, use the organizations.locations.vpcFlowLogsConfigs.create method.

You enable VPC Flow Logs by creating a VPC Flow Logs configuration. You can create the configuration with all of its parameters set to their default values, or you can customize the default values.

To create a default VPC Flow Logs configuration, include the following parameters in your API request:

POST -H "x-goog-user-project:PROJECT_ID" https://networkmanagement.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME

To create a custom VPC Flow Logs configuration, specify each parameter that you want to customize.

For example, to customize the aggregation interval, filtering, secondary sampling rate, and metadata parameters when creating a VPC Flow Logs configuration, include the following parameters in your API request:

POST -H "x-goog-user-project:PROJECT_ID" https://networkmanagement.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/vpcFlowLogsConfigs?vpc_flow_logs_config_id=CONFIG_NAME { "aggregationInterval": "AGGREGATION_INTERVAL", "filterExpr": "FILTER_EXPRESSION", "flowSampling": SAMPLING_RATE, "metadata": "LOGGING_METADATA", "crossProjectMetadata": "CROSS_PROJECT_METADATA" }

Replace the following:

When VPC Flow Logs is enabled for an organization, flow logs are written and billed to the Google Cloud project of the resource that reports flow logs. For more information, see Pricing and billing.

View VPC Flow Logs configuration status

You can check which resources have VPC Flow Logs enabled by viewing their VPC Flow Logs configurations. To view all configurations, seeView VPC Flow Logs configurations (all). If you use the Compute Engine API toenable and manage VPC Flow Logs, seeView VPC Flow Logs configurations (Compute Engine API only).

View VPC Flow Logs configurations (all)

Console

To view all VPC Flow Logs configurations, do the following:

  1. In the Google Cloud console, go to the VPC Flow Logs page.
    Go to VPC Flow Logs
  2. In the Organization-level configurations andProject-level configurations sections, view your active and paused configurations. If the status of a VPC Flow Logs configuration for a resource is On, it means that logging is turned on.

You can also view VPC Flow Logs configurations in theFlow log configs column on the resource page. For example, to view which VPC networks and subnets have VPC Flow Logs configurations:

  1. Go to the VPC networks page.
    Go to VPC networks
  2. Click the Networks in current project orSubnets in current project tab and in the Flow log configscolumn, view your active and paused VPC Flow Logs configurations.

gcloud

To view VPC Flow Logs configurations, use thegcloud network-management vpc-flow-logs-configs list andgcloud network-management vpc-flow-logs-configs describe commands.

View organization-level configurations

View project-level configurations

View all configurations for a resource

To view all VPC Flow Logs configurations for a VPC network, subnet, VLAN attachment, or a VPN tunnel, run the following command:

gcloud network-management vpc-flow-logs-configs show-effective-flow-logs-configs
--location=global
--resource=TARGET_RESOURCE

Replace TARGET_RESOURCE with one of the following resources:

When specifying the target resource, replace the following:

API

View organization-level configurations

View project-level configurations

View all configurations for a resource

To view all VPC Flow Logs configurations for a VPC network, subnet, VLAN attachment, or a VPN tunnel, use the following request:

GET https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs:showEffectiveFlowLogsConfigs?resource="TARGET_RESOURCE"

Replace the following:

When specifying the target resource, replace the following:

View VPC Flow Logs configurations (Compute Engine API only)

This section describes how to view which VPC Flow Logs configurations for subnets are managed by the Compute Engine API. To view all VPC Flow Logs configurations, seeView VPC Flow Logs configurations.

Console

  1. In the Google Cloud console, go to the VPC Flow Logs page.
    Go to VPC Flow Logs
  2. In the Project-level configurations section, click the Subnets (Compute Engine API) tab and view which subnets in the project have VPC Flow Logs enabled.
    These configurations are managed by the Compute Engine API. Configurations that are managed by the Network Management API are displayed in the Subnets tab.

gcloud

To view which subnets in a VPC network have VPC Flow Logs enabled, run the following command:

gcloud compute networks subnets list
--project PROJECT_ID
--network="NETWORK"
--format="csv(name,region,logConfig.enable)"

Replace the following:

Update VPC Flow Logs configuration

You can update a VPC Flow Logs configuration. For more information about the parameters that you can modify, seeLog sampling and processing.

Update an organization-level configuration

Updating a VPC Flow Logs configuration for an organization applies the modified configuration to all subnets, VLAN attachments, and Cloud VPN tunnels in all VPC networks in the organization.

Console

  1. In the Google Cloud console, go to the VPC Flow Logs page.
    Go to VPC Flow Logs
  2. In the Organization-level configurations section, select one or more configurations that you want to update and click Edit.
  3. Adjust any of the following:
    • The Aggregation interval. By default, the aggregation interval is set to 5 sec.
    • Whether to set the Status of the VPC Flow Logs configuration to on or off. The On status means that the selected VPC Flow Logs configuration is active and generates flow logs.
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include cross-project annotations. By default, Cross-project metadata annotations is selected. For more information, seeCross-project annotations.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 100% means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  4. Click Save.

gcloud

Use thegcloud network-management vpc-flow-logs-configs update command. The square brackets [] in the following commands indicate optional parameters.

To update a VPC Flow Logs configuration for an organization, run the following command:

gcloud network-management vpc-flow-logs-configs update CONFIG_NAME
--location=global
--organization=ORGANIZATION
[--aggregation-interval=AGGREGATION_INTERVAL]
[--filter-expr=FILTER_EXPRESSION]
[--flow-sampling=SAMPLING_RATE]
[--metadata=LOGGING_METADATA]
[--cross-project-metadata=CROSS_PROJECT_METADATA]
[--state=STATE]

For example, to update the aggregation interval parameter, run the following command:

gcloud network-management vpc-flow-logs-configs update CONFIG_NAME
--location=global
--organization=ORGANIZATION
--aggregation-interval=AGGREGATION_INTERVAL

Replace the following:

To update the optional parameters, replace the following:

API

Use theorganizations.locations.vpcFlowLogsConfigs.patch method. For information about the fields that you can modify, seeREST Resource: projects.locations.vpcFlowLogsConfigs.

To update a VPC Flow Logs configuration for an organization, include the following parameters in your API request:

PATCH -H "x-goog-user-project:PROJECT_ID" https://networkmanagement.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME?updateMask=FIELDS { ...fields to modify }

Replace the following:

For example, to update the aggregationInterval field for a configuration my-config in my-organization, use the following API request:

PATCH -H "x-goog-user-project:PROJECT_ID" https://networkmanagement.googleapis.com/v1/organizations/my-organization/locations/global/vpcFlowLogsConfigs/my-config?updateMask=aggregationInterval { aggregationInterval:AGGREGATION_INTERVAL }

Replace the following:

Update a project-level configuration

Project-level configurations include configurations for VPC networks, subnets, VLAN attachments, and Cloud VPN tunnels. Updating a VPC Flow Logs configuration for a VPC network applies the modified configuration to all subnets, VLAN attachments, and Cloud VPN tunnels in the network.

To update a VPC Flow Logs configuration managed by the Compute Engine API, seeUpdate configuration parameters for subnets.

Console

  1. In the Google Cloud console, go to the VPC Flow Logs page.
    Go to VPC Flow Logs
  2. In the Project-level configurations section, select one or more configurations that you want to update and click Edit.
  3. Adjust any of the following:
    • The Aggregation interval. By default, the aggregation interval is set to 5 sec.
    • Whether to set the Status of the VPC Flow Logs configuration to on or off. The On status means that the selected VPC Flow Logs configuration is active and generates flow logs.
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 100% means that all entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  4. Click Save.

You can also use theManage flow logs menu in the following locations to edit your VPC Flow Logs configurations:

gcloud

Use thegcloud network-management vpc-flow-logs-configs update command. The square brackets [] in the following command indicate optional parameters.

gcloud network-management vpc-flow-logs-configs update CONFIG_NAME
--location=global
[--network=NETWORK | --subnet=SUBNET | --interconnect-attachment=VLAN_ATTACHMENT | --vpn-tunnel=VPN_TUNNEL]
[--aggregation-interval=AGGREGATION_INTERVAL]
[--filter-expr=FILTER_EXPRESSION]
[--flow-sampling=SAMPLING_RATE]
[--metadata=LOGGING_METADATA]
[--state=STATE]

For example, to update the aggregation interval parameter, run the following command:

gcloud network-management vpc-flow-logs-configs update CONFIG_NAME
--location=global
--aggregation-interval=AGGREGATION_INTERVAL

Replace the following:

To update the optional parameters, replace the following:

API

Use theprojects.locations.vpcFlowLogsConfigs.patch method. For information about the fields that you can modify, seeREST Resource: projects.locations.vpcFlowLogsConfigs.

To update a VPC Flow Logs configuration, include the following parameters in your API request:

PATCH https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME?updateMask=FIELDS { ...fields to modify }

Replace the following:

For example, to update the aggregationInterval field for a configuration my-config in my-project, use the following API request:

PATCH https://networkmanagement.googleapis.com/v1/projects/my-project/locations/global/vpcFlowLogsConfigs/my-config?updateMask=aggregationInterval { aggregationInterval:AGGREGATION_INTERVAL }

Replace AGGREGATION_INTERVAL with any of the supported values for this parameter.

Update configuration parameters for subnets

This section describes how to update a VPC Flow Logs configuration managed by the Compute Engine API.

To view which VPC Flow Logs configurations are managed by the Compute Engine API, seeView which subnets in a network have VPC Flow Logs enabled.

Console

  1. In the Google Cloud console, go to the VPC networks page.
    Go to VPC networks
  2. Under Subnets in current project, click the subnet that you want to update.
  3. Click Edit.
  4. Optional: Adjust any of the following settings:
    • The Aggregation interval. By default, the aggregation interval is set to 5 sec.
    • Whether to configure log filtering. By default,Keep only logs that match a filter is deselected.
    • Whether to include metadata in the final log entries. By default, Metadata annotations includes all fields.
    • The Secondary sampling rate. 50% means that half of entries generated by the primary flow log sampling process are kept. The primary flow log sampling rate isn't configurable. For more information, seeLog sampling and processing.
  5. Click Save.

Alternatively, you can update your VPC Flow Logs configuration parameters by using theManage flow logs menu under Subnets in current project on the VPC networkspage.

gcloud

Run the following command:

gcloud compute networks subnets update SUBNET_NAME
[--logging-aggregation-interval=AGGREGATION_INTERVAL]
[--logging-flow-sampling=SAMPLING_RATE]
[--logging-filter-expr=FILTER_EXPRESSION]
[--logging-metadata=LOGGING_METADATA]
[--logging-metadata-fields=METADATA_FIELDS] \

Replace the following:

API

Modify the log sampling fields to update VPC Flow Logs behaviors.

PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME { "logConfig": { ...fields to modify }, "fingerprint": "SUBNET_FINGERPRINT" }

Replace the following:

For more information, see thesubnetworks.patch method.

Stop logs collection

You can pause logs collection for a resource byturning off all of its active VPC Flow Logs configurations.

If you no longer need a VPC Flow Logs configuration, you candelete the configuration. Logs collection is stopped and the configuration is deleted.

To stop logs collection and delete a VPC Flow Logs configuration managed by the Compute Engine API, seedisable VPC Flow Logs for a subnet.

Turn off a VPC Flow Logs configuration

Console

  1. In the Google Cloud console, go to the VPC Flow Logs page.
    Go to VPC Flow Logs
  2. In the Organization-level configurations orProject-level configurations sections, select one or more VPC Flow Logs configurations that you want to turn off and change the configuration status to Turn off.
    If your selection includes both active and inactive configurations, in theChange configuration status menu, click Turn all off.

gcloud

To pause logs collection for a VPC Flow Logs configuration, use the gcloud network-management vpc-flow-logs-configs update command.

Pause an organization-level configuration

gcloud network-management vpc-flow-logs-configs update CONFIG_NAME
--location=global
--organization=ORGANIZATION
--state=disabled

Replace the following:

Pause a project-level configuration

gcloud network-management vpc-flow-logs-configs update CONFIG_NAME
--location=global
--state=disabled

Replace CONFIG_NAME with the name of the configuration.

API

Pause an organization-level configuration

To pause logs collection, use theorganizations.locations.vpcFlowLogsConfigs.patch method.

PATCH -H "x-goog-user-project:PROJECT_ID" https://networkmanagement.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME?updateMask=state { "state": "DISABLED" }

Replace the following:

Pause a project-level configuration

To pause logs collection, use theprojects.locations.vpcFlowLogsConfigs.patch method.

PATCH https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME?updateMask=state { "state": "DISABLED" }

Replace the following:

Delete a VPC Flow Logs configuration

Console

  1. In the Google Cloud console, go to the VPC Flow Logs page.
    Go to VPC Flow Logs
  2. In the Organization-level configurations orProject-level configurations sections, select one or more VPC Flow Logs configurations that you want to delete and click Delete.

gcloud

To delete a VPC Flow Logs configuration, use the gcloud network-management vpc-flow-logs-configs delete command.

Delete an organization-level configuration

gcloud network-management vpc-flow-logs-configs delete CONFIG_NAME
--location=global
--organization=ORGANIZATION

Replace the following:

Delete a project-level configuration

gcloud network-management vpc-flow-logs-configs delete CONFIG_NAME
--location=global

Replace CONFIG_NAME with the name of the configuration that you want to delete.

API

Delete an organization-level configuration

To delete a VPC Flow Logs configuration, use theorganizations.locations.vpcFlowLogsConfigs.delete method.

DELETE -H "x-goog-user-project:PROJECT_ID" https://networkmanagement.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME

Replace the following:

Delete a project-level configuration

To delete a VPC Flow Logs configuration, use theprojects.locations.vpcFlowLogsConfigs.delete method.

DELETE https://networkmanagement.googleapis.com/v1/projects/PROJECT_ID/locations/global/vpcFlowLogsConfigs/CONFIG_NAME

Replace the following:

Disable VPC Flow Logs for a subnet

This section describes how to delete a VPC Flow Logs configuration managed by the Compute Engine API. When you disable VPC Flow Logs for a subnet, logs collection is stopped and the configuration is deleted.

Console

  1. In the Google Cloud console, go to the VPC networks page.
    Go to VPC networks
  2. Click the subnet that you want to update.
  3. Click Edit.
  4. For Flow logs, select Off.
  5. Click Save.

gcloud

Run the following command:

gcloud compute networks subnets update SUBNET_NAME
--no-enable-flow-logs

API

Disable VPC Flow Logs on a subnet to stop collecting log records.

PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME { "logConfig": { "enable": false }, "fingerprint": "SUBNET_FINGERPRINT" }

Replace the following:

For more information, see thesubnetworks.patch method.

Examples of log filters

This section provides examples of log filters that you can configure to only preserve logs that match the filter. For more information, seeLog filtering.

Example 1. Limit logs collection to a specific VM named my-vm

In this case, only logs where the src_instance field as reported by the source of the traffic is my-vm or the dst_instance field as reported by the destination of the traffic is my-vm are recorded.

gcloud network-management vpc-flow-logs-configs update my-config
--location=global
--filter-expr="(src_instance.vm_name == 'my-vm' && reporter=='SRC') || (dest_instance.vm_name == 'my-vm' && reporter=='DEST')"

If youenabled VPC Flow Logs by using the Compute Engine API, run the following command instead:

gcloud compute networks subnets update my-subnet
--logging-filter-expr="(src_instance.vm_name == 'my-vm' && reporter=='SRC') || (dest_instance.vm_name == 'my-vm' && reporter=='DEST')"

Example 2. Limit logs collection to packets whose source IP addresses are in the 10.0.0.0/8 subnet

gcloud network-management vpc-flow-logs-configs update my-config
--location=global
--filter-expr="inIpRange(connection.src_ip, '10.0.0.0/8')"

If youenabled VPC Flow Logs by using the Compute Engine API, run the following command instead:

gcloud compute networks subnets update my-subnet
--logging-filter-expr="inIpRange(connection.src_ip, '10.0.0.0/8')"

Example 3. Limit logs collection to VM traffic that is external to a VPC network

gcloud network-management vpc-flow-logs-configs update my-config
--location=global
--filter-expr="!(has(src_vpc.vpc_name) && has(dest_vpc.vpc_name))"

If youenabled VPC Flow Logs by using the Compute Engine API, run the following command instead:

gcloud compute networks subnets update my-subnet
--logging-filter-expr="!(has(src_vpc.vpc_name) && has(dest_vpc.vpc_name))"

Example 4. Limit logs collection to a specific destination VLAN attachment or Cloud VPN tunnel, my-gateway

gcloud network-management vpc-flow-logs-configs update my-config
--location=global
--filter-expr="dest_gateway.name == 'my-gateway'"

Example 5. Limit logs collection to VLAN attachments

gcloud network-management vpc-flow-logs-configs update my-config
--location=global
--filter-expr="dest_gateway.type == 'INTERCONNECT_ATTACHMENT'"

Example 6. Limit logs collection to a specific source VPC network, my-network

gcloud network-management vpc-flow-logs-configs update my-config
--location=global
--filter-expr="src_vpc.vpc_name == 'my-network'"

Troubleshooting

The following sections can help you diagnose issues with your VPC Flow Logs configuration.

Flow logs for subnets appear to be disabled even though you enabled them

What's next

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-06-15 UTC.