google-workspace-chat-logs

Get chat logs from Google Workspace.

google-workspace-chat-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]

profile=PROFILE: Profile name of Google Workspace
duration=NUM{mon|w|d|h|m|s}: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss: End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

Output Fields

Field	Type	Name	Description
profile	String	Connect profile	Profile name of Google Workspace
_time	Date	Time
conversation_type	String	Conversation type	e.g. SPACE, USER_TO_USER_DIRECT_MESSAGE, GROUP_DIRECT_MESSAGE
room_id	String	Room ID	e.g. AAAAAAAAAAA
room_name	String	Room name	e.g. Group Chat (AAAAAAAAAAA)
user	String	User	e.g. demo@logpresso.com
action	String	Action	e.g. conversation_read, attachment_upload, attachment_download
msg	String	Message	Audit message.
dlp_scan_status	String	DLP scan status	e.g. DLP_NOT_APPLICABLE, DLP_SCANNED, DLP_SCANNED_AND_WARNED
file_name	String	File name	Attachment file name.
sha256	String	SHA-256	SHA-256 value of attachment file.
url	String	URL	Attachment URL
actor	String	Actor
actor_type	String	Actor type	e.g. ADMIN, NON_ADMIN
conversation_ownership	String	Conversation ownership	e.g. INTERNALLY_OWNED, EXTERNALLY_OWNED
external_room	String	External room	e.g. ENABLED, DISABLED
msg_type	String	Message type	e.g. REGULAR_MESSAGE
msg_id	String	Message ID	e.g.
attachment_status	String	Attachment status	e.g. HAS_ATTACHMENT, NO_ATTACHMENT
target_users	String	Target users	e.g. demo@logpresso.com
retention_state	String	Retention state	e.g. PERMANENT, EPHEMERAL_ONE_DAY
params	List	Parameters	List of name-value pairs