google-workspace-drive-logs
Get drive activity logs from Google Workspace.
Syntax
google-workspace-drive-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [raw=RAW]
Options
- profile=PROFILE
- Optional. Profile name of Google Workspace
- duration=NUM{mon|w|d|h|m|s}
- Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- raw=RAW
- Optional. t or f. Specify 't' to output line field.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Profile name of Google Workspace |
| line | String | Event raw | |
| _time | Date | Time | |
| type | String | Type | e.g. access, pooled_quota_metadata |
| src_ip | IP address | Source IP address | |
| user | String | User | e.g. example@logpresso.com |
| action | String | Action | e.g. view, edit, upload, download |
| doc_type | String | Document type | e.g. unknown, spreadsheet, pdf, msword, msexcel |
| doc_title | String | Document title | |
| visibility | String | Visibility | e.g. private, people_with_link, public_in_the_domain |
| owner | String | Owner | |
| shared_drive | Bool | Shared drive | |
| team_drive | Bool | Team drive |