google-workspace-drive-logs

Get drive activity logs from Google Workspace.

google-workspace-drive-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]

profile=PROFILE: Profile name of Google Workspace
duration=NUM{mon|w|d|h|m|s}: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss: End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.

Output Fields

Field	Type	Name	Description
profile	String	Connect profile	Profile name of Google Workspace
_time	Date	Time
type	String	Type	e.g. access, pooled_quota_metadata
src_ip	IP address	Source IP address
user	String	User	e.g. example@logpresso.com
action	String	Action	e.g. view, edit, upload, download
doc_type	String	Document type	e.g. unknown, spreadsheet, pdf, msword, msexcel
doc_title	String	Document title
visibility	String	Visibility	e.g. private, people_with_link, public_in_the_domain
owner	String	Owner
shared_drive	Bool	Shared drive
team_drive	Bool	Team drive