Google Workspace Integration
Version 3.9.0 (View all)
Managed integration release status
Subscription level
What's this?		 Basic
Developed by
What's this?		 Elastic
Ingestion method(s) API
Minimum Kibana version(s) 9.1.4
9.0.7
8.19.4
Important - Managed integrations on Elastic Cloud Hosted

You can use this integration as an Elastic Managed integration on Elastic Cloud Hosted deployments running this version or later.

The Google Workspace integration collects and parses data from the different Google Workspace audit reports APIs.

These blogs from our Security Labs will help you know more about the Google Workspace and how to it setup:

  1. To understand what Google Workspace is in Part One - Surveying the Land
  2. To set it up, step by step, in Part Two - Setup Threat Detection with Elastic

It is compatible with a subset of applications under the Google Reports API v1. As of today it supports:

Google Workspace Service Description
SAML help View users’ successful and failed sign-ins to SAML applications.
User Accounts help Audit actions carried out by users on their own accounts including password changes, account recovery details and 2-Step Verification enrollment.
Login help Track user sign-in activity to your domain.
Rules help View a record of actions to review your user’s attempts to share sensitive data.
Admin help View administrator activity performed within the Google Admin console.
Drive help Record user activity within Google Drive including content creation in such as Google Docs, as well as content created elsewhere that your users upload to Drive such as PDFs and Microsoft Word files.
Groups help Track changes to groups, group memberships and group messages.
Group Enterprise help The Group Enterprise activity report returns information about various types of Enterprise Groups Audit activity events.
Device help The Mobile activity report returns information about various types of Device Audit activity events.
Token help The Token activity report returns information about various types of OAuth Token Audit activity events.
Access Transparency help The Access Transparency activity report returns information about various types of Access Transparency activity events.
Context Aware Access help The Context Aware Access activity report returns information about various types of Context-Aware Access Audit activity events.
GCP The GCP activity report returns information about various types of Google Cloud Platform activity events.
Chrome The Chrome activity reports return information about Chrome browser and Chrome OS events.
Data Studio Track and audit user interactions and changes made to Looker Studio assets.
Calendar The Calendar activity report returns information about how your account's users manage and modify their Google Calendar events.
Chat The Chat activity report returns information about how your account's users use and manage Spaces.
Vault The Vault activity report returns information about various types of Vault Audit activity events.
Meet The Meet activity report returns information about various aspects of call events.
Keep The Keep activity report returns information about how your account's users manage and modify their notes.
Gmail Reports The Gmail activity report returns information about message delivery, SMTP connections, spam classification and policy rule matches.
Gemini The Gemini in Workspace Apps activity report returns information about generative AI feature usage across Workspace applications.

In order to ingest data from the Google Reports API you must:

  • Have an administrator account. As a security best practice, instead of using a Super Admin account, you can create a custom role with the following permissions. This applies the principle of least privilege.

    Admin console privileges

    • OUs: Read
    • Users: Read
    • Chrome Management > Managed browsers: Read
    • View Reports
    • Alert Center: Full access

    Admin API privileges

    • Reports
    • Groups: Read
    • OU: Read
    • Users: Read

    You also need to enable the following APIs in your Google Cloud project:

    • Admin SDK API
    • Google Workspace Alert Center API

  • Set up a ServiceAccount using the administrator account.

  • Set up access to the Admin SDK API for the ServiceAccount.

  • Enable Domain-Wide Delegation for your ServiceAccount.

This integration will use the following oauth2 scope:

  • https://www.googleapis.com/auth/admin.reports.audit.readonly

Once you have downloaded your service account credentials as a JSON file, you are ready to set up your integration.

Click the Advanced option of Google Workspace Audit Reports. The default value of "API Host" is https://www.googleapis.com. The API Host will be used for collecting access_transparency, admin, calendar, chat, chrome, context_aware_access, data_studio, device, drive, gcp, gemini, gmail_reports, groups, group_enterprise, keep, login, meet, rules, saml, token, user accounts and vault logs.

Note

The Delegated Account value in the configuration, is expected to be the email of the administrator account, and not the email of the ServiceAccount.

The access_transparency, admin, context_aware_access, device, drive, gcp, groups, group_enterprise, login, rules, saml, token and user_accounts data streams request activity from the Reports API in time windows. Three settings control those windows:

  • Initial Interval (package level, default 24h): how far back the first collection reaches when a data stream starts with no saved position.
  • Lag Time (per data stream, default 2h): how far behind the current time the end of every window stays. Google publishes activity with a delay that varies by report; see Data retention and lag times. Events newer than now - Lag Time are not requested yet, and are collected on a later interval once they have settled.
  • Chunk Duration (per data stream, under Advanced options, disabled by default): the maximum span of activity requested in one interval. When set, each interval requests a window of at most this duration starting from the last completed position, and the position only moves forward after the whole window has been collected. If collection is interrupted, for example by an agent restart or a policy update, only that one chunk is requested again.

Without Chunk Duration, an interval requests everything from the last completed position up to now - Lag Time in a single window. For a data stream with a large backlog or a high event rate, such as token or drive on a busy domain, that window can take longer to page through than the time between interruptions. Each interruption then restarts the same window from the beginning, no progress is saved, and the data stream appears to stall while it re-sends events it has already sent.

Recommended Chunk Duration values:

Data stream volume Suggested value
High (for example token, drive, login on large domains) 1h
Moderate 6h
Low (for example rules, saml, access_transparency) 24h

A chunk should be small enough to be fully collected between the interruptions you expect, and must not exceed 720h (30 days). Once the data stream has caught up, the window end is limited by now - Lag Time, so Chunk Duration has no effect on steady-state collection. Leaving the setting empty, or setting it to 0, disables chunking. Existing saved positions are reused unchanged when the setting is turned on or off.

Note

The integration provides two Gmail data streams. This section is for gmail, which queries logs exported to Google BigQuery. If you prefer the Google Reports API, enable gmail_reports instead — it shares the service account and admin.reports.audit.readonly scope used by the other Reports API streams and skips the BigQuery configuration steps below.

The integration collects and parses Gmail audit logs data available for reporting in Google Workspace. You must first export Google Workspace logs to Google BigQuery. This involves exporting all activity log events and usage reports to Google BigQuery. Only certain Google Workspace editions support this feature. For more details see About reporting logs and BigQuery. The integration uses the BigQuery API to query logs from BigQuery.

In order to ingest data from the Google BigQuery API, you must:

  1. Enable BigQuery API if not already
  • In the Google Cloud console, navigate to APIs & Services > Library.
  • Search for BigQuery API and select it.
  • Click Enable.
  1. Create a service account:
  • In the Google Cloud console, navigate to APIs & Services > Credentials.
  • Click Create Credentials > Service account.
  • In the setup:
    • Enter a name for the service account.
    • Click Create and Continue.
    • (Optional) Grant project access.
    • Click Continue.
    • (Optional) Grant user access.
    • Click Done.
  1. Generate a JSON Key:
  • From the Credentials page, click on the name of your new service account.
  • Go to the Keys tab.
  • Click Add Key > Create new key.
  • Choose JSON format and click Create.
  • Save the downloaded JSON key securely.
  1. Grant IAM Role to service account:
  • Go to IAM & Admin > IAM in the Cloud Console.
  • Click Grant access.
  • Paste the service account email in the New principals field.
  • Click Select a role, search for and select BigQuery Job User.
  • Click Save.
  1. Set up a BigQuery project for reporting logs
  • Go to IAM & Admin page for your project.
  • Add a project editor for your project.
    • Click Grant access.
    • Enter gapps-reports@system.gserviceaccount.com in the New principals field.
    • In Select a role, select Project, then Editor.
    • Click Save.
  • Add a Google Workspace administrator account as a project editor by following the same steps above.
  • For more details see Set up a BigQuery project for reporting logs
  1. Set up a BigQuery Export configuration:
  • Sign in to your Google Admin console with a super administrator account.
  • Navigate to Reporting > Data Integrations (Requires having the Reports administrator privilege).
    Education administrators go to Menu Reporting > BigQuery export, which opens the Data integrations page.
  • Point to the BigQuery Export card and click Edit.
  • To activate BigQuery logs, check the Enable Google Workspace data export to Google BigQuery box.
  • (Optional) To export sensitive parameters of DLP rules, check the Allow export of sensitive content from DLP rule logs box.
  • Under BigQuery project ID, select the project where you want to store the logs.
    Choose a project for which gapps-reports@system.gserviceaccount.com has an editor role.
  • Under New dataset within project, enter the name of the dataset to use for storing the logs in the project.
    A new dataset will be created with this name in your BigQuery project.
  • (Optional) Check the Restrict the dataset to a specific geographic location box > select the location from the menu.
  • Click Save.
  • For more details see Set up a BigQuery Export configuration.
  1. Grant Dataset Permissions:
  • Go to Google Cloud console and search for BigQuery.
  • Click your Google Cloud project on the left pane.
  • Locate the dataset, click the three-dot menu > Share > Manage Permissions.
  • Click Add principal.
  • Paste the service account email in New principals.
  • Select BigQuery Data Viewer as the role.
  • Click Save.

This integration will make use of the following oauth2 scope:

  • https://www.googleapis.com/auth/bigquery

Once you have downloaded your service account credentials as a JSON file, you are ready to set up your integration for collecting Gmail logs.

Note

For Gmail data stream, the default value of "BigQuery API Host" is https://bigquery.googleapis.com. The BigQuery API Host will be used for collecting gmail logs only.

The Google Workspace Integration collects and parses data received from the Google Workspace Alert Center API using HTTP JSON Input.

  • Alert Data Stream has been tested against Google Workspace Alert Center API (v1).

  • Following Alert types have been supported in the current integration version:

    1. Customer takeout initiated
    2. Malware reclassification
    3. Misconfigured whitelist
    4. Phishing reclassification
    5. Suspicious message reported
    6. User reported phishing
    7. User reported spam spike
    8. Leaked password
    9. Suspicious login
    10. Suspicious login (less secure app)
    11. Suspicious programmatic login
    12. User suspended
    13. User suspended (spam)
    14. User suspended (spam through relay)
    15. User suspended (suspicious activity)
    16. Google Operations
    17. Configuration problem
    18. Government attack warning
    19. Device compromised
    20. Suspicious activity
    21. AppMaker Default Cloud SQL setup
    22. Activity Rule
    23. Data Loss Prevention
    24. Apps outage
    25. Primary admin changed
    26. SSO profile added
    27. SSO profile updated
    28. SSO profile deleted
    29. Super admin password reset
    30. Account suspension warning
    31. Calendar settings changed
    32. Chrome devices auto-update expiration warning
    33. Customer takeout initiated
    34. Drive settings changed
    35. Email settings changed
    36. Gmail potential employee spoofing
    37. Mobile settings changed
    38. New user added
    39. Reporting Rule
    40. Suspended user made active
    41. User deleted
    42. User granted Admin privilege
    43. User suspended (spam)
    44. User's Admin privileges revoked
    45. Users password changed
    46. Google Voice configuration problem detected

In order to ingest data from the Google Alert Center API, you must:

This integration will make use of the following oauth2 scope:

  • https://www.googleapis.com/auth/apps.alerts

Once Service Account credentials are downloaded as a JSON file, then the integration can be setup to collect data.

Note

The Delegated Account value in the configuration, is expected to be the email of the administrator account, and not the email of the ServiceAccount.

Note

The default value of the "Page Size" is set to 1000. This option is available under 'Alert' Advance options. Set the parameter "Page Size" according to the requirement. For Alert Data Stream, The default value of "Alert Center API Host" is https://alertcenter.googleapis.com. The Alert Center API Host will be used for collecting alert logs only.

Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to Agentless integrations and the Agentless integrations FAQ.

Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

This is a list of Google Workspace Reports fields that are mapped to ECS that are common to all data sets.

Google Workspace Reports ECS Fields
items[].id.time @timestamp
items[].id.uniqueQualifier event.id
items[].id.applicationName event.provider
items[].events[].name event.action
items[].customerId organization.id
items[].ipAddress source.ip, related.ip, source.as.*, source.geo.*
items[].actor.email source.user.email, source.user.name, source.user.domain
items[].actor.profileId source.user.id

This is the saml dataset.

Example 
{
    "@timestamp": "2021-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "d20c4911-f81c-47b1-9b0f-18d5f2b777d8",
        "id": "60e23a94-d52f-4e91-a2a4-9c69823881ab",
        "name": "elastic-agent-98195",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "data_stream": {
        "dataset": "google_workspace.saml",
        "namespace": "44301",
        "type": "logs"
    },
    "ecs": {
        "version": "9.5.0"
    },
    "elastic_agent": {
        "id": "60e23a94-d52f-4e91-a2a4-9c69823881ab",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "action": "login_failure",
        "agent_id_status": "verified",
        "category": [
            "authentication",
            "session"
        ],
        "created": "2026-08-21T07:47:25.121Z",
        "dataset": "google_workspace.saml",
        "id": "1",
        "ingested": "2026-08-21T07:47:28Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@example.com\",\"profileId\":1},\"events\":{\"name\":\"login_failure\",\"parameters\":[{\"name\":\"application_name\",\"value\":\"app\"},{\"name\":\"failure_type\",\"value\":\"failure_app_not_configured_for_user\"},{\"name\":\"initiated_by\",\"value\":\"idp\"},{\"name\":\"orgunit_path\",\"value\":\"ounit\"},{\"name\":\"saml_second_level_status_code\",\"value\":\"SUCCESS_URI\"},{\"name\":\"saml_status_code\",\"value\":\"SUCCESS_URI\"}],\"type\":\"login\"},\"id\":{\"applicationName\":\"saml\",\"customerId\":\"1\",\"time\":\"2021-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "outcome": "failure",
        "provider": "saml",
        "type": [
            "start"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "event": {
            "type": "login"
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        },
        "saml": {
            "application_name": "app",
            "failure_type": "failure_app_not_configured_for_user",
            "initiated_by": "idp",
            "orgunit_path": "ounit",
            "second_level_status_code": "SUCCESS_URI",
            "status_code": "SUCCESS_URI"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "example.com",
            "email": "foo@example.com",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-saml"
    ],
    "user": {
        "domain": "example.com",
        "email": "foo@example.com",
        "id": "1",
        "name": "foo"
    }
}
Exported fields
Field Description Type
@timestamp Event timestamp. date
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
event.dataset Event dataset constant_keyword
event.module Event module constant_keyword
google_workspace.actor.key Only present when actor.type is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts. keyword
google_workspace.actor.type The type of actor. Values can be: *USER*: Another user in the same domain. *EXTERNAL_USER*: A user outside the domain. *KEY*: A non-human actor. keyword
google_workspace.event.type The type of Google Workspace event, mapped from items[].events[].type in the original payload. Each fileset can have a different set of values for it, more details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.kind The type of API resource, mapped from kind in the original payload. More details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.organization.domain The domain that is affected by the report's event. keyword
google_workspace.saml.application_name Saml SP application name. keyword
google_workspace.saml.failure_type Login failure type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/saml. keyword
google_workspace.saml.initiated_by Requester of SAML authentication. keyword
google_workspace.saml.orgunit_path User orgunit. keyword
google_workspace.saml.second_level_status_code SAML second level status code. keyword
google_workspace.saml.status_code SAML status code. keyword
input.type Type of Filebeat input. keyword
log.offset Log offset. long

This is the user_accounts dataset.

Example 
{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "da3c07cc-49bb-4d18-b5d6-26c5e8c1f765",
        "id": "dbd2f6bf-ce71-4c2a-a32b-fedd4853864d",
        "name": "elastic-agent-74885",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "data_stream": {
        "dataset": "google_workspace.user_accounts",
        "namespace": "36939",
        "type": "logs"
    },
    "ecs": {
        "version": "9.5.0"
    },
    "elastic_agent": {
        "id": "dbd2f6bf-ce71-4c2a-a32b-fedd4853864d",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "action": "2sv_disable",
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "created": "2026-08-21T08:54:45.536Z",
        "dataset": "google_workspace.user_accounts",
        "id": "1",
        "ingested": "2026-08-21T08:54:48Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@example.com\",\"profileId\":1},\"events\":{\"name\":\"2sv_disable\",\"type\":\"2sv_change\"},\"id\":{\"applicationName\":\"user_accounts\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "user_accounts",
        "type": [
            "change",
            "user"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "event": {
            "type": "2sv_change"
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "example.com",
            "email": "foo@example.com",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-user_accounts"
    ],
    "user": {
        "domain": "example.com",
        "email": "foo@example.com",
        "id": "1",
        "name": "foo"
    }
}
Exported fields
Field Description Type
@timestamp Event timestamp. date
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
event.dataset Event dataset constant_keyword
event.module Event module constant_keyword
google_workspace.actor.key Only present when actor.type is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts. keyword
google_workspace.actor.type The type of actor. Values can be: *USER*: Another user in the same domain. *EXTERNAL_USER*: A user outside the domain. *KEY*: A non-human actor. keyword
google_workspace.event.type The type of Google Workspace event, mapped from items[].events[].type in the original payload. Each fileset can have a different set of values for it, more details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.kind The type of API resource, mapped from kind in the original payload. More details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.organization.domain The domain that is affected by the report's event. keyword
google_workspace.user_accounts.email_forwarding_destination_address Out of domain email the actor has forwarded to. keyword
input.type Type of Filebeat input. keyword
log.offset Log offset. long

This is the login dataset.

Example 
{
    "@timestamp": "2022-05-04T15:04:05.000Z",
    "agent": {
        "ephemeral_id": "5c8ef506-9c6f-42a4-a355-a439129305b0",
        "id": "57a41a13-a06f-4050-9451-8b40bc4df38b",
        "name": "elastic-agent-96730",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "data_stream": {
        "dataset": "google_workspace.login",
        "namespace": "70737",
        "type": "logs"
    },
    "ecs": {
        "version": "9.5.0"
    },
    "elastic_agent": {
        "id": "57a41a13-a06f-4050-9451-8b40bc4df38b",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "action": "account_disabled_password_leak",
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "created": "2026-08-21T07:43:05.339Z",
        "dataset": "google_workspace.login",
        "id": "1",
        "ingested": "2026-08-21T07:43:08Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@example.com\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "login",
        "type": [
            "user",
            "info"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "event": {
            "type": "account_warning"
        },
        "kind": "admin#reports#activity",
        "login": {
            "affected_email_address": "foo@elastic.co"
        },
        "organization": {
            "domain": "elastic.com"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo",
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "example.com",
            "email": "foo@example.com",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-login"
    ],
    "user": {
        "domain": "example.com",
        "email": "foo@example.com",
        "id": "1",
        "name": "foo",
        "target": {
            "domain": "elastic.co",
            "name": "foo"
        }
    }
}
Exported fields
Field Description Type
@timestamp Event timestamp. date
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
event.dataset Event dataset constant_keyword
event.module Event module constant_keyword
google_workspace.actor.key Only present when actor.type is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts. keyword
google_workspace.actor.type The type of actor. Values can be: *USER*: Another user in the same domain. *EXTERNAL_USER*: A user outside the domain. *KEY*: A non-human actor. keyword
google_workspace.event.type The type of Google Workspace event, mapped from items[].events[].type in the original payload. Each fileset can have a different set of values for it, more details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.kind The type of API resource, mapped from kind in the original payload. More details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.login.affected_email_address keyword
google_workspace.login.challenge_method Login challenge method. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. keyword
google_workspace.login.challenge_status Login challenge status. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. keyword
google_workspace.login.failure_type Login failure type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. keyword
google_workspace.login.is_second_factor boolean
google_workspace.login.is_suspicious boolean
google_workspace.login.network_info.ip_asn keyword
google_workspace.login.network_info.region_code keyword
google_workspace.login.network_info.subdivision_code keyword
google_workspace.login.resource_ids keyword
google_workspace.login.sensitive_action_name keyword
google_workspace.login.timestamp UNIX timestmap of login in microseconds. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. long
google_workspace.login.type Login credentials type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. keyword
google_workspace.organization.domain The domain that is affected by the report's event. keyword
input.type Type of Filebeat input. keyword
log.offset Log offset. long

This is the rules dataset.

Example 
{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "bb9721a6-67e0-472b-9636-35551f3b7622",
        "id": "ec1ac391-ab36-4b53-9d0a-11c2210dd56f",
        "name": "elastic-agent-87718",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "data_stream": {
        "dataset": "google_workspace.rules",
        "namespace": "69910",
        "type": "logs"
    },
    "ecs": {
        "version": "9.5.0"
    },
    "elastic_agent": {
        "id": "ec1ac391-ab36-4b53-9d0a-11c2210dd56f",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "action": "rule_match",
        "agent_id_status": "verified",
        "category": [
            "intrusion_detection"
        ],
        "created": "2026-08-21T07:45:05.553Z",
        "dataset": "google_workspace.rules",
        "id": "1",
        "ingested": "2026-08-21T07:45:08Z",
        "kind": "alert",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@example.com\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "rules",
        "type": [
            "info"
        ]
    },
    "google_workspace": {
        "actor": {
            "email": "foo@example.com",
            "profile": {
                "id": "1"
            },
            "type": "USER"
        },
        "event": {
            "name": "rule_match",
            "type": "rule_match_type"
        },
        "id": {
            "application_name": "rules",
            "customer": {
                "id": "1"
            },
            "time": "2020-10-02T15:00:00.000Z",
            "unique_qualifier": "1"
        },
        "ip_address": "67.43.156.13",
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        },
        "rules": {
            "actor_ip_address": "127.0.0.0",
            "has_alert": true,
            "id": [
                "12"
            ],
            "name": [
                "managers"
            ],
            "resource": {
                "recipients_omitted_count": 1234
            }
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "hosts": [
            "example.com",
            "elastic.com"
        ],
        "ip": [
            "67.43.156.13",
            "127.0.0.0"
        ],
        "user": [
            "foo"
        ]
    },
    "rule": {
        "id": [
            "12"
        ],
        "name": [
            "managers"
        ]
    },
    "source": {
        "as": {
            "number": 35908
        },
        "geo": {
            "continent_name": "Asia",
            "country_iso_code": "BT",
            "country_name": "Bhutan",
            "location": {
                "lat": 27.5,
                "lon": 90.5
            }
        },
        "ip": "67.43.156.13",
        "user": {
            "domain": "example.com",
            "email": "foo@example.com",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-rules"
    ],
    "user": {
        "domain": "example.com",
        "email": "foo@example.com",
        "id": "1",
        "name": "foo"
    }
}
Exported fields
Field Description Type
@timestamp Event timestamp. date
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
event.dataset Event dataset constant_keyword
event.module Event module constant_keyword
google_workspace.actor.email The primary email address of the actor. May be absent if there is no email address associated with the actor. keyword
google_workspace.actor.key Only present when actor.type is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts. keyword
google_workspace.actor.profile.id The unique Google Workspace profile ID of the actor. This value might be absent if the actor is not a Google Workspace user, or may be the number 105250506097979753968 which acts as a placeholder ID. keyword
google_workspace.actor.type The type of actor. Values can be: *USER*: Another user in the same domain. *EXTERNAL_USER*: A user outside the domain. *KEY*: A non-human actor. keyword
google_workspace.etag ETag of the entry. keyword
google_workspace.event.name Name of the event. This is the specific name of the activity reported by the API. And each eventName is related to a specific Google Workspace service or feature which the API organizes into types of events. For eventName request parameters in general: If no eventName is given, the report returns all possible instances of an eventName. When you request an eventName, the API's response returns all activities which contain that eventName. It is possible that the returned activities will have other eventName properties in addition to the one requested. For more information about eventName properties, see the list of event names for various applications above in applicationName. keyword
google_workspace.event.type The type of Google Workspace event, mapped from items[].events[].type in the original payload. Each fileset can have a different set of values for it, more details can be found here. keyword
google_workspace.id.application_name Application name to which the event belongs. For possible values see the list of applications above in applicationName. keyword
google_workspace.id.customer.id The unique identifier for a Google Workspace account. keyword
google_workspace.id.time Time of occurrence of the activity. This is in UNIX epoch time in seconds. date
google_workspace.id.unique_qualifier Unique qualifier if multiple events have the same time. keyword
google_workspace.ip_address IP address of the user doing the action. This is the Internet Protocol (IP) address of the user when logging into Google Workspace, which may or may not reflect the user's physical location. For example, the IP address can be the user's proxy server's address or a virtual private network (VPN) address. The API supports IPv4 and IPv6. ip
google_workspace.kind The type of API resource, mapped from kind in the original payload, more details can be found here. keyword
google_workspace.organization.domain The domain that is affected by the report's event. keyword
google_workspace.rules.actions List of actions taken. For a list of possible values refer to actions in the event details table. keyword
google_workspace.rules.actor_ip_address IP of the entity who was responsible for the original event which triggered the rule. ip
google_workspace.rules.application Name of the application to which the flagged item belongs. For a list of possible values refer to application in the event details table. keyword
google_workspace.rules.conference_id The unique identifier of a Google Meet conference. keyword
google_workspace.rules.data_source Source of the data. For a list of possible values refer to data_source in the event details table. keyword
google_workspace.rules.device.id ID of the device on which the action was triggered. keyword
google_workspace.rules.device.type Type of device referred to by device ID. For a list of possible values refer to device_type in the event details table. keyword
google_workspace.rules.drive_shared_drive_id Shared drive Id to which the drive item belongs, if applicable. keyword
google_workspace.rules.evaluation_context Evaluation metadata, such as contextual messages used in a rule evaluation. flattened
google_workspace.rules.has_alert Whether or not the triggered rule has alert enabled. boolean
google_workspace.rules.has_content_match Whether the resource has content which matches the criteria in the rule. For a list of possible values refer to has_content_match in the event details table. boolean
google_workspace.rules.id Unique identifier for a rule. Rules are created by admins in Google Workspace. keyword
google_workspace.rules.matched.detectors A list of detectors that matched against the resource. flattened
google_workspace.rules.matched.templates List of content detector templates that matched. keyword
google_workspace.rules.matched.threshold Threshold that matched in the rule. keyword
google_workspace.rules.matched.trigger Trigger of the rule evaluation: email sent or received, document shared. For a list of possible values refer to matched_trigger in the event details table. keyword
google_workspace.rules.mobile_device_type Type of device on which rule was applied. keyword
google_workspace.rules.mobile_ios_vendor_id iOS Vendor Id of device on which rule was applied, if applicable. keyword
google_workspace.rules.name Name of the rule. keyword
google_workspace.rules.resource.id Identifier of the resource which matched the rule. keyword
google_workspace.rules.resource.name Resource name that uniquely identifies a rule. keyword
google_workspace.rules.resource.owner_email Email address of the owner of the resource. keyword
google_workspace.rules.resource.recipients A list of users that a Drive document or an email message was shared with when the rule was triggered. keyword
google_workspace.rules.resource.recipients_omitted_count The number of resource recipients omitted due to exceeding the size limit. long
google_workspace.rules.resource.title Title of the resource which matched the rule: email subject, or document title. keyword
google_workspace.rules.resource.type Type of the rule. For a list of possible values refer to resource_type in the event details table. keyword
google_workspace.rules.resource_name Name of the resource which matched the rule. keyword
google_workspace.rules.scan_type Scan mode for the rule evaluation. For a list of possible values refer to scan_type in the event details table. keyword
google_workspace.rules.severity Severity of violating a rule. For a list of possible values refer to to severity in the event details table. keyword
google_workspace.rules.space.id ID of the space where the rule was triggered. keyword
google_workspace.rules.space.type Type of space referred to by the space ID. For a list of possible values refer to space_type in the event details table. keyword
google_workspace.rules.suppressed_actions A list of actions that were not taken due to other actions with higher priority. flattened
google_workspace.rules.triggered_actions A list of actions that were taken as a consequence of the rule being triggered. flattened
google_workspace.rules.type Type of the rule. For a list of possible values refer to rule_type in the event details table. keyword
google_workspace.rules.update_time_usec Update time (microseconds since epoch) indicating the version of rule which is used. date
input.type Type of Filebeat input. keyword
log.offset Log offset. long

This is the admin dataset.

Example 
{
    "@timestamp": "2022-04-04T15:04:05.000Z",
    "agent": {
        "ephemeral_id": "d95a21dc-3e48-4e9e-82bd-7af72345c58a",
        "id": "09ccb13c-8d7f-49ea-855f-adaf46746349",
        "name": "elastic-agent-66586",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "data_stream": {
        "dataset": "google_workspace.admin",
        "namespace": "47092",
        "type": "logs"
    },
    "ecs": {
        "version": "9.5.0"
    },
    "elastic_agent": {
        "id": "09ccb13c-8d7f-49ea-855f-adaf46746349",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "action": "CHANGE_APPLICATION_SETTING",
        "agent_id_status": "verified",
        "category": [
            "iam",
            "configuration"
        ],
        "created": "2026-08-21T07:27:25.543Z",
        "dataset": "google_workspace.admin",
        "id": "1",
        "ingested": "2026-08-21T07:27:28Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@example.com\",\"profileId\":1},\"events\":{\"name\":\"CHANGE_APPLICATION_SETTING\",\"parameters\":[{\"name\":\"APPLICATION_EDITION\",\"value\":\"basic\"},{\"name\":\"APPLICATION_NAME\",\"value\":\"drive\"},{\"name\":\"GROUP_EMAIL\",\"value\":\"group@example.com\"},{\"name\":\"NEW_VALUE\",\"value\":\"new\"},{\"name\":\"OLD_VALUE\",\"value\":\"old\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"org\"},{\"name\":\"SETTING_NAME\",\"value\":\"setting\"}],\"type\":\"APPLICATION_SETTINGS\"},\"id\":{\"applicationName\":\"admin\",\"customerId\":\"1\",\"time\":\"2022-04-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "admin",
        "type": [
            "change"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "admin": {
            "application": {
                "edition": "basic",
                "name": "drive"
            },
            "group": {
                "email": "group@example.com"
            },
            "new_value": "new",
            "old_value": "old",
            "org_unit": {
                "name": "org"
            },
            "setting": {
                "name": "setting"
            }
        },
        "event": {
            "type": "APPLICATION_SETTINGS"
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        }
    },
    "group": {
        "domain": "example.com",
        "name": "group"
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "example.com",
            "email": "foo@example.com",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-admin"
    ],
    "user": {
        "domain": "example.com",
        "email": "foo@example.com",
        "id": "1",
        "name": "foo",
        "target": {
            "group": {
                "domain": "example.com",
                "name": "group"
            }
        }
    }
}
Exported fields
Field Description Type
@timestamp Event timestamp. date
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
event.dataset Event dataset constant_keyword
event.module Event module constant_keyword
google_workspace.actor.key Only present when actor.type is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts. keyword
google_workspace.actor.type The type of actor. Values can be: *USER*: Another user in the same domain. *EXTERNAL_USER*: A user outside the domain. *KEY*: A non-human actor. keyword
google_workspace.admin.alert.id keyword
google_workspace.admin.alert.name The alert name. keyword
google_workspace.admin.alert.related_id keyword
google_workspace.admin.api.client.name The API client name. keyword
google_workspace.admin.api.scopes The API scopes. keyword
google_workspace.admin.application.asp_id The application specific password ID. keyword
google_workspace.admin.application.edition The Google Workspace edition. keyword
google_workspace.admin.application.enabled The enabled application. keyword
google_workspace.admin.application.id The application ID. keyword
google_workspace.admin.application.licences_order_number Order number used to redeem licenses. keyword
google_workspace.admin.application.licences_purchased Number of licences purchased. long
google_workspace.admin.application.name The application's name. keyword
google_workspace.admin.application.package_id The mobile application package ID. keyword
google_workspace.admin.bulk_upload.failed Number of failed records in bulk upload operation. long
google_workspace.admin.bulk_upload.total Number of total records in bulk upload operation. long
google_workspace.admin.chart.filters keyword
google_workspace.admin.chart.name keyword
google_workspace.admin.chrome_licenses.allowed Licences enabled. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-org-settings keyword
google_workspace.admin.chrome_licenses.enabled Licences enabled. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-org-settings keyword
google_workspace.admin.chrome_os.session_type Chrome OS session type. keyword
google_workspace.admin.device.command_details Command details. keyword
google_workspace.admin.device.id keyword
google_workspace.admin.device.serial_number Device serial number. keyword
google_workspace.admin.device.type Device type. keyword
google_workspace.admin.distribution.entity.name The distribution entity value, which can be a group name or an org-unit name. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-mobile-settings keyword
google_workspace.admin.distribution.entity.type The distribution entity type, which can be a group or an org-unit. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-mobile-settings keyword
google_workspace.admin.domain.alias The domain alias. keyword
google_workspace.admin.domain.name The primary domain name. keyword
google_workspace.admin.domain.secondary_name The secondary domain name. keyword
google_workspace.admin.email.log_search_filter.end_date The log search filter's ending date. date
google_workspace.admin.email.log_search_filter.message_id The log search filter's email message ID. keyword
google_workspace.admin.email.log_search_filter.recipient.ip The log search filter's email recipient's IP address. ip
google_workspace.admin.email.log_search_filter.recipient.value The log search filter's email recipient. keyword
google_workspace.admin.email.log_search_filter.sender.ip The log search filter's email sender's IP address. ip
google_workspace.admin.email.log_search_filter.sender.value The log search filter's email sender. keyword
google_workspace.admin.email.log_search_filter.start_date The log search filter's start date. date
google_workspace.admin.email.quarantine_name The name of the quarantine. keyword
google_workspace.admin.email_dump.include_deleted Indicates if deleted emails are included in the export. boolean
google_workspace.admin.email_dump.package_content The contents of the mailbox package. keyword
google_workspace.admin.email_dump.query The search query used for the dump. keyword
google_workspace.admin.email_monitor.dest_email The destination address of the email monitor. keyword
google_workspace.admin.email_monitor.level.chat The chat email monitor level. keyword
google_workspace.admin.email_monitor.level.draft The draft email monitor level. keyword
google_workspace.admin.email_monitor.level.incoming The incoming email monitor level. keyword
google_workspace.admin.email_monitor.level.outgoing The outgoing email monitor level. keyword
google_workspace.admin.field The name of the field. keyword
google_workspace.admin.gateway.name Gateway name. Present on some chat settings. keyword
google_workspace.admin.group.allowed_list Names of allow-listed groups. keyword
google_workspace.admin.group.email The group's primary email address. keyword
google_workspace.admin.group.priorities Group priorities. keyword
google_workspace.admin.info_type This will be used to state what kind of information was changed. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings keyword
google_workspace.admin.investigation.action keyword
google_workspace.admin.investigation.data_source keyword
google_workspace.admin.investigation.entity_ids keyword
google_workspace.admin.investigation.object_identifier keyword
google_workspace.admin.investigation.query keyword
google_workspace.admin.investigation.url_display_text keyword
google_workspace.admin.managed_configuration The name of the managed configuration. keyword
google_workspace.admin.mdm.token The MDM vendor enrollment token. keyword
google_workspace.admin.mdm.vendor The MDM vendor's name. keyword
google_workspace.admin.mobile.action.id The mobile device action's ID. keyword
google_workspace.admin.mobile.action.type The mobile device action's type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-mobile-settings keyword
google_workspace.admin.mobile.certificate.name The mobile certificate common name. keyword
google_workspace.admin.mobile.company_owned_devices The number of devices a company owns. long
google_workspace.admin.new_value The new value for the setting. keyword
google_workspace.admin.non_featured_services_selection Non-featured services selection. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings#FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED keyword
google_workspace.admin.oauth2.application.id OAuth2 application ID. keyword
google_workspace.admin.oauth2.application.name OAuth2 application name. keyword
google_workspace.admin.oauth2.application.type OAuth2 application type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings keyword
google_workspace.admin.oauth2.service.name OAuth2 service name. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings keyword
google_workspace.admin.old_value The old value for the setting. keyword
google_workspace.admin.org_unit.full The org unit full path including the root org unit name. keyword
google_workspace.admin.org_unit.name The organizational unit name. keyword
google_workspace.admin.print_server.name The name of the print server. keyword
google_workspace.admin.printer.name The name of the printer. keyword
google_workspace.admin.privilege.name Privilege name. keyword
google_workspace.admin.product.name The product name. keyword
google_workspace.admin.product.sku The product SKU. keyword
google_workspace.admin.request.id The request ID. keyword
google_workspace.admin.resource.id The name of the resource identifier. keyword
google_workspace.admin.role.id Unique identifier for this role privilege. keyword
google_workspace.admin.role.name The role name. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings keyword
google_workspace.admin.rule.name The rule name. keyword
google_workspace.admin.service.name The service name. keyword
google_workspace.admin.setting.description The setting name. keyword
google_workspace.admin.setting.metadata.description keyword
google_workspace.admin.setting.metadata.rule.key keyword
google_workspace.admin.setting.metadata.rule.type keyword
google_workspace.admin.setting.metadata.user_defined.name The name of the user-defined setting. keyword
google_workspace.admin.setting.name The setting name. keyword
google_workspace.admin.url.name The website name. keyword
google_workspace.admin.user.birthdate The user's birth date. date
google_workspace.admin.user.email The user's primary email address. keyword
google_workspace.admin.user.nickname The user's nickname. keyword
google_workspace.admin.verification_method Related verification method. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings and https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings keyword
google_workspace.event.type The type of Google Workspace event, mapped from items[].events[].type in the original payload. Each fileset can have a different set of values for it, more details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.kind The type of API resource, mapped from kind in the original payload. More details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.organization.domain The domain that is affected by the report's event. keyword
input.type Type of Filebeat input. keyword
log.offset Log offset. long

This is the drive dataset.

Example 
{
    "@timestamp": "2022-05-04T15:04:05.000Z",
    "agent": {
        "ephemeral_id": "fd06ff7f-60f1-4c18-8eeb-42c0f2e9b8a2",
        "id": "f0fc5f19-560d-4c55-881a-7e75ff565a25",
        "name": "elastic-agent-93835",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "data_stream": {
        "dataset": "google_workspace.drive",
        "namespace": "86558",
        "type": "logs"
    },
    "ecs": {
        "version": "9.5.0"
    },
    "elastic_agent": {
        "id": "f0fc5f19-560d-4c55-881a-7e75ff565a25",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "action": "add_to_folder",
        "agent_id_status": "verified",
        "category": [
            "file"
        ],
        "created": "2026-08-21T07:35:44.905Z",
        "dataset": "google_workspace.drive",
        "id": "1",
        "ingested": "2026-08-21T07:35:47Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@example.com\",\"profileId\":1},\"events\":{\"name\":\"add_to_folder\",\"parameters\":[{\"boolValue\":false,\"name\":\"billable\"},{\"name\":\"destination_folder_id\",\"value\":\"1234\"},{\"name\":\"destination_folder_title\",\"value\":\"folder title\"},{\"name\":\"doc_id\",\"value\":\"1234\"},{\"name\":\"doc_title\",\"value\":\"document title\"},{\"name\":\"doc_type\",\"value\":\"document\"},{\"name\":\"originating_app_id\",\"value\":\"1234\"},{\"name\":\"owner\",\"value\":\"owner@example.com\"},{\"boolValue\":false,\"name\":\"owner_is_shared_drive\"},{\"boolValue\":true,\"name\":\"primary_event\"},{\"name\":\"visibility\",\"value\":\"people_with_link\"}],\"type\":\"access\"},\"id\":{\"applicationName\":\"drive\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "drive",
        "type": [
            "change"
        ]
    },
    "file": {
        "name": "document title",
        "owner": "owner",
        "type": "file"
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "drive": {
            "billable": false,
            "destination_folder_id": "1234",
            "destination_folder_title": "folder title",
            "file": {
                "id": "1234",
                "owner": {
                    "email": "owner@example.com",
                    "is_shared_drive": false
                },
                "type": "document"
            },
            "originating_app_id": "1234",
            "primary_event": true,
            "visibility": "people_with_link"
        },
        "event": {
            "type": "access"
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "owner",
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "example.com",
            "email": "foo@example.com",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-drive"
    ],
    "user": {
        "domain": "example.com",
        "email": "foo@example.com",
        "id": "1",
        "name": "foo"
    }
}
Exported fields
Field Description Type
@timestamp Event timestamp. date
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
event.dataset Event dataset constant_keyword
event.module Event module constant_keyword
google_workspace.actor.application_name Name of the application used to perform the action. keyword
google_workspace.actor.key Only present when actor.type is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts. keyword
google_workspace.actor.type The type of actor. Values can be: *USER*: Another user in the same domain. *EXTERNAL_USER*: A user outside the domain. *KEY*: A non-human actor. keyword
google_workspace.drive.accessed_url The URLs that were accessed. keyword
google_workspace.drive.actor_is_collaborator_account Whether the actor is a collaborator account. boolean
google_workspace.drive.added_role Added membership role of a user/group in a Team Drive. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive keyword
google_workspace.drive.api_method The API method used to generate the event. keyword
google_workspace.drive.billable Whether this activity is billable. boolean
google_workspace.drive.copy_type Indicates whether the original item and new item are owned by the same organization. keyword
google_workspace.drive.deletion_reason The reason an item was deleted. keyword
google_workspace.drive.destination_folder_id keyword
google_workspace.drive.destination_folder_title keyword
google_workspace.drive.encryption_enforcement_option The client-side encryption policy being applied to the user at time of the item's creation. keyword
google_workspace.drive.file.id keyword
google_workspace.drive.file.owner.email keyword
google_workspace.drive.file.owner.is_shared_drive Boolean flag denoting whether owner is a shared drive. boolean
google_workspace.drive.file.type Document Drive type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive keyword
google_workspace.drive.is_encrypted Whether the file is client-side encrypted. boolean
google_workspace.drive.membership_change_type Type of change in Team Drive membership of a user/group. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive keyword
google_workspace.drive.new_publish_visibility New Publish Visibility Value. keyword
google_workspace.drive.new_value When a setting or property of the file changes, the new value for it will appear here. keyword
google_workspace.drive.old_publish_visibility Old Publish Visibility Value. keyword
google_workspace.drive.old_value When a setting or property of the file changes, the old value for it will appear here. keyword
google_workspace.drive.old_visibility When visibility changes, this holds the old value. keyword
google_workspace.drive.originating_app_id The Google Cloud Project ID of the application that performed the action. keyword
google_workspace.drive.owner_is_team_drive Whether the owner is a Team Drive. boolean
google_workspace.drive.parsed_query keyword
google_workspace.drive.primary_event Whether this is a primary event. A single user action in Drive may generate several events. boolean
google_workspace.drive.removed_role Removed membership role of a user/group in a Team Drive. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive keyword
google_workspace.drive.script_id The document ID of the executing script. keyword
google_workspace.drive.shared_drive_id The unique identifier of the Team Drive. Only populated for for events relating to a Team Drive or item contained inside a Team Drive. keyword
google_workspace.drive.shared_drive_settings_change_type Type of change in Team Drive settings. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive keyword
google_workspace.drive.sheets_import_range_recipient_doc Doc ID of the recipient of a sheets import range. keyword
google_workspace.drive.source_folder_id keyword
google_workspace.drive.source_folder_title keyword
google_workspace.drive.target Target user or group. keyword
google_workspace.drive.target_domain The domain for which the access scope was changed. This can also be the alias all to indicate the access scope was changed for all domains that have visibility for this document. keyword
google_workspace.drive.target_user The email address of the user or group whose access permissions were changed, or the name of the domain for which access permissions were changed. keyword
google_workspace.drive.visibility Visibility of target file. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive keyword
google_workspace.drive.visibility_change When visibility changes, this holds the new overall visibility of the file. keyword
google_workspace.event.type The type of Google Workspace event, mapped from items[].events[].type in the original payload. Each fileset can have a different set of values for it, more details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.kind The type of API resource, mapped from kind in the original payload. More details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.organization.domain The domain that is affected by the report's event. keyword
input.type Type of Filebeat input. keyword
log.offset Log offset. long

This is the groups dataset.

Example 
{
    "@timestamp": "2022-05-04T15:04:05.000Z",
    "agent": {
        "ephemeral_id": "1328fbf7-11d8-4bcf-b88e-570646aa300e",
        "id": "0d21a228-d06b-4019-89b7-be02c1d80bf4",
        "name": "elastic-agent-95467",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "data_stream": {
        "dataset": "google_workspace.groups",
        "namespace": "46827",
        "type": "logs"
    },
    "ecs": {
        "version": "9.5.0"
    },
    "elastic_agent": {
        "id": "0d21a228-d06b-4019-89b7-be02c1d80bf4",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "action": "change_acl_permission",
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "created": "2026-08-21T07:40:55.867Z",
        "dataset": "google_workspace.groups",
        "id": "1",
        "ingested": "2026-08-21T07:40:58Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@example.com\",\"profileId\":1},\"events\":{\"name\":\"change_acl_permission\",\"parameters\":[{\"name\":\"acl_permission\",\"value\":\"can_add_members\"},{\"name\":\"group_email\",\"value\":\"group@example.com\"},{\"multiValue\":[\"managers\",\"members\"],\"name\":\"new_value_repeated\"},{\"multiValue\":[\"managers\"],\"name\":\"old_value_repeated\"}],\"type\":\"acl_change\"},\"id\":{\"applicationName\":\"groups\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "groups",
        "type": [
            "group",
            "change"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "event": {
            "type": "acl_change"
        },
        "groups": {
            "acl_permission": "can_add_members",
            "email": "group@example.com",
            "new_value": [
                "managers",
                "members"
            ],
            "old_value": [
                "managers"
            ]
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        }
    },
    "group": {
        "domain": "example.com",
        "name": "group"
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "example.com",
            "email": "foo@example.com",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-groups"
    ],
    "user": {
        "domain": "example.com",
        "email": "foo@example.com",
        "id": "1",
        "name": "foo",
        "target": {
            "group": {
                "domain": "example.com",
                "name": "group"
            }
        }
    }
}
Exported fields
Field Description Type
@timestamp Event timestamp. date
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
event.dataset Event dataset constant_keyword
event.module Event module constant_keyword
google_workspace.actor.key Only present when actor.type is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts. keyword
google_workspace.actor.type The type of actor. Values can be: *USER*: Another user in the same domain. *EXTERNAL_USER*: A user outside the domain. *KEY*: A non-human actor. keyword
google_workspace.event.type The type of Google Workspace event, mapped from items[].events[].type in the original payload. Each fileset can have a different set of values for it, more details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.groups.acl_permission Group permission setting updated. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups keyword
google_workspace.groups.email Group email. keyword
google_workspace.groups.member.email Member email. keyword
google_workspace.groups.member.role Member role. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups keyword
google_workspace.groups.message.id SMTP message Id of an email message. Present for moderation events. keyword
google_workspace.groups.message.moderation_action Message moderation action. Possible values are approved and rejected. keyword
google_workspace.groups.new_value New value(s) of the group setting. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups keyword
google_workspace.groups.old_value Old value(s) of the group setting. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups keyword
google_workspace.groups.setting Group setting updated. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups keyword
google_workspace.groups.status A status describing the output of an operation. Possible values are failed and succeeded. keyword
google_workspace.groups.value Value of the group setting. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups keyword
google_workspace.kind The type of API resource, mapped from kind in the original payload. More details can be found at https://developers.google.com/admin-sdk/reports/v1/reference/activities/list keyword
google_workspace.organization.domain The domain that is affected by the report's event. keyword
input.type Type of Filebeat input. keyword
log.offset Log offset. long

This is the alert dataset.

Example 
{
    "@timestamp": "2022-07-01T10:49:29.436Z",
    "agent": {
        "ephemeral_id": "60871017-f42c-48b1-be5a-cd15dd7f6a32",
        "id": "b3235132-6691-4895-beee-a8cde95a199e",
        "name": "elastic-agent-84453",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "data_stream": {
        "dataset": "google_workspace.alert",
        "namespace": "51889",
        "type": "logs"
    },
    "ecs": {
        "version": "9.5.0"
    },
    "elastic_agent": {
        "id": "b3235132-6691-4895-beee-a8cde95a199e",
        "snapshot": false,
        "version": "8.19.4"
    },
    "email": {
        "attachments": {
            "file": {
                "hash": {
                    "sha256": [
                        "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c",
                        "228b48a56dbc2ecf10393227ac9c9dc943881fd7a55452e12a09107476bef2b2",
                        "5fb1679e08674059b72e271d8902c11a127bb5301b055dc77fa03932ada56a56"
                    ]
                }
            }
        },
        "delivery_timestamp": [
            "2022-07-01T10:38:13.194Z"
        ],
        "message_id": [
            "decedih843@example.com",
            "decedih@example.com"
        ],
        "subject": [
            "Sales",
            "RE: Example salesorderspca JSON request"
        ],
        "to": {
            "address": [
                "example@example.com"
            ]
        }
    },
    "event": {
        "action": "Gmail phishing",
        "agent_id_status": "verified",
        "category": [
            "email",
            "threat",
            "malware"
        ],
        "created": "2026-08-21T07:28:34.478Z",
        "dataset": "google_workspace.alert",
        "end": "2022-07-01T10:47:04.530Z",
        "id": "91840a82-3af0-46d7-95ec-625c1cf0c3f7",
        "ingested": "2026-08-21T07:28:37Z",
        "kind": "alert",
        "original": "{\"alertId\":\"91840a82-3af0-46d7-95ec-625c1cf0c3f7\",\"createTime\":\"2022-07-01T10:49:29.436394Z\",\"customerId\":\"02umwv6u\",\"data\":{\"@type\":\"type.googleapis.com/google.apps.alertcenter.type.MailPhishing\",\"domainId\":{\"customerPrimaryDomain\":\"example.com\"},\"isInternal\":true,\"maliciousEntity\":{\"displayName\":\"string\",\"entity\":{\"displayName\":\"example\",\"emailAddress\":\"example@example.com\"},\"fromHeader\":\"header@example.com\"},\"messages\":[{\"attachmentsSha256Hash\":[\"50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c\",\"228b48a56dbc2ecf10393227ac9c9dc943881fd7a55452e12a09107476bef2b2\"],\"date\":\"2022-07-01T10:38:13.194711Z\",\"md5HashMessageBody\":\"d29343907090dff4cec4a9a0efb80d20\",\"md5HashSubject\":\"a3708f8228384d932237f85980ff8283\",\"messageBodySnippet\":\" hi greetings from sales \",\"messageId\":\"decedih843@example.com\",\"recipient\":\"example@example.com\",\"subjectText\":\"Sales\"},{\"attachmentsSha256Hash\":[\"5fb1679e08674059b72e271d8902c11a127bb5301b055dc77fa03932ada56a56\"],\"md5HashMessageBody\":\"d29343907090dff4cec4a9a0efb80d20\",\"md5HashSubject\":\"a3708f8228384d932237f85980ff8283\",\"messageBodySnippet\":\" hi greetings \",\"messageId\":\"decedih@example.com\",\"recipient\":\"example@example.com\",\"subjectText\":\"RE: Example salesorderspca JSON request\"}],\"systemActionType\":\"NO_OPERATION\"},\"deleted\":false,\"endTime\":\"2022-07-01T10:47:04.530834Z\",\"etag\":\"wF2Ix2DWDv8=\",\"metadata\":{\"alertId\":\"91840a82-3af0-46d7-95ec-625c1cf0c3f7\",\"assignee\":\"example@example.com\",\"customerId\":\"02umwv6u\",\"etag\":\"wF2Ix2DWDv8=\",\"severity\":\"HIGH\",\"status\":\"NOT_STARTED\",\"updateTime\":\"2022-07-01T10:49:29.436394Z\"},\"securityInvestigationToolLink\":\"string\",\"source\":\"Gmail phishing\",\"startTime\":\"2022-07-01T10:38:13.194711Z\",\"type\":\"User reported phishing\",\"updateTime\":\"2022-07-01T10:49:29.436394Z\"}",
        "start": "2022-07-01T10:38:13.194Z",
        "type": [
            "info"
        ]
    },
    "google_workspace": {
        "alert": {
            "create_time": "2022-07-01T10:49:29.436Z",
            "customer": {
                "id": "02umwv6u"
            },
            "data": {
                "domain_id": {
                    "customer_primary_domain": "example.com"
                },
                "is_internal": true,
                "malicious_entity": {
                    "display_name": "string",
                    "entity": {
                        "display_name": "example",
                        "email_address": "example@example.com"
                    },
                    "from_header": "header@example.com"
                },
                "messages": [
                    {
                        "attachments_sha256_hash": [
                            "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c",
                            "228b48a56dbc2ecf10393227ac9c9dc943881fd7a55452e12a09107476bef2b2"
                        ],
                        "date": "2022-07-01T10:38:13.194Z",
                        "id": "decedih843@example.com",
                        "md5": {
                            "hash": {
                                "message_body": "d29343907090dff4cec4a9a0efb80d20",
                                "subject": "a3708f8228384d932237f85980ff8283"
                            }
                        },
                        "message_body_snippet": " hi greetings from sales ",
                        "recipient_email": "example@example.com",
                        "subject_text": "Sales"
                    },
                    {
                        "attachments_sha256_hash": [
                            "5fb1679e08674059b72e271d8902c11a127bb5301b055dc77fa03932ada56a56"
                        ],
                        "id": "decedih@example.com",
                        "md5": {
                            "hash": {
                                "message_body": "d29343907090dff4cec4a9a0efb80d20",
                                "subject": "a3708f8228384d932237f85980ff8283"
                            }
                        },
                        "message_body_snippet": " hi greetings ",
                        "recipient_email": "example@example.com",
                        "subject_text": "RE: Example salesorderspca JSON request"
                    }
                ],
                "system_action_type": "NO_OPERATION",
                "type": "type.googleapis.com/google.apps.alertcenter.type.MailPhishing"
            },
            "deleted": false,
            "end_time": "2022-07-01T10:47:04.530Z",
            "etag": "wF2Ix2DWDv8=",
            "id": "91840a82-3af0-46d7-95ec-625c1cf0c3f7",
            "metadata": {
                "alert": {
                    "id": "91840a82-3af0-46d7-95ec-625c1cf0c3f7"
                },
                "assignee": "example@example.com",
                "customer": {
                    "id": "02umwv6u"
                },
                "etag": "wF2Ix2DWDv8=",
                "severity": "HIGH",
                "status": "NOT_STARTED",
                "update_time": "2022-07-01T10:49:29.436Z"
            },
            "security_investigation_tool_link": "string",
            "source": "Gmail phishing",
            "start_time": "2022-07-01T10:38:13.194Z",
            "type": "User reported phishing",
            "update_time": "2022-07-01T10:49:29.436Z"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "02umwv6u"
    },
    "related": {
        "hash": [
            "a3708f8228384d932237f85980ff8283",
            "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c",
            "228b48a56dbc2ecf10393227ac9c9dc943881fd7a55452e12a09107476bef2b2",
            "5fb1679e08674059b72e271d8902c11a127bb5301b055dc77fa03932ada56a56"
        ],
        "user": [
            "example"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-alert"
    ],
    "user": {
        "domain": "example.com",
        "email": [
            "example@example.com"
        ],
        "name": "example"
    }
}
Exported fields
Field Description Type
@timestamp Event timestamp. date
data_stream.dataset Data stream dataset. constant_keyword
data_stream.namespace Data stream namespace. constant_keyword
data_stream.type Data stream type. constant_keyword
email.attachments A list of objects describing the attachment files sent along with an email message. nested
email.attachments.file.hash.sha256 SHA256 hash. keyword
event.dataset Event dataset. constant_keyword
event.module Event module. constant_keyword
google_workspace.alert.create_time The time this alert was created. date
google_workspace.alert.customer.id The unique identifier of the Google account of the customer. keyword
google_workspace.alert.data.action.name List of action names associated with the rule threshold. keyword
google_workspace.alert.data.actor.email Email of person who performed the action. keyword
google_workspace.alert.data.affected.user_emails The list of emails which correspond to the users directly affected by the incident. keyword
google_workspace.alert.data.alert_details alert details of google workspace alert. keyword
google_workspace.alert.data.appeal_window appeal window of alert. keyword
google_workspace.alert.data.attachment.data.csv.data_rows.entries The data entries in a CSV file row, as a string array rather than a single comma-separated string. keyword
google_workspace.alert.data.attachment.data.csv.headers The list of headers for data columns in a CSV file. keyword
google_workspace.alert.data.create_time Rule create timestamp. date
google_workspace.alert.data.dashboard.uri Link to the outage event in Google Workspace Status Dashboard. keyword
google_workspace.alert.data.description A detailed, freeform incident description. text
google_workspace.alert.data.display.name Alert display name. keyword
google_workspace.alert.data.domain Customer domain for email template personalization. keyword