Google Cloud Platform (GCP) Billing metrics

Metrics

The billing dataset collects Cloud Billing Reports information from Google Cloud BigQuery daily cost detail table. BigQuery is a fully-managed, serverless data warehouse. Cloud Billing export to BigQuery enables you to export detailed Google Cloud billing data (such as usage, cost estimates, and pricing data) automatically throughout the day to a BigQuery dataset that you specify. Then you can access your Cloud Billing data from BigQuery for detailed analysis.

Please see export cloud billing data to BigQuery for more details on how to export billing data.

In BigQuery dataset, detailed Google Cloud daily cost data is loaded into a data table named gcp_billing_export_v1_<BILLING_ACCOUNT_ID>. There is a defined schema for Google Cloud daily cost data that is exported to BigQuery. Please see daily cost detail data schema for more details.

Sample Event

An example event for billing looks as following:

{
    "@timestamp": "2017-10-12T08:05:34.853Z",
    "cloud": {
        "account": {
            "id": "01475F-5B1080-1137E7"
        },
        "project": {
            "id": "elastic-bi",
            "name": "elastic-containerlib-prod"
        },
        "provider": "gcp"
    },
    "event": {
        "dataset": "gcp.billing",
        "duration": 115000,
        "module": "gcp"
    },
    "gcp": {
        "billing": {
            "billing_account_id": "01475F-5B1080-1137E7",
            "cost_type": "regular",
            "invoice_month": "202106",
            "project_id": "containerlib-prod-12763",
            "project_name": "elastic-containerlib-prod",
            "total": 4717.170681
        }
    },
    "metricset": {
        "name": "billing",
        "period": 10000
    },
    "service": {
        "type": "gcp"
    }
}

Exported fields

Exported fields

Changelog

This change involves project_id, credentials_file and credentials_json variables that are moved from input level configuration to package level configuration (as those variables are reused across all inputs/data streams).

Users with GCP integration enabled will need to input values for these variables again when upgrading the policies to this version.

Enhancement View pull request
Add GCP Billing Data Stream

Enhancement View pull request
Add GCP Compute Data Stream

Enhancement View pull request
Add GCP Firestore Data stream | | 1.10.0 | Enhancement View pull request
Update package to ECS 8.3.0. | | 1.9.2 | Bug fix View pull request
Fix GCP auditlog parsing issue on response status | | 1.9.1 | Enhancement View pull request
Update readme | | 1.9.0 | Enhancement View pull request
Preserve request and response in flattened fields. | | 1.8.0 | Enhancement View pull request
Add missing cloud.provider field. | | 1.7.0 | Enhancement View pull request
Add dashboards for firewall and vpc flow logs.

Bug fix View pull request
Add missing mappings for several event.* fields. | | 1.6.1 | Enhancement View pull request
Clarify the GCP privileges required by the Pub/Sub input. | | 1.6.0 | Enhancement View pull request
Update to ECS 8.2 | | 1.5.1 | Enhancement View pull request
Add documentation for multi-fields | | 1.5.0 | Enhancement View pull request
Improve Google Cloud Platform docs. | | 1.4.2 | Bug fix View pull request
Remove emtpy values, names with only dots, and invalid client IPs. | | 1.4.1 | Bug fix View pull request
Fix quoting of the credentials_json value in policy templates. | | 1.4.0 | Enhancement View pull request
Add gcp.dns integration | | 1.3.1 | Bug fix View pull request
Add Ingest Pipeline script to map IANA Protocol Numbers | | 1.3.0 | Enhancement View pull request
Update to ECS 8.0 | | 1.2.2 | Bug fix View pull request
Regenerate test files using the new GeoIP database | | 1.2.1 | Bug fix View pull request
Change test public IPs to the supported subset | | 1.2.0 | Enhancement View pull request
Add 8.0.0 version constraint | | 1.1.2 | Enhancement View pull request
Update Title and Description. | | 1.1.1 | Bug fix View pull request
Fix logic that checks for the 'forwarded' tag | | 1.1.0 | Enhancement View pull request
Update to ECS 1.12.0 | | 1.0.0 | Enhancement View pull request
Move from experimental to GA

Enhancement View pull request
remove experimental from data_sets | | 0.3.3 | Enhancement View pull request
Convert to generated ECS fields | | 0.3.2 | Enhancement View pull request
update to ECS 1.11.0 | | 0.3.1 | Enhancement View pull request
Escape special characters in docs | | 0.3.0 | Enhancement View pull request
Update integration description | | 0.2.0 | Enhancement View pull request
Set "event.module" and "event.dataset" | | 0.1.0 | Enhancement View pull request
update to ECS 1.10.0 and adding event.original options | | 0.0.2 | Enhancement View pull request
update to ECS 1.9.0 | | 0.0.1 | Enhancement View pull request
initial release |