About reporting logs in BigQuery
You can access reporting logs and usage reports in the Google Admin console as well as through the Reports API. You can also export G Suite logs and usage reports to Google BigQuery. You can use this feature to:
- Analyze individual activity information for Admin, Google Calendar, Devices, Google Drive, Login, Google Groups, oAuth Tokens, and SAML Audit logs, as well as any updates to the Reports API.
- Build reports across apps by combining G Suite activity reports with usage data from other apps being used in the organization.
- Perform advanced searches on G Suite activity by adding organization directory data into BigQuery.
- Report aggregated usage metrics for user accounts, Drive, Chrome OS, Classroom, Calendar, Google+, Google Hangouts, device management, Gmail, and any updates to the Reports API.
- Utilize the BigQuery web UI, command line, or third-party tools to perform deeper analysis.
- Create custom reporting and dashboards using analytics tools such as Google Data Studio and third-party visualization partners that are integrated with BigQuery.
Data and feature availability
You can gather and aggregate information about:
- Usage reports—All users in the domain, regardless of G Suite license, for usage tables.
- Audit logs—Users who have a G Suite Business license or above for Drive and Mobile audit logs. For other logs, such as Admin, Calendar, Groups, and so on, data for all users (across editions) will be exported to BigQuery.
This data is made available in one BigQuery dataset with 2 aggregate tables: activity_ and usage_. Each table has one table for every day the export is successful.
Inside the dataset, there are 2 tables with 2 different formats:
- Activity (activity_) tables—These tables contain all the logs data currently available for reporting. If you are familiar with the Reports API, you can see a more thorough description of each record. Email logs search is available through a different feature within Gmail in your Admin console.
- Usage (usage_) tables—These tables contain data related to G Suite service usage across your account. They are aggregated statistics about your domain. As a result, it may take a while to aggregate statistics. You can see a more thorough description of each record.