Configure a central bucket
Stay organized with collections
Save and categorize content based on your preferences.
You can decide to not store logs in the _Default bucket to route them to a
central networking bucket (or multiple buckets for larger organizations).
You can achieve this by performing any of the following:
- Use an
aggregated
sink configured at the folder or organization level. Optionally, such a
sink allows intercept logs to avoid duplication.
- Manually configure sinks in projects to route traffic to specific buckets.
To analyze networking logs in the organization using Log Analytics, we
recommend you route them to the central networking bucket before you enable
VPC Flow Logs.
- Create a bucket.
- Route logs to the newly created bucket. For more information, see
Route logs to supported destinations.
- Collate and route organization-level logs to supported destinations.
- Configure log routing for each project.
- Enable VPC Flow Logs for each resource.
Route logs from the projects to a central bucket
By default, Log Analytics lets you analyze the logs in a single log bucket.
To view data from multiple projects, you must create a central log bucket and
route logs to this central bucket.
The bucket that is used to store networking logs must be upgraded to support
Log Analytics.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-08-29 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[],[],null,["# Configure a central bucket\n\nYou can decide to not store logs in the *_Default* bucket to route them to a\ncentral networking bucket (or multiple buckets for larger organizations).\n\nYou can achieve this by performing any of the following:\n\n- Use an [aggregated](/logging/docs/export/aggregated_sinks) sink configured at the folder or organization level. Optionally, such a sink allows intercept logs to avoid duplication.\n- Manually configure sinks in projects to route traffic to specific buckets.\n\nTo analyze networking logs in the organization using Log Analytics, we\nrecommend you route them to the central networking bucket before you enable\nVPC Flow Logs.\n\n1. [Create a bucket](/logging/docs/buckets#create_bucket).\n2. Route logs to the newly created bucket. For more information, see [Route logs to supported destinations](/logging/docs/export/configure_export_v2).\n3. [Collate and route organization-level logs to supported destinations](/logging/docs/export/aggregated_sinks).\n4. Configure log routing for each project.\n5. [Enable VPC Flow Logs for each resource](/vpc/docs/using-flow-logs#enabling-vpc-flow-logs).\n\nRoute logs from the projects to a central bucket\n------------------------------------------------\n\nBy default, Log Analytics lets you analyze the logs in a single log bucket.\nTo view data from multiple projects, you must create a central log bucket and\nroute logs to this central bucket.\n\nThe bucket that is used to store networking logs must be upgraded to support\n[Log Analytics](/logging/docs/buckets#upgrade-bucket)."]]
