Google Cloud

The Google Cloud destination exports telemetry from a Bindplane pipeline to Google Cloud's observability suite. Metrics are sent to Cloud Monitoring, logs to Cloud Logging, and traces to Cloud Trace. Choose which signals to export with the Telemetry Type selector.

Supported Telemetry Types

Metrics	Logs	Traces
✓	✓	✓

Prerequisites

You need a Google Cloud project and credentials authorized to write telemetry to it.

The following Google Cloud APIs must be enabled on the destination project:

• Cloud Monitoring API (monitoring.googleapis.com)
• Cloud Logging API (logging.googleapis.com)
• Cloud Trace API (cloudtrace.googleapis.com)

The collector must be able to reach these endpoints over HTTPS on port 443. When the collector runs on a Google Cloud host, this access is typically available by default.

Credentials and IAM roles

The exporter authenticates using Google Application Default Credentials. When the collector runs on a Google Cloud host (Compute Engine, GKE), it can use the host's attached service account automatically. When the collector runs outside Google Cloud, create a service account and supply its key as JSON or a file path.

Grant the service account the roles matching the signals you export:

Signal	Role	Identifier
Metrics	Monitoring Metric Writer	roles/monitoring.metricWriter
Logs	Logs Writer	roles/logging.logWriter
Traces	Cloud Trace Agent	roles/cloudtrace.agent

Create and download a service account key following the Google Cloud documentation. The downloaded key is used when the Authentication Method is set to json or file.

Configuration

General

Parameter	Type	Required	Default	Description
Choose Telemetry Type	Telemetry Selector	No	Logs, Metrics, Traces	Which signals to export.
Project ID	String	No	(empty)	The Google Cloud project ID to send telemetry to. Detected from the credentials if left empty.
Authentication Method	Enum: auto, json, file	Yes	auto	How the collector authenticates to Google Cloud.1
Credentials	String (sensitive)	Yes	(empty)	JSON contents of a Google service account credential file. Shown when Authentication Method is json.
Credentials File	String	Yes	(empty)	Path to a Google service account credential file on the collector. The collector's runtime user must be able to read it. Shown when Authentication Method is file.

1. auto uses the collector's environment (Application Default Credentials), which works on Google Cloud hosts or when GOOGLE_APPLICATION_CREDENTIALS is set. json takes the service account key contents inline. file reads the key from a path on the collector.

Advanced

Parameter	Type	Required	Default	Description
Timeout	Duration	No	5s	Timeout for sending a batch to Google Cloud. Batches that cannot be sent within the timeout are dropped.
Enable Compression	Boolean	No	true	Compress telemetry with gzip before sending.
Metric Write-Ahead-Log	Boolean	No	false	Write metrics to a write-ahead-log before sending, to help avoid loss during network outages or collector restarts.
WAL Max Retry Duration	Integer (minutes)	No	60	Maximum time to retry sending metrics from the write-ahead-log after a network error. Shown when Metric Write-Ahead-Log is enabled.
Default Location	Enum (creatable)	No	us-east1	Region assigned to records (via cloud.region) that lack a region or availability zone. Any Google Cloud region is accepted.
Drop Raw Copy	Boolean	No	true	Drop the raw copy of the log stored in log.record.original.

Sending Queue

Parameter	Type	Required	Default	Description
Enable Sending Queue	Boolean	No	true	Buffer telemetry in memory before sending, to help avoid loss during a temporary network outage.
Number of Consumers	Integer	No	10	Number of consumers that dequeue batches. Shown when the sending queue is enabled.
Queue Size	Integer	No	5000	Maximum number of batches kept in memory before dropping. Shown when the sending queue is enabled.
Enable Persistent Queuing	Boolean	No	true	Buffer telemetry to disk before sending, to help avoid loss during network outages or collector restarts. Shown when the sending queue is enabled.
Persistent Queue Storage	Extension	Yes	File storage extension	Storage backend for the persistent queue. Defaults to a file storage extension at ${OIQ_OTEL_COLLECTOR_HOME}/storage. Shown when both the sending queue and persistent queuing are enabled.

Examples

Send all signals using an inline service account key (JSON)

This destination authenticates with the json method, embedding the service account key directly in the configuration. It exports metrics, logs, and traces to the project bindplane-gcp. Replace the credentials value with your own service account key.

apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  name: google-cloud
spec:
  type: googlecloud
  parameters:
    - name: telemetry_types
      value:
        - Logs
        - Metrics
        - Traces
    - name: project
      value: bindplane-gcp
    - name: auth_type
      value: json
    - name: credentials
      value: '{"type":"service_account","project_id":"bindplane-gcp","private_key_id":"REPLACE_ME","private_key":"REPLACE_ME","client_email":"[e-mail]"}'

Configuration Tips

• On Google Cloud hosts, leave Authentication Method on auto and Project ID empty. The exporter resolves both from the attached service account and instance metadata.
• Set Default Location to the region closest to your collectors so records without an explicit cloud.region are not assigned the us-east1 default.
• Keep the sending queue and persistent queuing enabled in production so telemetry survives transient network failures and collector restarts.

Troubleshooting

Permission denied or authentication errors

Symptoms: the collector logs PermissionDenied, 403, or credential errors and no telemetry reaches Google Cloud.

Solutions:

1. Confirm the service account has the role for each exported signal: roles/monitoring.metricWriter for metrics, roles/logging.logWriter for logs, roles/cloudtrace.agent for traces.
2. Verify the target API (Cloud Monitoring, Cloud Logging, or Cloud Trace) is enabled on the project.
3. When using file, confirm the collector's runtime user can read the credentials file.

Telemetry sent to the wrong or no project

Symptoms: data does not appear in the expected project.

Solutions:

1. Set Project ID explicitly rather than relying on detection from credentials.
2. Confirm the service account belongs to the intended project.

Dropped data during network outages

Symptoms: gaps in metrics or logs after a network interruption or collector restart.

Solutions:

1. Enable the sending queue and persistent queuing so batches buffer to disk instead of dropping.
2. For metrics, enable the Metric Write-Ahead-Log to retry sending after the network recovers.

Standalone Destination

apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  name: google-cloud
spec:
  type: googlecloud
  parameters:
    - name: telemetry_types
      value:
        - Logs
        - Metrics
        - Traces
    - name: project
      value: bindplane-gcp
    - name: auth_type
      value: file
    - name: credentials_file
      value: /opt/observiq-otel-collector/service_account.json

Related Resources

• Google Cloud Exporter — OpenTelemetry Collector Contrib
• Authentication for Google Cloud APIs and services
• Create service accounts — Google Cloud IAM