> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/destinations/google-cloud.md).

# Google Cloud

The Google Cloud destination exports telemetry from a Bindplane pipeline to Google Cloud's observability suite. Metrics are sent to Cloud Monitoring, logs to Cloud Logging, and traces to Cloud Trace. Choose which signals to export with the Telemetry Type selector.

### Supported Telemetry

| Metrics | Logs | Traces |
| ------- | ---- | ------ |
| ✓       | ✓    | ✓      |

### Prerequisites

You need a Google Cloud project and credentials authorized to write telemetry to it.

The following Google Cloud APIs must be enabled on the destination project:

* Cloud Monitoring API (`monitoring.googleapis.com`)
* Cloud Logging API (`logging.googleapis.com`)
* Cloud Trace API (`cloudtrace.googleapis.com`)

The collector must be able to reach these endpoints over HTTPS on port 443. When the collector runs on a Google Cloud host, this access is typically available by default.

#### Credentials and IAM roles

The exporter authenticates using Google [Application Default Credentials](https://cloud.google.com/docs/authentication). When the collector runs on a Google Cloud host (Compute Engine, GKE), it can use the host's attached service account automatically. When the collector runs outside Google Cloud, create a [service account](https://cloud.google.com/iam/docs/service-accounts-create) and supply its key as JSON or a file path.

Grant the service account the roles matching the signals you export:

| Signal  | Role                     | Identifier                      |
| ------- | ------------------------ | ------------------------------- |
| Metrics | Monitoring Metric Writer | `roles/monitoring.metricWriter` |
| Logs    | Logs Writer              | `roles/logging.logWriter`       |
| Traces  | Cloud Trace Agent        | `roles/cloudtrace.agent`        |

Create and download a service account key following the [Google Cloud documentation](https://cloud.google.com/iam/docs/keys-create-delete). The downloaded key is used when the Authentication Method is set to `json` or `file`.

### Configuration

<figure><img src="/files/tn87H8focA5CUhCC5tyx" alt="Bindplane docs - Google Cloud - image 1"><figcaption></figcaption></figure>

**General**

| Parameter             | Type                   | Required | Default               | Description                                                                                                                                                          |
| --------------------- | ---------------------- | -------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Choose Telemetry Type | Telemetry Selector     | No       | Logs, Metrics, Traces | Which signals to export.                                                                                                                                             |
| Project ID            | String                 | No       | *(empty)*             | The Google Cloud project ID to send telemetry to. Detected from the credentials if left empty.                                                                       |
| Authentication Method | Enum: auto, json, file | Yes      | `auto`                | How the collector authenticates to Google Cloud.<sup>1</sup>                                                                                                         |
| Credentials           | String (sensitive)     | Yes      | *(empty)*             | JSON contents of a Google service account credential file. Shown when Authentication Method is `json`.                                                               |
| Credentials File      | String                 | Yes      | *(empty)*             | Path to a Google service account credential file on the collector. The collector's runtime user must be able to read it. Shown when Authentication Method is `file`. |

1. *`auto` uses the collector's environment (Application Default Credentials), which works on Google Cloud hosts or when `GOOGLE_APPLICATION_CREDENTIALS` is set. `json` takes the service account key contents inline. `file` reads the key from a path on the collector.*

**Advanced**

| Parameter              | Type              | Required | Default    | Description                                                                                                                         |
| ---------------------- | ----------------- | -------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| Timeout                | Duration          | No       | `5s`       | Timeout for sending a batch to Google Cloud. Batches that cannot be sent within the timeout are dropped.                            |
| Enable Compression     | Boolean           | No       | `true`     | Compress telemetry with gzip before sending.                                                                                        |
| Metric Write-Ahead-Log | Boolean           | No       | `false`    | Write metrics to a write-ahead-log before sending, to help avoid loss during network outages or collector restarts.                 |
| WAL Max Retry Duration | Integer (minutes) | No       | `60`       | Maximum time to retry sending metrics from the write-ahead-log after a network error. Shown when Metric Write-Ahead-Log is enabled. |
| Default Location       | Enum (creatable)  | No       | `us-east1` | Region assigned to records (via `cloud.region`) that lack a region or availability zone. Any Google Cloud region is accepted.       |
| Drop Raw Copy          | Boolean           | No       | `true`     | Drop the raw copy of the log stored in `log.record.original`.                                                                       |

**Sending Queue**

| Parameter                 | Type      | Required | Default                | Description                                                                                                                                                                                   |
| ------------------------- | --------- | -------- | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enable Sending Queue      | Boolean   | No       | `true`                 | Buffer telemetry in memory before sending, to help avoid loss during a temporary network outage.                                                                                              |
| Number of Consumers       | Integer   | No       | `10`                   | Number of consumers that dequeue batches. Shown when the sending queue is enabled.                                                                                                            |
| Queue Size                | Integer   | No       | `5000`                 | Maximum number of batches kept in memory before dropping. Shown when the sending queue is enabled.                                                                                            |
| Enable Persistent Queuing | Boolean   | No       | `true`                 | Buffer telemetry to disk before sending, to help avoid loss during network outages or collector restarts. Shown when the sending queue is enabled.                                            |
| Persistent Queue Storage  | Extension | Yes      | File storage extension | Storage backend for the persistent queue. Defaults to a file storage extension at `${OIQ_OTEL_COLLECTOR_HOME}/storage`. Shown when both the sending queue and persistent queuing are enabled. |

### Examples

#### Send all signals using an inline service account key (JSON)

This destination authenticates with the `json` method, embedding the service account key directly in the configuration. It exports metrics, logs, and traces to the project `bindplane-gcp`. Replace the credentials value with your own service account key.

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  name: google-cloud
spec:
  type: googlecloud
  parameters:
    - name: telemetry_types
      value:
        - Logs
        - Metrics
        - Traces
    - name: project
      value: bindplane-gcp
    - name: auth_type
      value: json
    - name: credentials
      value: '{"type":"service_account","project_id":"bindplane-gcp","private_key_id":"REPLACE_ME","private_key":"REPLACE_ME","client_email":"otel-collector@bindplane-gcp.iam.gserviceaccount.com"}'
```

### Configuration Tips

* On Google Cloud hosts, leave Authentication Method on `auto` and Project ID empty. The exporter resolves both from the attached service account and instance metadata.
* Set Default Location to the region closest to your collectors so records without an explicit `cloud.region` are not assigned the `us-east1` default.
* Keep the sending queue and persistent queuing enabled in production so telemetry survives transient network failures and collector restarts.

### Troubleshooting

#### Permission denied or authentication errors

Symptoms: the collector logs `PermissionDenied`, `403`, or credential errors and no telemetry reaches Google Cloud.

Solutions:

1. Confirm the service account has the role for each exported signal: `roles/monitoring.metricWriter` for metrics, `roles/logging.logWriter` for logs, `roles/cloudtrace.agent` for traces.
2. Verify the target API (Cloud Monitoring, Cloud Logging, or Cloud Trace) is enabled on the project.
3. When using `file`, confirm the collector's runtime user can read the credentials file.

#### Telemetry sent to the wrong or no project

Symptoms: data does not appear in the expected project.

Solutions:

1. Set Project ID explicitly rather than relying on detection from credentials.
2. Confirm the service account belongs to the intended project.

#### Dropped data during network outages

Symptoms: gaps in metrics or logs after a network interruption or collector restart.

Solutions:

1. Enable the sending queue and persistent queuing so batches buffer to disk instead of dropping.
2. For metrics, enable the Metric Write-Ahead-Log to retry sending after the network recovers.

### Standalone Destination

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  name: google-cloud
spec:
  type: googlecloud
  parameters:
    - name: telemetry_types
      value:
        - Logs
        - Metrics
        - Traces
    - name: project
      value: bindplane-gcp
    - name: auth_type
      value: file
    - name: credentials_file
      value: /opt/observiq-otel-collector/service_account.json
```

### Related Resources

* [Google Cloud Exporter — OpenTelemetry Collector Contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/googlecloudexporter/README.md)
* [Authentication for Google Cloud APIs and services](https://cloud.google.com/docs/authentication)
* [Create service accounts — Google Cloud IAM](https://cloud.google.com/iam/docs/service-accounts-create)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bindplane.com/integrations/destinations/google-cloud.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.