Google Cloud VPC Flow Logs

Google Cloud VPC Flow Logs. Sampled network flow records within a Cloud Logging LogEntry.

Source and collection

Enabled subnet/network flow logging and Cloud Logging sinks.

Record aggregation interval, sampling, metadata and filtering settings.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 0d30d698e4c96da4d2f68d6092a80995920e1943e6f2423a69ddedaf57a39b82

{"insertId":"ut8lbrffooxyw","jsonPayload":{"bytes_sent":"1776","connection":{"dest_ip":"67.43.156.13","dest_port":33478,"protocol":6,"src_ip":"10.87.40.76","src_port":5601},"dest_location":{"asn":15169,"continent":"America","country":"usa"},"end_time":"2019-06-14T03:45:37.301953198Z","packets_sent":"7","reporter":"SRC","rtt_msec":"36","src_instance":{"project_id":"my-sample-project","region":"us-east1","vm_name":"kibana","zone":"us-east1-b"},"src_vpc":{"project_id":"my-sample-project","subnetwork_name":"default","vpc_name":"default"},"start_time":"2019-06-14T03:45:37.186193305Z"},"logName":"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows","receiveTimestamp":"2019-06-14T03:50:10.845445834Z","resource":{"labels":{"location":"us-east1-b","project_id":"my-sample-project","subnetwork_id":"758019854043528829","subnetwork_name":"default"},"type":"gce_subnetwork"},"timestamp":"2019-06-14T03:50:10.845445834Z"}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`insertId`	str
`jsonPayload.bytes_sent`	str
`jsonPayload.connection.dest_ip`	str
`jsonPayload.connection.dest_port`	int
`jsonPayload.connection.protocol`	int
`jsonPayload.connection.src_ip`	str
`jsonPayload.connection.src_port`	int
`jsonPayload.dest_location.asn`	int
`jsonPayload.dest_location.continent`	str
`jsonPayload.dest_location.country`	str
`jsonPayload.end_time`	str
`jsonPayload.packets_sent`	str
`jsonPayload.reporter`	str
`jsonPayload.rtt_msec`	str
`jsonPayload.src_instance.project_id`	str
`jsonPayload.src_instance.region`	str
`jsonPayload.src_instance.vm_name`	str
`jsonPayload.src_instance.zone`	str
`jsonPayload.src_vpc.project_id`	str
`jsonPayload.src_vpc.subnetwork_name`	str
`jsonPayload.src_vpc.vpc_name`	str
`jsonPayload.start_time`	str
`logName`	str
`receiveTimestamp`	str
`resource.labels.location`	str
`resource.labels.project_id`	str
`resource.labels.subnetwork_id`	str
`resource.labels.subnetwork_name`	str
`resource.type`	str
`timestamp`	str

jsonPayload: Native field; inspect its exact type and nesting in the complete example below.
resource: Native field; inspect its exact type and nesting in the complete example below.
timestamp: Native field; inspect its exact type and nesting in the complete example below.

Investigation uses

Compare connection tuples, byte estimates and resource metadata with host evidence.
Retain resource, account/project/subscription and region context for correlation.

Validation boundaries

Sampling and aggregation prevent treating one record as a packet capture or complete traffic history.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.