# Google GCP Audit Logs Mapping Issue

**URL:** <https://discuss.elastic.co/t/google-gcp-audit-logs-mapping-issue/190819>\
**Category:** Elasticsearch\
**Created:** [July 16, 2019, 7:51pm UTC](https://discuss.elastic.co/t/google-gcp-audit-logs-mapping-issue/190819 "2019-07-16T19:51:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![daniel\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_a/32/48390_2.png) [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\
**Post date:** [July 16, 2019, 7:51pm UTC](https://discuss.elastic.co/t/google-gcp-audit-logs-mapping-issue/190819/1 "2019-07-16T19:51:49Z")

</div>

I've been trying to fix a dynamic mapping for the GCP audit logs (Google Cloud), and I can't figure out a way to fix the mapping schema. The problem is related to "Object in arrays are not well supported" for a specific filed "authorizationInfo" in the logs.

an array of objects:

```
    "authorizationInfo" : [
        {
            "resourceAttributes" : {
                "service" : "resourcemanager",
                   "type" : "resourcemanager.projects",
                   "name" : "some_random_name"
            },
                    "permission" : "compute.instances.list",
                       "granted" : true
        }
    ],

```

sample log:

```
{
        "severity" : "INFO",
            "host" : null,
         "logName" : "/logs/cloudaudit.googleapis.com%2Fdata_access",
        "insertId" : "XXXXXXXXX",
       "messageId" : "XXXXXXXXX",
    "protoPayload" : {
           "serviceName" : "compute.googleapis.com",
                 "@type" : "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo" : {
        "principalEmail" : "XXXX@email.com"
    },
     "authorizationInfo" : [
        {
            "resourceAttributes" : {
                "service" : "resourcemanager",
                   "type" : "resourcemanager.projects",
                   "name" : "some_random_name"
            },
                    "permission" : "compute.instances.list",
                       "granted" : true
        }
    ],
            "methodName" : "compute.instances.list",
      "resourceLocation" : {
        "currentLocations" : [
            "east-us"
        ]
    },
          "resourceName" : "/zones/instances",
               "request" : {
        "@type" : "type.googleapis.com/compute.instances.list"
    },
       "requestMetadata" : {
                  "callerNetwork" : "/global/networks/ __unknown__",
        "callerSuppliedUserAgent" : "google-api-nodejs-client/0.10.0,gzip(gfe)",
              "requestAttributes" : {
            "auth" : {},
            "time" : "2010-07-12T06:25:31.891Z"
        },
                       "callerIp" : "xx.xxx.xxx.xx",
          "destinationAttributes" : {}
    }
},
       "timestamp" : "2010-07-12T06:25:31.802Z",
        "resource" : {
      "type" : "gce_instance",
    "labels" : {
               "zone" : "east-us",
        "instance_id" : "",
         "project_id" : "some_random_name"
    }
},
        "@version" : "1",
"receiveTimestamp" : "2010-07-12T06:25:32.110631747Z",
      "@timestamp" : "2010-07-12T06:25:32.338Z"
```

---

<div class="post-metadata">

**Author:** ![daniel\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_a/32/48390_2.png) [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\
**Post date:** [July 17, 2019, 3:21pm UTC](https://discuss.elastic.co/t/google-gcp-audit-logs-mapping-issue/190819/2 "2019-07-17T15:21:09Z")

</div>

I think the issue is that Kibana won't show the results after implementing nested data type, and this made me confused.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2019, 3:21pm UTC](https://discuss.elastic.co/t/google-gcp-audit-logs-mapping-issue/190819/3 "2019-08-14T15:21:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.