Send logs to Google BigQuery

Create a stream that writes the logs of your applications as rows in a Google BigQuery table, in Azion Console or with the Azion API, and confirm the delivery.

Last updated

View as Markdown Agent setup

You can send the logs of a stream to a table in Google BigQuery from Azion Console or with the Azion API.

Data Stream sends the log lines as rows to a table of a BigQuery dataset. In the stream form, the endpoint is set in the field labeled Connector, and BigQuery is its Google BigQuery option. For every field and its bounds, refer to Endpoints.

The stream signs in to Google with a service account key that you provide. Data Stream performs the Google OAuth 2.0 authentication and generates the JSON Web Tokens, so the key is the only credential you set. The example collects the requests of one workload with the Applications data source.

Select your interface once. The prerequisites and every task below show only that path.

Prerequisites

  • An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
  • A workload on the account that receives requests.
  • A Google Cloud project with the BigQuery API enabled, and the ID of the project.
  • Billing enabled on the project. The free tier does not accept rows streamed into a table. Google Cloud lists the fees for these inserts under Streaming Inserts in the BigQuery price table.
  • A dataset in the project, and its dataset ID. The dataset ID is case sensitive.
  • A table in the dataset, with a schema for the data the stream sends, and its table ID. The table ID is the name you give the table.
  • A Google Cloud service account with the BigQuery Admin role, and a key of the service account in JSON format. Google Cloud downloads the key as a JSON file when you create it.

The key file holds the keys below. Data Stream takes the whole content of the file:

JSON
01{
02 "type": "service_account",
03 "project_id": "<project-id>",
04 "private_key_id": "<private-key-id>",
05 "private_key": "<private-key>",
06 "client_email": "<client-email>",
07 "client_id": "<client-id>",
08 "auth_uri": "<auth-uri>",
09 "token_uri": "<token-uri>",
10 "auth_provider_x509_cert_url": "<auth-provider-cert-url>",
11 "client_x509_cert_url": "<client-cert-url>"
12}

Create the stream

The stream collects from the workload you choose, through a workload filter. A workload filter keeps your other streams active, which a sampled stream does not.

To create the stream with the API, send a POST request to https://api.azion.com/v4/workspace/stream/streams. Replace [TOKEN VALUE] with your personal token, <workload-id> with the ID of your workload, and the table values with your own. Replace [SERVICE ACCOUNT KEY] with the content of the key file as one JSON string, with each quotation mark and backslash of the file escaped with a \:

Shell
01curl -X POST 'https://api.azion.com/v4/workspace/stream/streams' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d {
05 "name": "logs-to-bigquery",
06 "active": true,
07 "inputs": [
08 { "type": "raw_logs", "attributes": { "data_source": "workloads" } }
09 ],
10 "transform": [
11 { "type": "filter_workloads", "attributes": { "workloads": [<workload-id>] } },
12 { "type": "render_template", "attributes": { "template": 2 } }
13 ],
14 "outputs": [
15 {
16 "type": "big_query",
17 "attributes": {
18 "project_id": "my-project",
19 "dataset_id": "azion_logs",
20 "table_id": "requests",
21 "service_account_key": "[SERVICE ACCOUNT KEY]"
22 }
23 }
24 ]
25 }

The workloads data source is Applications in the Console, and template 2 is Applications Event Collector. The API answers 201 with the stored stream:

JSON
01{
02 "state": "executed",
03 "data": {
04 "id": 12350,
05 "name": "logs-to-bigquery",
06 "last_editor": "user@example.com",
07 "created": "2026-01-01T12:10:29.000000Z",
08 "last_modified": "2026-01-01T12:10:29.000000Z",
09 "product_version": "1.0",
10 …
11 "outputs": [
12 {
13 "type": "big_query",
14 "attributes": {
15 "dataset_id": "azion_logs",
16 "project_id": "my-project",
17 "table_id": "requests",
18 "service_account_key": "[SERVICE ACCOUNT KEY]"
19 }
20 }
21 ]
22 }
23}

Keep the id: it identifies the stream in every later request, such as /v4/workspace/stream/streams/12350. For every key of the body, refer to Stream settings.

To create the stream in Azion Console:

Open Data Stream

Access Azion Console > Data Stream.

Select + Stream
Name the stream

In the General section, enter a Name. For example: logs-to-bigquery.

Select the data source

In the Input section, select Applications in Data Source.

Turn off Sampling

In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.

Choose the workload

In the Transform section, set Option to Filter Workloads. In Available Workload, select your workload and move it to Chosen Workload with the arrow.

Select the template

In the Render Template section, select Applications Event Collector in Template.

Select the BigQuery endpoint

In the Output section, select Google BigQuery in Connector.

Enter the table location

Enter the ID of your Google Cloud project in Project ID, the dataset ID in Dataset ID, and the table ID in Table ID. For example: my-project, azion_logs, and requests.

Paste the service account key

In Service Account Key, paste the whole content of the JSON key file. The field is a JSON editor.

Keep the stream active

In the Status section, keep Active turned on.

Select Save

The Console shows Your data stream has been created. The stream appears in the Data Stream list with BigQuery in the Connector column and the Active status.

The API and the Console save the stream without contacting Google Cloud. A wrong project, dataset, table, or key surfaces only when the stream sends. An activation takes effect after one to two minutes.

Confirm the delivery

Real-Time Events records every send of a stream, delivered or not, with the status code the endpoint returned. Send a few requests to the workload, then wait about a minute: a stream sends a batch every 60 seconds, or sooner when it reaches 2,000 log lines.

To read the sends with the API, query the dataStreamedEvents dataset of the Real-Time Events GraphQL API. Replace the dates with a range that covers the activation of the stream:

Shell
01curl -X POST 'https://api.azion.com/v4/events/graphql' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d '{"query":"query { dataStreamedEvents(limit: 20, filter: {tsRange: {begin: \"2026-01-01T12:00:00\", end: \"2026-01-01T12:45:00\"}}, orderBy: [ts_DESC]) { ts endpointType statusCode streamedLines dataStreamed } }"}'

The API answers 200 with one record for each send, the latest first:

JSON
01{
02 "data": {
03 "dataStreamedEvents": [
04 {
05 "ts": "2026-01-01T12:02:04Z",
06 "endpointType": "BIG_QUERY",
07 "statusCode": 200,
08 "streamedLines": 2,
09 "dataStreamed": 2797
10 }
11 ]
12 }
13}

A send to BigQuery carries BIG_QUERY in endpointType. A statusCode of 200 means the endpoint accepted the batch, and an empty dataStreamedEvents list means the stream has not sent in the range. For every field, refer to Real-Time Events GraphQL fields.

To find the sends in Azion Console:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Data Stream data source
Read the latest sends

Each row is one send. Find the rows with BIG_QUERY in Endpoint Type, and read their Status Code.

A Status Code of 200 means BigQuery accepted the batch. Streamed Lines gives the number of log lines in the batch.

A status other than 200 is the answer of the endpoint, and 503 means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.

Next steps

EndpointsEvery field of the BigQuery endpoint, with its type, bounds, and API name.Create a custom templateChoose the variables of each log line, and so the data the table receives.Edit, stop, or delete a streamChange the table or the key, pause the stream, or remove it.Troubleshoot Data StreamFind what to change when a send returns a status other than 200.