Google Drive Audit Logs connector reference

Beta

This feature is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage Databricks previews.

This page has reference information for the managed Google Drive Audit Logs connector, including the supported source table and its destination table schema.

Supported source tables

The Google Drive Audit Logs connector supports a single source table, drive, under the default source schema. The table supports incremental ingestion. The connector uses the event_time field as the cursor field for incremental ingestion.

Source table	Primary key	Description	Sync mode	Cursor field
drive	event_time, unique_qualifier	Google Drive audit activity events from the Google Workspace Admin SDK Reports API, such as file views, edits, downloads, and sharing changes.	Incremental	event_time

Source table	Primary key	Description	Sync mode	Cursor field
drive	event_time, unique_qualifier	Google Drive audit activity events from the Google Workspace Admin SDK Reports API, such as file views, edits, downloads, and sharing changes.	Incremental	event_time

Connector options

The Google Drive Audit Logs connector has no additional configuration options beyond the pipeline settings available for all managed connectors. See Ingest data from Google Workspace.

Destination table schemas

drive

Primary key: event_time, unique_qualifier Cursor field: event_time

Field	Data type
event_time	TIMESTAMP
unique_qualifier	STRING
id	VARIANT
actor	VARIANT
ipAddress	STRING
ownerDomain	STRING
etag	STRING
kind	STRING
events	VARIANT

Field	Data type
event_time	TIMESTAMP
unique_qualifier	STRING
id	VARIANT
actor	VARIANT
ipAddress	STRING
ownerDomain	STRING
etag	STRING
kind	STRING
events	VARIANT

note

This table does not support SCD type 2 because it has VARIANT columns.

Pagination and incremental ingestion

The connector reads from the Google Workspace Admin SDK Reports API activities.list endpoint for the drive application. It applies server-side time filtering with the startTime and endTime query parameters and pages through results using the nextPageToken cursor.

For incremental ingestion, the connector tracks the event_time field as the cursor. The event_time and unique_qualifier columns are promoted from the nested id object so that they can serve as the primary key and cursor. When no start datetime is configured, the connector backfills the previous 180 days. The Admin SDK Reports API retains Drive audit activity for up to 180 days. See Google Drive Audit Logs connector limitations.