GKEAPIServer

GKEAPIServer Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel The Google Cloud Platform (GCP) Kubernetes Engine data connector allows you to monitor containerized applications, track performance metrics, and detect potential threats across your GKE environment.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
ApfAdditionalLatency Additional latency due to APF throttling. String
ApfExecutionTime Time taken to execute the request excluding APF wait time. String
ApfFs APF Flow Schema. String
ApfFSeats Final number of seats used after adjustments. Int32
ApfISeats Number of seats initially allocated by APF. Int32
ApfPl API Priority and Fairness (APF) Priority Level. String
AuditID Unique identifier for the audit log entry. String
ClusterName Name of the Kubernetes cluster. String
ComponentLocation Region or zone where the API server is located. String
ComponentName Name of the GKE component generating the log (typically apiserver). String
ComputeResourceName Name of the compute instance or pod. String
HttpVerb HTTP method (e.g., GET, POST, PUT, DELETE). String
InsertId Unique ID for the log entry used to prevent duplication. String
Labels Dynamic field containing various labels associated with the log entry. Object
Latency Total time taken to serve the request. String
Location GCP region or zone. String
LogName Name of the log stream, usually indicating the source. String
Message The content of the log message. String
Pid Process ID that generated the log entry. String
ProjectID GCP project ID where the GKE cluster resides. String
Protocol Protocol used for the request (e.g., HTTP/1.1). String
ReceiveTimestamp Timestamp when GCP Logging received the log. DateTime
ResponseCode HTTP response status code. Int32
Severity Log severity level (e.g., INFO, WARNING, ERROR). String
SourceFile Source file in the API server codebase where the log originated. String
SourceLine Line number in the source file. String
SourceSystem String
SrcIP Source IP address of the client that sent the request. String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The timestamp indicating when the log event was created or generated by the source system. DateTime
Type The name of the table String
URI Full URI of the API request to the Kubernetes API server. String
UserAgent The User-Agent string sent with the request. String

Schema changes #

Date Action
2026-01-02 Table added to tracking