How to Collect Only Google Workspace Login Logs Using the Connector (Cost Optimization)

Question

How to Collect Only Google Workspace Login Logs Using the Connector (Cost Optimization)

mara7 226

Hello Team,

We are trying to collect Google account login logs in Microsoft Sentinel using the Google Workspace Activities (via Codeless Connector Framework) (Preview) connector.

From what we have observed, this connector seems to collect all Google activity logs. However, we only need login logs, and we want to exclude other events to reduce costs.

Questions:

Is there a way to filter and collect only login logs using this connector?
Can we use a Data Collection Rule (DCR) to collect only login logs and reduce ingestion/storage costs?
- If DCR is not supported, what alternative methods are available?
  - If DCR is supported, how can we connect and configure it with this connector?

Thank you.

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Siva shunmugam Nadessin 3,435 Microsoft External Staff Moderator

Hello mara7

Thank you for reaching out to the Microsoft Q&A forum.

Here's what you can consider:

Filtering with Data Collection Rules (DCR):

Currently, the Google Workspace Activities connector captures all activity logs, and there is no native filtering option in the connector to select only login logs. However, you can use Data Collection Rules (DCR) to help manage the ingestion of logs and potentially reduce costs.

By creating a DCR, you can set parameters that target the specific data you want to collect. If supported, this would allow you to filter out non-login related logs and collect only what you truly need.

Setting up the DCR:

First, you'd want to navigate to your Azure Monitor in the Azure portal. From there, you’ll create a new DCR by following these steps:

Go to Data Collection Rules.
Select Add to create a new rule.
Specify the name, resource group, and subscription.
Under Add data source, choose the logs you want to collect (in this case, the Google Workspace logs).
Apply necessary filters to focus on login events.
Save your DCR and monitor your ingestion rates to ensure it meets your needs.

Alternative Methods:
- If DCR is not supported with the Google Workspace connector, consider leveraging Log Analytics queries after ingestion to separate out login logs for reporting and analysis, though it may not directly reduce costs.
- Another potential workaround is to periodically audit and clear out unnecessary logs or set up Azure Policy alerts for data usage.

Follow-Up Questions:

To provide more tailored assistance, here are a few follow-up questions:

Have you already set up the Google Workspace connector, or is that still pending?
Are you currently using any specific data filtering techniques within your DCRs?
What specific types of login logs are you looking to collect (e.g., successful logins, failed logins)?
Do you have any log retention policies defined already that might impact your collection?

Hope this helps you move forward! Feel free to drop more questions if needed!

References:

mara7 226 Reputation points

2025-12-11T01:46:30.4+00:00

Hello,

If I apply filtering with DCR, will only the filtered data be stored in Log Analytics and incur costs? My understanding is that the Google Workspace connector sends logs directly to Log Analytics, so I’m not sure if there’s any cost-saving benefit. Is it possible to filter before the logs are stored in Log Analytics?

For reference, the Google Workspace connector has not been set up yet.
Siva shunmugam Nadessin 3,435 Reputation points Microsoft External Staff Moderator

2025-12-11T02:23:22.24+00:00
Hello mara7,

Below is our investigation, You’re asking two key things:

If we filter using a Data Collection Rule (DCR), do we only pay for storage and collection costs of the filtered data?

Is it possible to filter before logs are stored in Log Analytics, especially for Google Workspace connector logs?

For question “How DCR Filtering Impacts Cost” below is the answer.

Yes, filtering with DCR reduces ingestion costs because Azure Monitor charges at the point of ingestion. If you filter out unnecessary data before it enters the Log Analytics workspace, you avoid paying for that discarded data.

DCR transformations happen in the ingestion pipeline, not after storage. This means only the filtered records are ingested and billed.

Cost drivers:

Data ingestion volume (GB per month)

Retention period So reducing ingestion volume via DCR filtering directly lowers costs.

For question “Can Logs Be Filtered Before Storage” below is the answer.

Yes, for sources that support DCR or ingestion-time transformations.

DCR lets you apply KQL-based filters and transformations before data is written to Log Analytics.

For workflows that don’t natively support DCR, you can use a workspace transformation DCR to filter data at ingestion time. [v4.hkg1.meaqua.org]

Example: Azure Firewall now supports ingestion-time transformations, allowing selective logging before ingestion.

For question Google Workspace Connector Status below is the answer.

The Google Workspace Activities connector currently collects all activity logs and does not have native filtering.

You can try applying a DCR if supported, but as of now, filtering at the connector level isn’t available. If DCR integration works, you could target only login events and reduce costs.

If DCR isn’t supported for this connector, the only alternative is post-ingestion filtering (queries), which doesn’t save ingestion/storage costs.

Why It Feels Like No Cost Savings

· Your observation is correct: if logs are sent directly to Log Analytics without a DCR or ingestion-time transformation, all data is ingested and billed, even if you later query only a subset. The cost-saving effect only applies when filtering happens before ingestion.

Summary

Filtering via DCR before ingestion = pay only for filtered data.

Google Workspace connector is still on hold and lacks native filtering; DCR may not apply yet.

If filtering isn’t possible pre-ingestion, there’s no cost benefit—queries after ingestion don’t reduce charges.
mara7 226 Reputation points

2025-12-11T03:33:47.88+00:00

I understand that, as of now, it’s not possible to use the Google Workspace connector itself for cost-saving filtering.
Thank you.

Share via

How to Collect Only Google Workspace Login Logs Using the Connector (Cost Optimization)

0 additional answers

Your answer