{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/google-cloud-logging/json-schema/google-cloud-logging-settings-schema.json",
  "title": "Settings",
  "description": "Describes the settings associated with a project, folder, organization, or billing account.",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/google-cloud-logging-v2-api-openapi.yml#/components/schemas/Settings",
  "type": "object",
  "properties": {
    "loggingServiceAccountId": {
      "description": "Output only. The service account for the given resource container, such as project or folder. Log sinks use this service account as their writer_identity if no custom service account is provided in the request when calling the create sink method.",
      "type": "string",
      "readOnly": true
    },
    "storageLocation": {
      "description": "Optional. The storage location for the _Default and _Required log buckets of newly created projects and folders, unless the storage location is explicitly provided.Example value: europe-west1.Note: this setting does not affect the location of resources where a location is explicitly provided when created, such as custom log buckets.",
      "type": "string"
    },
    "disableDefaultSink": {
      "description": "Optional. If set to true, the _Default sink in newly created projects and folders will created in a disabled state. This can be used to automatically disable log storage if there is already an aggregated sink configured in the hierarchy. The _Default sink can be re-enabled manually if needed.",
      "type": "boolean"
    },
    "name": {
      "type": "string",
      "description": "Output only. The resource name of the settings.",
      "readOnly": true
    },
    "kmsKeyName": {
      "description": "Optional. The resource name for the configured Cloud KMS key.KMS key name format: \"projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING]/cryptoKeys/[KEY]\" For example:\"projects/my-project/locations/us-central1/keyRings/my-ring/cryptoKeys/my-key\"To enable CMEK, set this field to a valid kms_key_name for which the associated service account has the required roles/cloudkms.cryptoKeyEncrypterDecrypter role assigned for the key.The Cloud KMS key used by the Log Router can be updated by changing the kms_key_name to a new valid key name.To disable CMEK for the Log Router, set this field to an empty string.See Configure CMEK for Cloud Logging (https://docs.cloud.google.com/logging/docs/routing/managed-encryption) for more information.",
      "type": "string"
    },
    "defaultSinkConfig": {
      "$ref": "#/$defs/DefaultSinkConfig",
      "description": "Optional. Overrides the built-in configuration for _Default sink."
    },
    "kmsServiceAccountId": {
      "description": "Output only. The service account that will be used by the Log Router to access your Cloud KMS key.Before enabling CMEK, you must first assign the role roles/cloudkms.cryptoKeyEncrypterDecrypter to the service account that will be used to access your Cloud KMS key. Use GetSettings to obtain the service account ID.See Configure CMEK for Cloud Logging (https://docs.cloud.google.com/logging/docs/routing/managed-encryption) for more information.",
      "type": "string",
      "readOnly": true
    }
  },
  "$defs": {
    "DefaultSinkConfig": {
      "type": "object",
      "properties": {
        "mode": {
          "description": "Required. Determines the behavior to apply to the built-in _Default sink inclusion filter.Exclusions are always appended, as built-in _Default sinks have no exclusions.",
          "type": "string",
          "enum": [
            "FILTER_WRITE_MODE_UNSPECIFIED",
            "APPEND",
            "OVERWRITE"
          ]
        },
        "exclusions": {
          "type": "array",
          "description": "Optional. Specifies the set of exclusions to be added to the _Default sink in newly created resource containers.",
          "items": {
            "$ref": "#/$defs/LogExclusion"
          }
        },
        "filter": {
          "description": "Optional. An advanced logs filter (https://docs.cloud.google.com/logging/docs/view/building-queries#queries-by-expression). The only exported log entries are those that are in the resource owning the sink and that match the filter.For example:logName=\"projects/[PROJECT_ID]/logs/[LOG_ID]\" AND severity>=ERRORTo match all logs, don't add exclusions and use the following line as the value of filter:logName:*Cannot be empty or unset when the value of mode is OVERWRITE.",
          "type": "string"
        }
      },
      "description": "Describes the custom _Default sink configuration that is used to override the built-in _Default sink configuration in newly created resource containers, such as projects or folders."
    },
    "LogExclusion": {
      "type": "object",
      "properties": {
        "filter": {
          "description": "Required. An advanced logs filter (https://docs.cloud.google.com/logging/docs/view/building-queries#queries-by-expression) that matches the log entries to be excluded. By using the sample function (https://docs.cloud.google.com/logging/docs/view/logging-query-language#sample), you can exclude less than 100% of the matching log entries.For example, the following query matches 99% of low-severity log entries from Google Cloud Storage buckets:resource.type=gcs_bucket severity<ERROR sample(insertId, 0.99)",
          "type": "string"
        },
        "updateTime": {
          "type": "string",
          "description": "Output only. The last update timestamp of the exclusion.This field may not be present for older exclusions.",
          "format": "google-datetime",
          "readOnly": true
        },
        "disabled": {
          "type": "boolean",
          "description": "Optional. If set to True, then this exclusion is disabled and it does not exclude any log entries. You can update an exclusion to change the value of this field."
        },
        "name": {
          "type": "string",
          "description": "Optional. A client-assigned identifier, such as \"load-balancer-exclusion\". Identifiers are limited to 100 characters and can include only letters, digits, underscores, hyphens, and periods. First character has to be alphanumeric."
        },
        "createTime": {
          "format": "google-datetime",
          "type": "string",
          "readOnly": true,
          "description": "Output only. The creation timestamp of the exclusion.This field may not be present for older exclusions."
        },
        "description": {
          "description": "Optional. A description of this exclusion.",
          "type": "string"
        }
      },
      "description": "Specifies a set of log entries that are filtered out by a sink. If your Google Cloud resource receives a large volume of log entries, you can use exclusions to reduce your chargeable logs. Note that exclusions on organization-level and folder-level sinks don't apply to child resources. Note also that you cannot modify the _Required sink or exclude logs from it."
    }
  }
}