Writing logs to Google Stackdriver

Airflow can be configured to read and write task logs in Google Stackdriver Logging.

To enable this feature, airflow.cfg must be configured as in this example:

[logging]
# Airflow can store logs remotely in AWS S3, Google Cloud Storage or Elastic Search.
# Users must supply an Airflow connection id that provides access to the storage
# location. If remote_logging is set to true, see UPDATING.md for additional
# configuration requirements.
remote_logging = True
remote_base_log_folder = stackdriver://logs-name

All configuration options are in the [logging] section.

  1. By default Application Default Credentials are used to obtain credentials. You can also set google_key_path option in [logging] section, if you want to use your own service account.

  2. Make sure with those credentials, you can read/write to/from stackdriver.

  3. Install the google package, like so: pip install 'apache-airflow[google]'.

  4. Restart the Airflow webserver and scheduler, and trigger (or wait for) a new task execution.

  5. Verify that logs are showing up for newly executed tasks in the bucket you have defined.

  6. Verify that the Google Cloud Storage viewer is working in the UI. With Stackdriver you should see the logs pulled in the real time

The value of field remote_logging must always be set to True for this feature to work. Turning this option off will result in data not being sent to Stackdriver.

The remote_base_log_folder option contains the URL that specifies the type of handler to be used. For integration with Stackdriver, this option should start with stackdriver://. The path section of the URL specifies the name of the log e.g. stackdriver://airflow-tasks writes logs under the name airflow-tasks.

You can set google_key_path option in the [logging] section to specify the path to the service account key file. If omitted, authentication and authorization based on the Application Default Credentials will be used. Make sure that with those credentials, you can read and write the logs.

Note

The above credentials are NOT the same credentials that you configure with google_cloud_default Connection. They should usually be different than the google_cloud_default ones, having only capability to read and write the logs. For security reasons, limiting the access of the log reader to only allow log reading and writing is an important security measure.

By using the logging_config_class option you can get advanced features of this handler. Details are available in the handler’s documentation - StackdriverTaskHandler.

Was this entry helpful?