---
title: "Google Pub/Sub HTTP REST API"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-destinations/google-pubsub/"
last_modified: "2026-08-05T15:08:09+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# Google Pub/Sub HTTP REST API

AxoSyslog can send data to [Google Cloud Pub/Sub](https://cloud.google.com/pubsub?hl=en) using its [HTTP REST API](https://cloud.google.com/pubsub/docs/reference/rest).

## Prerequisites

- AxoSyslog version 4.5.0 or later.
- Install the `axosyslog-scl` package on [Debian/Ubuntu](https://axoflow.com/docs/axosyslog-core/4.28/install/debian-ubuntu/index.md). On [RHEL and compatible distributions](https://axoflow.com/docs/axosyslog-core/4.28/install/rhel-fedora-almalinux/index.md), the SCL files are part of the `axosyslog` base package.

  Your configuration must also contain `@include "scl.conf"`, which the default configuration file already does. If the SCL files are missing, AxoSyslog fails to start with an [`unexpected LL_IDENTIFIER` error](https://axoflow.com/docs/axosyslog-core/4.28/chapter-troubleshooting-syslog-ng/unexpected-ll-identifier/index.md).

  ```shell
  @include "scl.conf"
  ```

  The `google-pubsub()` driver is a reusable configuration snippet (SCL). For details on using or writing such configuration snippets, see [Reusing configuration blocks](https://axoflow.com/docs/axosyslog-core/4.28/chapter-configuration-file/large-configs/config-blocks/index.md). You can find its source in [scl/google/google-pubsub.conf](https://github.com/axoflow/axosyslog/blob/main/scl/google/google-pubsub.conf) on GitHub.
- This feature requires a separate module. Install the `axosyslog-mod-http` package on [Debian/Ubuntu](https://axoflow.com/docs/axosyslog-core/4.28/install/debian-ubuntu/index.md), or the `axosyslog-http` package on [RHEL and compatible distributions](https://axoflow.com/docs/axosyslog-core/4.28/install/rhel-fedora-almalinux/index.md). If the module isn’t installed, AxoSyslog fails to start with an [`unexpected LL_IDENTIFIER` error](https://axoflow.com/docs/axosyslog-core/4.28/chapter-troubleshooting-syslog-ng/unexpected-ll-identifier/index.md).
- This feature requires a separate module. Install the `axosyslog-mod-cloud-auth` package on [Debian/Ubuntu](https://axoflow.com/docs/axosyslog-core/4.28/install/debian-ubuntu/index.md), or the `axosyslog-cloud-auth` package on [RHEL and compatible distributions](https://axoflow.com/docs/axosyslog-core/4.28/install/rhel-fedora-almalinux/index.md). If the module isn’t installed, AxoSyslog fails to start with an [`unexpected LL_IDENTIFIER` error](https://axoflow.com/docs/axosyslog-core/4.28/chapter-troubleshooting-syslog-ng/unexpected-ll-identifier/index.md).

- A [Google Pub/Sub subscription](https://cloud.google.com/pubsub?hl=en).
- An [IAM service account](https://cloud.google.com/iam/docs/service-account-overview) that AxoSyslog uses for authentication.
- A Google Cloud project that has the Pub/Sub API enabled.

For details, see the [Google Pub/Sub tutorial](https://cloud.google.com/pubsub/docs/building-pubsub-messaging-system#before_you_begin).

## Configuration

To configure AxoSyslog, you’ll need the name of the project and the topic where you want to send your data.

Minimal configuration:

```sh
@include "scl.conf"
# ...

destination d_pubsub {
  google-pubsub(
    project("syslog-ng-project")
    topic("syslog-ng-topic")
    auth(
      service-account(
        key("/path/to/service-account-key.json")
      )
    )
  );
};
```

## Options

The following options are specific to the `google-pubsub()` destination. But since this destination is based on the `http()` destination, you can use the [options of the `http()` destination](https://axoflow.com/docs/axosyslog-core/4.28/chapter-destinations/configuring-destinations-http-nonjava/reference-destination-http-nonjava/index.md) as well if needed.

> Note: The `google-pubsub()` destination automatically configures some of these `http()` destination options as required by the Google Pub/Sub API.

## attributes()

|  |  |
| --- | --- |
| Type: | string |
| Default: | `"--scope rfc5424,all-nv-pairs --exclude MESSAGE"` |

*Description:* A JSON object representing key-value pairs for the Pub/Sub Event, formatted as [AxoSyslog value-pairs](https://axoflow.com/docs/axosyslog-core/4.28/chapter-concepts/concepts-value-pairs/option-value-pairs/index.md). By default, the `google-pubsub()` destination sends the RFC5424 fields as attributes. If you want to send different fields, override the default template. By default, the message part is sent in the `data()` option.

## auth()

Options for cloud-related authentication. Currently only the [GCP Service Account authentication](https://cloud.google.com/iam/docs/service-account-overview) is supported.

Specify the JSON file storing the key to the service account like this:

```sh
auth(
    service-account(
      key("/path/to/service-account-key.json")
    )
  )
```

#### service-account()

Authenticate to a service account using Service Account Key-Based Authentication. This method works both inside and outside GCP It uses a [service account key](https://cloud.google.com/iam/docs/keys-create-delete) generated and downloaded through the GCP IAM & Admin console. The long-term service account key is used to generate short-term tokens for authentication (also called [self-signed JWT](https://google.aip.dev/auth/4111)).

##### audience()

|  |  |
| --- | --- |
| Type: | string |
| Default: |  |

> **Note:**
>
> - When using the `google-pubsub()` destination, the `audience()` option is set to `https://pubsub.googleapis.com/google.pubsub.v1.Publisher`. Don’t change it.
> - When using the `google-pubsub()-grpc` destination, you don’t need to set the `audience()` option because the underlying gRPC API recognizes it automatically.
> - You cannot use `audience()` and `scope()` together.

##### key()

|  |  |
| --- | --- |
| Type: | string (path) |
| Default: |  |

Path to the service account key.

##### scope()

|  |  |
| --- | --- |
| Type: | string |
| Default: |  |

Available in AxoSyslog version 4.15 and later.

URL for a scope claim for authentication [instead of audience](https://google.aip.dev/auth/4111#scope-vs-audience). For example:

```shell
  ...
  cloud-auth(
    gcp(
      service-account(
        key("/path/to/secret.json")
        scope("https://www.googleapis.com/auth/example-scope")
      )
    )
  )
```

> **Note:**
> You cannot use `audience()` and `scope()` together.

##### token-validity-duration()

|  |  |
| --- | --- |
| Type: | integer (seconds) |
| Default: | `3600` |

#### user-managed-service-account()

Available in AxoSyslog version 4.6 and later.

> **Note:**
> The `user-managed-service-account()` method is only available for VMs running within GCP.

Authenticate to a [user-managed service account](https://cloud.google.com/iam/docs/service-account-types#user-managed) of a GCP virtual machine using the VM Metadata Server Method. AxoSyslog interacts with the internal GCP metadata server, which provides an OAuth2 token for authentication. You can attach the [default service accounts](https://cloud.google.com/iam/docs/service-account-types#default) as well.

##### metadata-url()

|  |  |
| --- | --- |
| Type: | string |
| Default: | `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts` |

The URL of the metadata server. When specifying the port, use the `URL:port` format.

##### name()

|  |  |
| --- | --- |
| Type: | string |
| Default: | `default` |

Name of the service account to use.

## data()

|  |  |
| --- | --- |
| Type: | string/template |
| Default: | `"${MESSAGE}"` |

*Description:* The template to use as the data part of the Google Pub/Sub message.

## project()

|  |  |
| --- | --- |
| Type: | string |
| Default: | - |

*Description:* The ID of the Google Cloud project where AxoSyslog sends the data. The Pub/Sub API must be enabled for the project.

## topic()

|  |  |
| --- | --- |
| Type: | string |
| Default: | - |

*Description:* The name of the Google Pub/Sub topic where AxoSyslog sends the data.

## service_endpoint()

|  |  |
| --- | --- |
| Type: | string |
| Default: | `https://pubsub.googleapis.com` |

The service endpoint for the Pub/Sub API where AxoSyslog sends the data. For a list of locational endpoints, see the [official Pub/Sub APIs documentation](https://cloud.google.com/pubsub/docs/reference/service_apis_overview#list_of_locational_endpoints).

Last modified August 5, 2026: [Small fixes and deduplications (99cac43a)](https://github.com/axoflow/axosyslog-core-docs/commit/99cac43a517770299b97c7ed360eb87af9fef5ab)