TL;DR Short answer: Google Workspace admin reports and audit logs, covering logins, admin actions, Drive, Meet, mobile devices and OAuth tokens, are only kept by Google for a limited time, so Workspace reports ETL tools archive them in a warehouse or SIEM. Google's own BigQuery export is the most complete route on eligible editions, Airbyte's Admin Reports connector works on any edition through the Reports API, and Cloud Logging, Splunk, Microsoft Sentinel and Elastic cover security monitoring. Eight Workspace reports ETL tools compared:
Airbyte Workspace BigQuery export Google Cloud Logging Custom code with the Reports API GAM Splunk Microsoft Sentinel Elastic The Workspace constraint: Google keeps most audit log events for about six months and the Reports API returns roughly the last 180 days, so if you need longer history for audits or investigations, start archiving now, because older events cannot be recovered later. Workspace reports ETL tools extract activity and usage data from Google Workspace, through the Admin SDK Reports API or Google's own exports, and load it into a warehouse or security platform. Security teams use the data to investigate suspicious logins and data sharing, compliance teams to keep audit trails beyond Google's retention, and IT teams to measure adoption and licence use. For directory data to join with, see our guide to Google Directory ETL tools .
The Reports API and the BigQuery export expose two kinds of data:
Activity logs: per-event audit records for admin console actions, logins, Drive, Gmail, Calendar, Groups, Meet, mobile devices, OAuth token grants and SAML, each with the actor, time, IP address and event details.Usage reports: daily aggregate metrics for users and the whole domain, such as emails sent, Drive files created, Meet minutes and storage used.Customer-level usage: organisation-wide totals for adoption and licence planning.Entity usage: metrics reported for individual entities rather than users, where Google provides them.Activity logs answer security and audit questions, while usage reports answer adoption and licensing questions, so many teams load both.
How long does Google Workspace keep audit logs? Google retains Workspace report data for a limited period, which is the main reason these pipelines exist:
Audit log events: most activity log events, such as admin, login and Drive events, are kept for about six months.Reports API window: the API generally returns activity from roughly the last 180 days.Usage reports: aggregate usage metrics are kept for longer than individual events, but still not indefinitely.Late updates: in the BigQuery export, a row for a given date can be updated for up to 30 days after that date.What this means: for audits, legal holds or long investigations, archive events continuously into storage you control, with your own retention policy.For broader governance practices, see our guide to data governance tools .
How do the Workspace reports ETL tools compare? Tool Approach Editions Best for Cost Airbyte Reports API connector, full refresh Any edition with Reports API access Workspace logs next to other sources in any warehouse Free self-hosted Core; paid Cloud plans BigQuery export Native daily export Enterprise, Education, Frontline and Enterprise Essentials Plus Complete activity and usage data in BigQuery Included; BigQuery charges apply Cloud Logging Audit log sharing with Google Cloud Eligible editions Routing logs to Google Cloud sinks Cloud Logging charges apply Reports API Custom code Any edition with Reports API access Exact control over events Free, engineering time GAM Command-line tool Any edition Admin scripting and ad hoc exports Free, open source Splunk SIEM add-on Any edition with API access Security teams on Splunk Splunk licence Microsoft Sentinel SIEM connector Any edition with API access Security teams on Azure Sentinel ingestion pricing Elastic SIEM integration Any edition with API access Security teams on Elastic Elastic plans
Which Workspace reports ETL tools should you consider? Eight Workspace reports ETL tools, from Google's own exports to SIEM integrations:
1. Airbyte Airbyte is the open-source data connectivity platform for AI and analytics, and among Workspace reports ETL tools it works on any Workspace edition with Reports API access. Its Google Workspace Admin Reports source syncs the admin, drive, logins, mobile, OAuth tokens and Meet activity streams, with a lookback setting that reaches back up to 180 days. For other ELT options, see our guide to ELT tools .
It authenticates with a service account that has domain-wide delegation and two read-only scopes, and it backs off when it hits Reports API quotas. Workspace activity then lands next to HR, identity and security data from 700+ connectors. Airbyte runs in Airbyte Cloud, in your own environment with Airbyte Flex, or self-hosted with Airbyte Core, which matters for sensitive employee data.
Key features Activity streams: admin, drive, logins, mobile, OAuth tokens and Meet.Lookback: sync up to 180 days of history on the first run.Read-only scopes: only audit and usage read-only scopes are needed.Any destination: BigQuery, Snowflake, Databricks, Redshift, S3 and more.Best for: teams archiving Workspace activity next to identity and security data outside BigQuery.
Pricing: self-hosted Airbyte Core is free; Airbyte Cloud is billed on volume, and Pro and Airbyte Flex on capacity.
Pros Cons Works on any edition with Reports API access Full refresh only Six activity streams in one source Usage reports not included Cloud, Flex or self-hosted Core Requires super admin setup for delegation
2. Workspace BigQuery export On eligible editions, Google Workspace can export logs and usage reports directly to BigQuery, creating daily activity and usage tables in one dataset. It covers more applications than the API-based connectors, including Gmail, Calendar, Groups and SAML, and is the most complete route among Workspace reports ETL tools. For BigQuery-side tooling, see our guide to BigQuery ETL tools .
Key features Activity tables: per-event logs for admin, Drive, Gmail, Calendar, login, Groups, OAuth and SAML.Usage tables: aggregate usage metrics for users and the domain.Daily export: tables update approximately daily.Directory joins: combine with directory data for richer investigations.Best for: organisations on eligible editions that use BigQuery.
Pricing: included with eligible editions; BigQuery storage and query charges apply.
Pros Cons Most complete coverage Only on eligible editions Managed by Google BigQuery only Activity and usage together Rows can change for up to 30 days
3. Google Cloud Logging Among Workspace reports ETL tools for Google Cloud users, log sharing stands out: Google Workspace can share audit logs with Google Cloud, where they appear in Cloud Logging and can be routed with log sinks to BigQuery, Cloud Storage, Pub/Sub or third-party security tools. It suits teams already centralising cloud logs in Google Cloud.
Key features Log sharing: Workspace audit logs appear in Cloud Logging.Log sinks: route to BigQuery, Cloud Storage or Pub/Sub.Log Analytics: query logs with SQL in Cloud Logging.Retention control: set your own retention on log buckets.Best for: teams centralising Workspace logs with Google Cloud logs.
Pricing: Cloud Logging ingestion and storage charges apply.
Pros Cons Fits Google Cloud logging setups Only on eligible editions Route logs with sinks Cloud Logging charges apply Streams to Pub/Sub for SIEMs Configuration spans two consoles
4. Custom code with the Reports API Behind most Workspace reports ETL tools, the Admin SDK Reports API returns activity by application and usage reports by date, with filters for users, events and parameters. Google's client libraries handle authentication with a delegated service account, and push notifications can watch for new activity. For other API pipelines, see our guide to REST API ETL tools .
Key features Activities: list events by application, user, time range and event name.Usage reports: customer, user and entity usage by date.Watch channels: receive notifications when new activity arrives.Client libraries: Python, Java, Go and other languages.Best for: engineering teams with specific audit requirements.
Pricing: free with your Workspace subscription; you pay for engineering and infrastructure.
Pros Cons Exact control over applications and events You own scheduling, state and retries Push notifications for new activity Quota limits to manage Official client libraries Ongoing maintenance
5. GAM GAM is one of the simplest Workspace reports ETL tools for admins: a widely used open-source command-line tool for Google Workspace administration that can pull activity and usage reports and write them to CSV or Google Sheets. It suits admins who want scripted, ad hoc exports without building a pipeline.
Key features Report commands: pull activity and usage reports by application.CSV and Sheets output: write results to files or Google Sheets.Scripting: schedule exports with cron or a CI runner.Admin tasks: the same tool manages users, groups and devices.Best for: Workspace admins who need scripted exports.
Pricing: free and open source.
Pros Cons Quick ad hoc reports Not a continuous pipeline Scriptable for scheduled jobs Command-line skills required Free and open source Large exports can be slow
6. Splunk Among Workspace reports ETL tools for security teams, Splunk's Google Workspace add-on collects audit logs through Google's APIs into Splunk, where analysts correlate them with other identity and endpoint data and build alerts. It is the natural route for organisations already running Splunk. For other identity sources, see our guide to Okta ETL tools .
Key features Audit log collection: login, admin, Drive and other activity.Correlation: combine with identity, endpoint and network logs.Alerts: detect suspicious logins and sharing.Dashboards: security and compliance views.Best for: security teams already using Splunk.
Pricing: covered by your Splunk licence, with costs driven by ingest volume.
Pros Cons Correlation with other security data Splunk licence costs Alerting and dashboards Ingest volume drives cost Mature security content Not an analytics warehouse
7. Microsoft Sentinel Microsoft Sentinel, Microsoft's cloud SIEM, is one of the Workspace reports ETL tools for mixed estates: it includes a data connector for Google Workspace activity, so security teams running Microsoft and Google tools side by side can monitor both in one place, with analytics rules and workbooks for Workspace events.
Key features Workspace connector: ingest Workspace activity logs.Analytics rules: detect threats across Microsoft and Google data.Workbooks: visualise Workspace activity.Automation: respond with playbooks.Best for: security teams standardised on Microsoft Sentinel.
Pricing: billed on data ingested into Sentinel.
Pros Cons One SIEM for Microsoft and Google Requires Azure and Sentinel Analytics rules and workbooks Ingestion-based pricing Fits Microsoft security stacks Connector setup spans two clouds
8. Elastic Elastic's Google Workspace integration ships audit logs into Elasticsearch, where they can be searched, visualised in Kibana and used in Elastic Security detection rules. It suits teams running Elastic for observability or security. For other audit trails, see our guide to AWS CloudTrail ETL tools .
Key features Integration: collect Workspace audit logs with Elastic Agent.Search: query events quickly across long periods.Dashboards: prebuilt Kibana views for Workspace activity.Detections: security rules for suspicious behaviour.Best for: teams running Elastic for security or observability.
Pricing: Elastic Cloud plans or self-managed infrastructure costs.
Pros Cons Fast search across logs Elastic cluster to run or pay for Kibana dashboards Storage grows with log volume Detection rules in Elastic Security Not a warehouse for usage analytics
How do you send Google Workspace logs to a SIEM? Security teams usually choose one of three paths:
Direct SIEM integrations: Splunk, Microsoft Sentinel and Elastic pull Workspace logs through Google's APIs with their own connectors.Google Cloud routing: share Workspace logs with Google Cloud and route them through Pub/Sub to a SIEM that reads from it.Warehouse first: load logs into a warehouse with an ETL tool, then query or forward them, which keeps a long-term archive alongside the SIEM.Retention planning: keep SIEM retention for detection and a cheaper warehouse or storage archive for long-term audits.For identity data that often joins Workspace logs in a SIEM, see our guide to Auth0 ETL tools .
What should you check before syncing Workspace reports? Whichever Workspace reports ETL tools you choose, check these first:
Edition: confirm whether your Workspace edition supports the BigQuery export or log sharing with Google Cloud.Delegation: domain-wide delegation must be granted by a super administrator, with only the read-only report scopes.Retention: start archiving before you need history, since events older than Google's retention cannot be recovered.Personal data: activity logs identify employees and their behaviour, so restrict access and follow your privacy and works council requirements.Late updates: re-read recent days, because events and usage can be updated after their date.Quotas: the Reports API has request quotas, so schedule syncs and back off on errors.How do you start pulling Workspace reports with Airbyte? If you decide to test Airbyte, setting up a Workspace reports pipeline takes three steps.
Step 1: Create a delegated service account A super administrator creates a service account, grants it domain-wide delegation with the admin.reports.audit.readonly and admin.reports.usage.readonly scopes, and downloads its JSON key.
Step 2: Set up the source In Airbyte, open Sources, choose New source, select Google Workspace Admin Reports and enter the JSON key, the admin email address and a lookback period of up to 180 days.
Step 3: Set up a destination and connection Pick a destination, ideally a dataset with restricted access, and schedule daily syncs. The process is the same whether you start with Airbyte Cloud or run self-hosted Airbyte Core .
Which Workspace reports ETL tool should you choose? Choosing between Workspace reports ETL tools starts with your edition and your security stack. On eligible editions with BigQuery, use Google's native export for the most complete data, or Cloud Logging to route logs elsewhere. On any edition, or for warehouses other than BigQuery, use Airbyte or the Reports API. Security teams on Splunk, Sentinel or Elastic should use those integrations, often alongside a warehouse archive, and GAM suits ad hoc admin exports. For more Google Cloud options, see our guide to GCP ETL tools .
Archive Google Workspace activity with Airbyte Sync Google Workspace admin, login, Drive, Meet and OAuth activity into a warehouse you control, next to identity and security data, in Airbyte Cloud, in your own environment with Airbyte Flex, or self-hosted with Airbyte Core.
Try Airbyte Cloud free for 14 days or talk to our team .
Frequently Asked Questions (FAQs) 1. What are the best Workspace reports ETL tools? Google's BigQuery export is the most complete option on eligible editions, and Airbyte's Admin Reports connector works on any edition with Reports API access. Cloud Logging routes logs in Google Cloud, the Reports API and GAM support custom exports, and Splunk, Microsoft Sentinel and Elastic cover SIEM use.
2. Does Airbyte support Google Workspace Admin Reports? Yes. Airbyte's source syncs admin, drive, logins, mobile, OAuth token and Meet activity with full refresh syncs, using a service account with domain-wide delegation and read-only scopes.
3. How long does Google keep Workspace audit logs? Most Workspace audit log events are kept for about six months, and the Reports API returns roughly the last 180 days, so longer history needs your own archive.
4. Which Workspace editions support the BigQuery export? The export is available on Enterprise, Education, Frontline and Enterprise Essentials Plus editions, among others; check Google's edition comparison for your plan.
5. Is Workspace activity data personal data? Yes. It identifies employees and what they did, so restrict access, define retention and follow your privacy obligations.
Suggested reads Okta ETL Tools
Google Directory ETL Tools
AWS CloudTrail ETL Tools
Data Governance Tools
