diff --git a/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/FieldUsageCountsMapper.java b/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/FieldUsageCountsMapper.java new file mode 100644 index 0000000000..3bf84d21a3 --- /dev/null +++ b/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/FieldUsageCountsMapper.java @@ -0,0 +1,24 @@ +package com.linkedin.datahub.graphql.types.usage; + +import com.linkedin.datahub.graphql.generated.FieldUsageCounts; +import com.linkedin.datahub.graphql.types.mappers.ModelMapper; +import javax.annotation.Nonnull; + + +public class FieldUsageCountsMapper implements ModelMapper { + + public static final FieldUsageCountsMapper INSTANCE = new FieldUsageCountsMapper(); + + public static FieldUsageCounts map(@Nonnull final com.linkedin.usage.FieldUsageCounts usageCounts) { + return INSTANCE.apply(usageCounts); + } + + @Override + public FieldUsageCounts apply(@Nonnull final com.linkedin.usage.FieldUsageCounts usageCounts) { + FieldUsageCounts result = new FieldUsageCounts(); + result.setCount(usageCounts.getCount()); + result.setFieldName(usageCounts.getFieldName()); + + return result; + } +} diff --git a/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/UsageAggregationMetricsMapper.java b/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/UsageAggregationMetricsMapper.java index c23a33d0c0..697b15d57e 100644 --- a/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/UsageAggregationMetricsMapper.java +++ b/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/UsageAggregationMetricsMapper.java @@ -21,6 +21,10 @@ public class UsageAggregationMetricsMapper implements result.setTotalSqlQueries(usageAggregationMetrics.getTotalSqlQueries()); result.setUniqueUserCount(usageAggregationMetrics.getUniqueUserCount()); result.setTopSqlQueries(usageAggregationMetrics.getTopSqlQueries()); + if (usageAggregationMetrics.hasFields()) { + result.setFields( + usageAggregationMetrics.getFields().stream().map(FieldUsageCountsMapper::map).collect(Collectors.toList())); + } if (usageAggregationMetrics.hasUsers()) { result.setUsers(usageAggregationMetrics.getUsers() .stream() diff --git a/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/UsageQueryResultAggregationMapper.java b/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/UsageQueryResultAggregationMapper.java index d7f3f5c5ac..ba3b86b72a 100644 --- a/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/UsageQueryResultAggregationMapper.java +++ b/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/types/usage/UsageQueryResultAggregationMapper.java @@ -20,6 +20,10 @@ public class UsageQueryResultAggregationMapper implements UsageQueryResultAggregations result = new UsageQueryResultAggregations(); result.setTotalSqlQueries(pdlUsageResultAggregations.getTotalSqlQueries()); result.setUniqueUserCount(pdlUsageResultAggregations.getUniqueUserCount()); + if (pdlUsageResultAggregations.hasFields()) { + result.setFields( + pdlUsageResultAggregations.getFields().stream().map(FieldUsageCountsMapper::map).collect(Collectors.toList())); + } if (pdlUsageResultAggregations.hasUsers()) { result.setUsers(pdlUsageResultAggregations.getUsers() .stream() diff --git a/datahub-graphql-core/src/main/resources/gms.graphql b/datahub-graphql-core/src/main/resources/gms.graphql index f320bc9212..04b61cad51 100644 --- a/datahub-graphql-core/src/main/resources/gms.graphql +++ b/datahub-graphql-core/src/main/resources/gms.graphql @@ -2618,6 +2618,7 @@ type UsageQueryResult { type UsageQueryResultAggregations { uniqueUserCount: Int users: [UserUsageCounts] + fields: [FieldUsageCounts] totalSqlQueries: Int } @@ -2626,6 +2627,7 @@ type UsageAggregationMetrics { users: [UserUsageCounts] totalSqlQueries: Int topSqlQueries: [String] + fields: [FieldUsageCounts] } type UsageAggregation { @@ -2635,6 +2637,11 @@ type UsageAggregation { metrics: UsageAggregationMetrics } +type FieldUsageCounts { + fieldName: String + count: Int +} + enum WindowDuration { DAY WEEK diff --git a/datahub-web-react/src/app/entity/dataset/profile/DatasetProfile.tsx b/datahub-web-react/src/app/entity/dataset/profile/DatasetProfile.tsx index 403a563df6..ea5d9cbb31 100644 --- a/datahub-web-react/src/app/entity/dataset/profile/DatasetProfile.tsx +++ b/datahub-web-react/src/app/entity/dataset/profile/DatasetProfile.tsx @@ -82,6 +82,7 @@ export const DatasetProfile = ({ urn }: { urn: string }): JSX.Element => { { analytics.event({ diff --git a/datahub-web-react/src/app/entity/dataset/profile/QueriesTab.tsx b/datahub-web-react/src/app/entity/dataset/profile/QueriesTab.tsx index 743cb4bf41..6c7c601b5a 100644 --- a/datahub-web-react/src/app/entity/dataset/profile/QueriesTab.tsx +++ b/datahub-web-react/src/app/entity/dataset/profile/QueriesTab.tsx @@ -37,7 +37,6 @@ function getTopNQueries(responseSize: number, buckets?: Maybe[ } export default function QueriesTab({ dataset }: Props) { - console.log(dataset.usageStats); const topQueries = getTopNQueries(5, dataset.usageStats?.buckets); if (topQueries.length === 0) { diff --git a/datahub-web-react/src/app/entity/dataset/profile/UsageFacepile.tsx b/datahub-web-react/src/app/entity/dataset/profile/UsageFacepile.tsx index 745a91e7f9..02f9951cbb 100644 --- a/datahub-web-react/src/app/entity/dataset/profile/UsageFacepile.tsx +++ b/datahub-web-react/src/app/entity/dataset/profile/UsageFacepile.tsx @@ -1,5 +1,5 @@ -import React from 'react'; -import { Avatar } from 'antd'; +import React, { useMemo } from 'react'; +import { Avatar, Tooltip } from 'antd'; import { UserUsageCounts } from '../../../../types.generated'; export type Props = { @@ -7,10 +7,14 @@ export type Props = { }; export default function UsageFacepile({ users }: Props) { + const sortedUsers = useMemo(() => users?.slice().sort((a, b) => (b?.count || 0) - (a?.count || 0)), [users]); + return ( - - {users?.map((user) => ( - {user?.userEmail?.charAt(0).toUpperCase()} + + {sortedUsers?.map((user) => ( + + {user?.userEmail?.charAt(0).toUpperCase()} + ))} ); diff --git a/datahub-web-react/src/app/entity/dataset/profile/schema/Schema.tsx b/datahub-web-react/src/app/entity/dataset/profile/schema/Schema.tsx index 6bd21f28e0..e86c5b9247 100644 --- a/datahub-web-react/src/app/entity/dataset/profile/schema/Schema.tsx +++ b/datahub-web-react/src/app/entity/dataset/profile/schema/Schema.tsx @@ -1,9 +1,12 @@ -import React, { useState, useEffect } from 'react'; +import React, { useState, useEffect, useMemo } from 'react'; +import { geekblue } from '@ant-design/colors'; -import { Button, Table, Typography } from 'antd'; +import { Button, Table, Tooltip, Typography } from 'antd'; import { AlignType } from 'rc-table/lib/interface'; import styled from 'styled-components'; import { FetchResult } from '@apollo/client'; +import { ColumnsType } from 'antd/lib/table'; + import TypeIcon from './TypeIcon'; import { Schema, @@ -17,6 +20,7 @@ import { EditableSchemaFieldInfoUpdate, EntityType, GlossaryTerms, + UsageQueryResult, } from '../../../../../types.generated'; import TagTermGroup from '../../../../shared/tags/TagTermGroup'; import { UpdateDatasetMutation } from '../../../../../graphql/dataset.generated'; @@ -38,8 +42,21 @@ const LighterText = styled(Typography.Text)` color: rgba(0, 0, 0, 0.45); `; +const UsageBar = styled.div<{ width: number }>` + width: ${(props) => props.width}px; + height: 10px; + background-color: ${geekblue[3]}; + border-radius: 2px; +`; + +const UsageBarContainer = styled.div` + width: 100%; + height: 100%; +`; + export type Props = { urn: string; + usageStats?: UsageQueryResult | null; schema?: Schema | null; editableSchemaMetadata?: EditableSchemaMetadata | null; updateEditableSchema: ( @@ -109,10 +126,17 @@ function convertEditableSchemaMetadataForUpdate( }; } -export default function SchemaView({ urn, schema, editableSchemaMetadata, updateEditableSchema }: Props) { +const USAGE_BAR_MAX_WIDTH = 50; + +export default function SchemaView({ urn, schema, editableSchemaMetadata, updateEditableSchema, usageStats }: Props) { const [tagHoveredIndex, setTagHoveredIndex] = useState(undefined); const [showRaw, setShowRaw] = useState(false); const [rows, setRows] = useState>([]); + const hasUsageStats = useMemo(() => (usageStats?.aggregations?.fields?.length || 0) > 0, [usageStats]); + const maxFieldUsageCount = useMemo( + () => Math.max(...(usageStats?.aggregations?.fields?.map((field) => field?.count || 0) || [])), + [usageStats], + ); useEffect(() => { const fields = [...(schema?.fields || [])] as Array; @@ -229,6 +253,24 @@ export default function SchemaView({ urn, schema, editableSchemaMetadata, update ); }; + const usageStatsRenderer = (fieldPath: string) => { + const relevantUsageStats = usageStats?.aggregations?.fields?.find( + (fieldStats) => fieldStats?.fieldName === fieldPath, + ); + + if (!relevantUsageStats) { + return null; + } + + return ( + + + + + + ); + }; + const descriptionColumn = { title: 'Description', dataIndex: 'description', @@ -253,6 +295,20 @@ export default function SchemaView({ urn, schema, editableSchemaMetadata, update }), }; + const usageColumn = { + width: 50, + title: 'Usage', + dataIndex: 'fieldPath', + key: 'usage', + render: usageStatsRenderer, + }; + + let allColumns: ColumnsType = [...defaultColumns, descriptionColumn, tagAndTermColumn]; + + if (hasUsageStats) { + allColumns = [...allColumns, usageColumn]; + } + const getRawSchema = (schemaValue) => { try { return JSON.stringify(JSON.parse(schemaValue), null, 2); @@ -280,7 +336,7 @@ export default function SchemaView({ urn, schema, editableSchemaMetadata, update ) : ( rows.length > 0 && ( { } } + // Compute aggregations for field usage counts. + { + Map fieldAgg = new HashMap<>(); + buckets.forEach((bucket) -> { + Optional.ofNullable(bucket.getMetrics().getFields()).ifPresent(fieldUsageCounts -> { + fieldUsageCounts.forEach((fieldCount -> { + String key = fieldCount.getFieldName(); + int count = fieldAgg.getOrDefault(key, 0); + count += fieldCount.getCount(); + fieldAgg.put(key, count); + })); + }); + }); + + if (!fieldAgg.isEmpty()) { + FieldUsageCountsArray fields = new FieldUsageCountsArray(); + fields.addAll(fieldAgg.entrySet().stream().map((mapping) -> new FieldUsageCounts() + .setFieldName(mapping.getKey()) + .setCount(mapping.getValue())).collect(Collectors.toList())); + aggregations.setFields(fields); + } + } + return new UsageQueryResult() .setBuckets(buckets) .setAggregations(aggregations); diff --git a/metadata-ingestion/README.md b/metadata-ingestion/README.md index 3f8f1b6e4c..dd5415bcd7 100644 --- a/metadata-ingestion/README.md +++ b/metadata-ingestion/README.md @@ -31,32 +31,34 @@ If you run into an error, try checking the [_common setup issues_](./developing. We use a plugin architecture so that you can install only the dependencies you actually need. -| Plugin Name | Install Command | Provides | -| ------------- | ---------------------------------------------------------- | ----------------------------------- | -| file | _included by default_ | File source and sink | -| console | _included by default_ | Console sink | -| athena | `pip install 'acryl-datahub[athena]'` | AWS Athena source | -| bigquery | `pip install 'acryl-datahub[bigquery]'` | BigQuery source | -| feast | `pip install 'acryl-datahub[feast]'` | Feast source | -| glue | `pip install 'acryl-datahub[glue]'` | AWS Glue source | -| hive | `pip install 'acryl-datahub[hive]'` | Hive source | -| mssql | `pip install 'acryl-datahub[mssql]'` | SQL Server source | -| mysql | `pip install 'acryl-datahub[mysql]'` | MySQL source | -| oracle | `pip install 'acryl-datahub[oracle]'` | Oracle source | -| postgres | `pip install 'acryl-datahub[postgres]'` | Postgres source | -| redshift | `pip install 'acryl-datahub[redshift]'` | Redshift source | -| sqlalchemy | `pip install 'acryl-datahub[sqlalchemy]'` | Generic SQLAlchemy source | -| snowflake | `pip install 'acryl-datahub[snowflake]'` | Snowflake source | -| superset | `pip install 'acryl-datahub[superset]'` | Superset source | -| mongodb | `pip install 'acryl-datahub[mongodb]'` | MongoDB source | -| ldap | `pip install 'acryl-datahub[ldap]'` ([extra requirements]) | LDAP source | -| looker | `pip install 'acryl-datahub[looker]'` | Looker source | -| lookml | `pip install 'acryl-datahub[lookml]'` | LookML source, requires Python 3.7+ | -| kafka | `pip install 'acryl-datahub[kafka]'` | Kafka source | -| druid | `pip install 'acryl-datahub[druid]'` | Druid Source | -| dbt | _no additional dependencies_ | dbt source | -| datahub-rest | `pip install 'acryl-datahub[datahub-rest]'` | DataHub sink over REST API | -| datahub-kafka | `pip install 'acryl-datahub[datahub-kafka]'` | DataHub sink over Kafka | +| Plugin Name | Install Command | Provides | +| --------------- | ---------------------------------------------------------- | ----------------------------------- | +| file | _included by default_ | File source and sink | +| console | _included by default_ | Console sink | +| athena | `pip install 'acryl-datahub[athena]'` | AWS Athena source | +| bigquery | `pip install 'acryl-datahub[bigquery]'` | BigQuery source | +| bigquery-usage | `pip install 'acryl-datahub[bigquery-usage]'` | BigQuery usage statistics source | +| feast | `pip install 'acryl-datahub[feast]'` | Feast source | +| glue | `pip install 'acryl-datahub[glue]'` | AWS Glue source | +| hive | `pip install 'acryl-datahub[hive]'` | Hive source | +| mssql | `pip install 'acryl-datahub[mssql]'` | SQL Server source | +| mysql | `pip install 'acryl-datahub[mysql]'` | MySQL source | +| oracle | `pip install 'acryl-datahub[oracle]'` | Oracle source | +| postgres | `pip install 'acryl-datahub[postgres]'` | Postgres source | +| redshift | `pip install 'acryl-datahub[redshift]'` | Redshift source | +| sqlalchemy | `pip install 'acryl-datahub[sqlalchemy]'` | Generic SQLAlchemy source | +| snowflake | `pip install 'acryl-datahub[snowflake]'` | Snowflake source | +| snowflake-usage | `pip install 'acryl-datahub[snowflake-usage]'` | Snowflake usage statistics source | +| superset | `pip install 'acryl-datahub[superset]'` | Superset source | +| mongodb | `pip install 'acryl-datahub[mongodb]'` | MongoDB source | +| ldap | `pip install 'acryl-datahub[ldap]'` ([extra requirements]) | LDAP source | +| looker | `pip install 'acryl-datahub[looker]'` | Looker source | +| lookml | `pip install 'acryl-datahub[lookml]'` | LookML source, requires Python 3.7+ | +| kafka | `pip install 'acryl-datahub[kafka]'` | Kafka source | +| druid | `pip install 'acryl-datahub[druid]'` | Druid Source | +| dbt | _no additional dependencies_ | dbt source | +| datahub-rest | `pip install 'acryl-datahub[datahub-rest]'` | DataHub sink over REST API | +| datahub-kafka | `pip install 'acryl-datahub[datahub-kafka]'` | DataHub sink over Kafka | These plugins can be mixed and matched as desired. For example: @@ -451,6 +453,12 @@ source: # table_pattern/schema_pattern is same as above ``` +:::tip + +You can also get fine-grained usage statistics for BigQuery using the `bigquery-usage` source. + +::: + ### AWS Athena `athena` Extracts: @@ -766,6 +774,75 @@ sink: schema_registry_config: {} # passed to https://docs.confluent.io/platform/current/clients/confluent-kafka-python/html/index.html#confluent_kafka.schema_registry.SchemaRegistryClient ``` +### Google BigQuery Usage Stats `bigquery-usage` + +- Fetch a list of queries issued +- Fetch a list of tables and columns accessed +- Aggregate these statistics into buckets, by day or hour granularity + +Note: the client must have one of the following OAuth scopes: + +- https://www.googleapis.com/auth/logging.read +- https://www.googleapis.com/auth/logging.admin +- https://www.googleapis.com/auth/cloud-platform.read-only +- https://www.googleapis.com/auth/cloud-platform + +```yml +source: + type: bigquery-usage + config: + project_id: project # optional - can autodetect from environment + options: + # See https://googleapis.dev/python/logging/latest/client.html for details. + credentials: ~ # optional - see docs + env: PROD + + bucket_duration: "DAY" + start_time: ~ # defaults to the last full day in UTC (or hour) + end_time: ~ # defaults to the last full day in UTC (or hour) + + top_n_queries: 10 # number of queries to save for each table +``` + +:::tip + +This source only does usage statistics. To get the tables, views, and schemas in your BigQuery project, use the `bigquery` source. + +::: + +### Snowflake Usage Stats `snowflake-usage` + +- Fetch a list of queries issued +- Fetch a list of tables and columns accessed (excludes views) +- Aggregate these statistics into buckets, by day or hour granularity + +Note: the user/role must have access to the account usage table. The "accountadmin" role has this by default, and other roles can be granted this permission: https://docs.snowflake.com/en/sql-reference/account-usage.html#enabling-account-usage-for-other-roles. + +Note: the underlying access history views that we use are only available in Snowflake's enterprise edition or higher. + +```yml +source: + type: snowflake-usage + config: + username: user + password: pass + host_port: account_name + role: ACCOUNTADMIN + env: PROD + + bucket_duration: "DAY" + start_time: ~ # defaults to the last full day in UTC (or hour) + end_time: ~ # defaults to the last full day in UTC (or hour) + + top_n_queries: 10 # number of queries to save for each table +``` + +:::tip + +This source only does usage statistics. To get the tables, views, and schemas in your Snowflake warehouse, ingest using the `snowflake` source. + +::: + ### Console `console` Simply prints each metadata event to stdout. Useful for experimentation and debugging purposes. diff --git a/metadata-ingestion/setup.py b/metadata-ingestion/setup.py index 06bbfc1d6b..4e15654cbd 100644 --- a/metadata-ingestion/setup.py +++ b/metadata-ingestion/setup.py @@ -91,6 +91,7 @@ plugins: Dict[str, Set[str]] = { "postgres": sql_common | {"psycopg2-binary", "GeoAlchemy2"}, "redshift": sql_common | {"sqlalchemy-redshift", "psycopg2-binary", "GeoAlchemy2"}, "snowflake": sql_common | {"snowflake-sqlalchemy"}, + "snowflake-usage": sql_common | {"snowflake-sqlalchemy"}, "superset": {"requests"}, } @@ -200,6 +201,7 @@ entry_points = { "postgres = datahub.ingestion.source.postgres:PostgresSource", "redshift = datahub.ingestion.source.redshift:RedshiftSource", "snowflake = datahub.ingestion.source.snowflake:SnowflakeSource", + "snowflake-usage = datahub.ingestion.source.snowflake_usage:SnowflakeUsageSource", "superset = datahub.ingestion.source.superset:SupersetSource", ], "datahub.ingestion.sink.plugins": [ diff --git a/metadata-ingestion/src/datahub/ingestion/run/pipeline.py b/metadata-ingestion/src/datahub/ingestion/run/pipeline.py index 799093b697..549a4d43fb 100644 --- a/metadata-ingestion/src/datahub/ingestion/run/pipeline.py +++ b/metadata-ingestion/src/datahub/ingestion/run/pipeline.py @@ -146,9 +146,9 @@ class Pipeline: def pretty_print_summary(self) -> int: click.echo() - click.secho("Source report:", bold=True) + click.secho(f"Source ({self.config.source.type}) report:", bold=True) click.echo(self.source.get_report().as_string()) - click.secho("Sink report:", bold=True) + click.secho(f"Sink ({self.config.sink.type}) report:", bold=True) click.echo(self.sink.get_report().as_string()) click.echo() if self.source.get_report().failures or self.sink.get_report().failures: diff --git a/metadata-ingestion/src/datahub/ingestion/source/bigquery_usage.py b/metadata-ingestion/src/datahub/ingestion/source/bigquery_usage.py index 9bea6036e8..9fe158055e 100644 --- a/metadata-ingestion/src/datahub/ingestion/source/bigquery_usage.py +++ b/metadata-ingestion/src/datahub/ingestion/source/bigquery_usage.py @@ -14,11 +14,10 @@ import datahub.emitter.mce_builder as builder from datahub.ingestion.api.common import PipelineContext from datahub.ingestion.api.source import Source, SourceReport from datahub.ingestion.api.workunit import UsageStatsWorkUnit -from datahub.ingestion.source.usage_common import BaseUsageConfig, get_time_bucket -from datahub.metadata.schema_classes import ( - UsageAggregationClass, - UsageAggregationMetricsClass, - UserUsageCountsClass, +from datahub.ingestion.source.usage_common import ( + BaseUsageConfig, + GenericAggregatedDataset, + get_time_bucket, ) from datahub.utilities.delayed_iter import delayed_iter @@ -101,6 +100,9 @@ class BigQueryTableRef: return f"projects/{self.project}/datasets/{self.dataset}/tables/{self.table}" +AggregatedDataset = GenericAggregatedDataset[BigQueryTableRef] + + def _table_ref_to_urn(ref: BigQueryTableRef, env: str) -> str: return builder.make_dataset_urn( "bigquery", f"{ref.project}.{ref.dataset}.{ref.table}", env @@ -213,18 +215,6 @@ class QueryEvent: return queryEvent -@dataclass -class AggregatedDataset: - bucket_start_time: datetime - resource: BigQueryTableRef - - readCount: int = 0 - queryCount: int = 0 - queryFreq: Counter[str] = dataclasses.field(default_factory=collections.Counter) - userFreq: Counter[str] = dataclasses.field(default_factory=collections.Counter) - columnFreq: Counter[str] = dataclasses.field(default_factory=collections.Counter) - - class BigQueryUsageConfig(BaseUsageConfig): project_id: Optional[str] = None extra_client_options: dict = {} @@ -373,43 +363,15 @@ class BigQueryUsageSource(Source): resource, AggregatedDataset(bucket_start_time=floored_ts, resource=resource), ) - - agg_bucket.readCount += 1 - agg_bucket.userFreq[event.actor_email] += 1 - if event.query: - agg_bucket.queryCount += 1 - agg_bucket.queryFreq[event.query] += 1 - for column in event.fieldsRead: - agg_bucket.columnFreq[column] += 1 + agg_bucket.add_read_entry(event.actor_email, event.query, event.fieldsRead) return datasets def _make_usage_stat(self, agg: AggregatedDataset) -> UsageStatsWorkUnit: - return UsageStatsWorkUnit( - id=f"{agg.bucket_start_time.isoformat()}-{agg.resource}", - usageStats=UsageAggregationClass( - bucket=int(agg.bucket_start_time.timestamp() * 1000), - duration=self.config.bucket_duration, - resource=_table_ref_to_urn(agg.resource, self.config.env), - metrics=UsageAggregationMetricsClass( - uniqueUserCount=len(agg.userFreq), - users=[ - UserUsageCountsClass( - user=builder.UNKNOWN_USER, - count=count, - userEmail=user_email, - ) - for user_email, count in agg.userFreq.most_common() - ], - totalSqlQueries=agg.queryCount, - topSqlQueries=[ - query - for query, _ in agg.queryFreq.most_common( - self.config.top_n_queries - ) - ], - ), - ), + return agg.make_usage_workunit( + self.config.bucket_duration, + lambda resource: _table_ref_to_urn(resource, self.config.env), + self.config.top_n_queries, ) def get_report(self) -> SourceReport: diff --git a/metadata-ingestion/src/datahub/ingestion/source/snowflake_usage.py b/metadata-ingestion/src/datahub/ingestion/source/snowflake_usage.py new file mode 100644 index 0000000000..1c3386f366 --- /dev/null +++ b/metadata-ingestion/src/datahub/ingestion/source/snowflake_usage.py @@ -0,0 +1,199 @@ +import collections +import dataclasses +import json +import logging +from datetime import datetime, timezone +from typing import Dict, Iterable, List, Optional + +import pydantic +import pydantic.dataclasses +from sqlalchemy import create_engine +from sqlalchemy.engine import Engine + +import datahub.emitter.mce_builder as builder +from datahub.ingestion.api.source import Source, SourceReport +from datahub.ingestion.api.workunit import UsageStatsWorkUnit +from datahub.ingestion.source.snowflake import SnowflakeConfig +from datahub.ingestion.source.usage_common import ( + BaseUsageConfig, + GenericAggregatedDataset, + get_time_bucket, +) + +logger = logging.getLogger(__name__) + +SnowflakeTableRef = str +AggregatedDataset = GenericAggregatedDataset[SnowflakeTableRef] + +SNOWFLAKE_USAGE_SQL_TEMPLATE = """ +SELECT + -- access_history.query_id, -- only for debugging purposes + access_history.query_start_time, + query_history.query_text, + query_history.query_type, + access_history.base_objects_accessed, + -- access_history.direct_objects_accessed, -- might be useful in the future + -- query_history.execution_status, -- not really necessary, but should equal "SUCCESS" + -- query_history.warehouse_name, + access_history.user_name, + users.first_name, + users.last_name, + users.display_name, + users.email, + query_history.role_name +FROM + snowflake.account_usage.access_history access_history +LEFT JOIN + snowflake.account_usage.query_history query_history + ON access_history.query_id = query_history.query_id +LEFT JOIN + snowflake.account_usage.users users + ON access_history.user_name = users.name +WHERE ARRAY_SIZE(base_objects_accessed) > 0 + AND query_start_time >= to_timestamp_ltz({start_time_millis}, 3) + AND query_start_time < to_timestamp_ltz({end_time_millis}, 3) +ORDER BY query_start_time DESC +; +""".strip() + + +@pydantic.dataclasses.dataclass +class SnowflakeColumnReference: + columnId: int + columnName: str + + +@pydantic.dataclasses.dataclass +class SnowflakeObjectAccessEntry: + columns: List[SnowflakeColumnReference] + objectDomain: str + objectId: int + objectName: str + + +@pydantic.dataclasses.dataclass +class SnowflakeJoinedAccessEvent: + query_start_time: datetime + query_text: str + query_type: str + base_objects_accessed: List[SnowflakeObjectAccessEntry] + + user_name: str + first_name: Optional[str] + last_name: Optional[str] + display_name: Optional[str] + email: str + role_name: str + + +class SnowflakeUsageConfig(SnowflakeConfig, BaseUsageConfig): + database: str = "snowflake" + + @pydantic.validator("role", always=True) + def role_accountadmin(cls, v): + if not v or v.lower() != "accountadmin": + # This isn't an error, since the privileges can be delegated to other + # roles as well: https://docs.snowflake.com/en/sql-reference/account-usage.html#enabling-account-usage-for-other-roles + logger.info( + 'snowflake usage tables are only accessible by role "accountadmin" by default; you set %s', + v, + ) + return v + + +@dataclasses.dataclass +class SnowflakeUsageSource(Source): + config: SnowflakeUsageConfig + report: SourceReport = dataclasses.field(default_factory=SourceReport) + + @classmethod + def create(cls, config_dict, ctx): + config = SnowflakeUsageConfig.parse_obj(config_dict) + return cls(ctx, config) + + def get_workunits(self) -> Iterable[UsageStatsWorkUnit]: + access_events = self._get_snowflake_history() + aggregated_info = self._aggregate_access_events(access_events) + + for time_bucket in aggregated_info.values(): + for aggregate in time_bucket.values(): + wu = self._make_usage_stat(aggregate) + self.report.report_workunit(wu) + yield wu + + def _make_usage_query(self) -> str: + return SNOWFLAKE_USAGE_SQL_TEMPLATE.format( + start_time_millis=int(self.config.start_time.timestamp() * 1000), + end_time_millis=int(self.config.end_time.timestamp() * 1000), + ) + + def _make_sql_engine(self) -> Engine: + url = self.config.get_sql_alchemy_url() + logger.debug(f"sql_alchemy_url={url}") + engine = create_engine(url, **self.config.options) + return engine + + def _get_snowflake_history(self) -> Iterable[SnowflakeJoinedAccessEvent]: + query = self._make_usage_query() + engine = self._make_sql_engine() + + results = engine.execute(query) + for row in results: + # Make some minor type conversions. + if hasattr(row, "_asdict"): + # Compat with SQLAlchemy 1.3 and 1.4 + # See https://docs.sqlalchemy.org/en/14/changelog/migration_14.html#rowproxy-is-no-longer-a-proxy-is-now-called-row-and-behaves-like-an-enhanced-named-tuple. + event_dict = row._asdict() + else: + event_dict = dict(row) + event_dict["base_objects_accessed"] = json.loads( + event_dict["base_objects_accessed"] + ) + event_dict["query_start_time"] = ( + event_dict["query_start_time"] + ).astimezone(tz=timezone.utc) + + event = SnowflakeJoinedAccessEvent(**event_dict) + yield event + + def _aggregate_access_events( + self, events: Iterable[SnowflakeJoinedAccessEvent] + ) -> Dict[datetime, Dict[SnowflakeTableRef, AggregatedDataset]]: + datasets: Dict[ + datetime, Dict[SnowflakeTableRef, AggregatedDataset] + ] = collections.defaultdict(dict) + + for event in events: + floored_ts = get_time_bucket( + event.query_start_time, self.config.bucket_duration + ) + + for object in event.base_objects_accessed: + resource = object.objectName + + agg_bucket = datasets[floored_ts].setdefault( + resource, + AggregatedDataset(bucket_start_time=floored_ts, resource=resource), + ) + agg_bucket.add_read_entry( + event.email, + event.query_text, + [colRef.columnName.lower() for colRef in object.columns], + ) + + return datasets + + def _make_usage_stat(self, agg: AggregatedDataset) -> UsageStatsWorkUnit: + return agg.make_usage_workunit( + self.config.bucket_duration, + lambda resource: builder.make_dataset_urn( + "snowflake", resource.lower(), self.config.env + ), + self.config.top_n_queries, + ) + + def get_report(self): + return self.report + + def close(self): + pass diff --git a/metadata-ingestion/src/datahub/ingestion/source/usage_common.py b/metadata-ingestion/src/datahub/ingestion/source/usage_common.py index 5ccadd939f..9bcb53c2de 100644 --- a/metadata-ingestion/src/datahub/ingestion/source/usage_common.py +++ b/metadata-ingestion/src/datahub/ingestion/source/usage_common.py @@ -1,11 +1,21 @@ +import collections +import dataclasses import enum from datetime import datetime, timedelta, timezone -from typing import Optional +from typing import Callable, Counter, Generic, List, Optional, TypeVar import pydantic +import datahub.emitter.mce_builder as builder from datahub.configuration.common import ConfigModel -from datahub.metadata.schema_classes import WindowDurationClass +from datahub.ingestion.api.workunit import UsageStatsWorkUnit +from datahub.metadata.schema_classes import ( + FieldUsageCountsClass, + UsageAggregationClass, + UsageAggregationMetricsClass, + UserUsageCountsClass, + WindowDurationClass, +) @enum.unique @@ -30,6 +40,69 @@ def get_bucket_duration_delta(bucketing: BucketDuration) -> timedelta: return timedelta(days=1) +ResourceType = TypeVar("ResourceType") + + +@dataclasses.dataclass +class GenericAggregatedDataset(Generic[ResourceType]): + bucket_start_time: datetime + resource: ResourceType + + readCount: int = 0 + queryCount: int = 0 + queryFreq: Counter[str] = dataclasses.field(default_factory=collections.Counter) + userFreq: Counter[str] = dataclasses.field(default_factory=collections.Counter) + columnFreq: Counter[str] = dataclasses.field(default_factory=collections.Counter) + + def add_read_entry( + self, user: str, query: Optional[str], fields: List[str] + ) -> None: + self.readCount += 1 + self.userFreq[user] += 1 + if query: + self.queryCount += 1 + self.queryFreq[query] += 1 + for column in fields: + self.columnFreq[column] += 1 + + def make_usage_workunit( + self, + bucket_duration: BucketDuration, + urn_builder: Callable[[ResourceType], str], + top_n_queries: Optional[int], + ) -> UsageStatsWorkUnit: + return UsageStatsWorkUnit( + id=f"{self.bucket_start_time.isoformat()}-{self.resource}", + usageStats=UsageAggregationClass( + bucket=int(self.bucket_start_time.timestamp() * 1000), + duration=bucket_duration, + resource=urn_builder(self.resource), + metrics=UsageAggregationMetricsClass( + uniqueUserCount=len(self.userFreq), + users=[ + UserUsageCountsClass( + user=builder.UNKNOWN_USER, + count=count, + userEmail=user_email, + ) + for user_email, count in self.userFreq.most_common() + ], + totalSqlQueries=self.queryCount, + topSqlQueries=[ + query for query, _ in self.queryFreq.most_common(top_n_queries) + ], + fields=[ + FieldUsageCountsClass( + fieldName=column, + count=count, + ) + for column, count in self.columnFreq.most_common() + ], + ), + ), + ) + + class BaseUsageConfig(ConfigModel): # start_time and end_time will be populated by the validators. bucket_duration: BucketDuration = BucketDuration.DAY diff --git a/metadata-ingestion/src/datahub/metadata/com/linkedin/pegasus2avro/usage/__init__.py b/metadata-ingestion/src/datahub/metadata/com/linkedin/pegasus2avro/usage/__init__.py index 184268d81c..f5482018ce 100644 --- a/metadata-ingestion/src/datahub/metadata/com/linkedin/pegasus2avro/usage/__init__.py +++ b/metadata-ingestion/src/datahub/metadata/com/linkedin/pegasus2avro/usage/__init__.py @@ -4,11 +4,13 @@ # Do not modify manually! # fmt: off +from .....schema_classes import FieldUsageCountsClass from .....schema_classes import UsageAggregationClass from .....schema_classes import UsageAggregationMetricsClass from .....schema_classes import UserUsageCountsClass +FieldUsageCounts = FieldUsageCountsClass UsageAggregation = UsageAggregationClass UsageAggregationMetrics = UsageAggregationMetricsClass UserUsageCounts = UserUsageCountsClass diff --git a/metadata-ingestion/src/datahub/metadata/schema.avsc b/metadata-ingestion/src/datahub/metadata/schema.avsc index cec9a35e2c..446a9b6f3e 100644 --- a/metadata-ingestion/src/datahub/metadata/schema.avsc +++ b/metadata-ingestion/src/datahub/metadata/schema.avsc @@ -4731,6 +4731,33 @@ "name": "topSqlQueries", "default": null, "doc": " Frequent SQL queries; mostly makes sense for datasets in SQL databases " + }, + { + "type": [ + "null", + { + "type": "array", + "items": { + "type": "record", + "name": "FieldUsageCounts", + "namespace": "com.linkedin.pegasus2avro.usage", + "fields": [ + { + "type": "string", + "name": "fieldName" + }, + { + "type": "int", + "name": "count" + } + ], + "doc": " Records field-level usage counts for a given resource " + } + } + ], + "name": "fields", + "default": null, + "doc": " Field-level usage stats " } ], "doc": "Metrics for usage data for a given resource and bucket. Not all fields\nmake sense for all buckets, so every field is optional." diff --git a/metadata-ingestion/src/datahub/metadata/schema_classes.py b/metadata-ingestion/src/datahub/metadata/schema_classes.py index fa0cdee8ac..17f7e861ee 100644 --- a/metadata-ingestion/src/datahub/metadata/schema_classes.py +++ b/metadata-ingestion/src/datahub/metadata/schema_classes.py @@ -7606,6 +7606,55 @@ class TagPropertiesClass(DictWrapper): self._inner_dict['description'] = value +class FieldUsageCountsClass(DictWrapper): + """ Records field-level usage counts for a given resource """ + + RECORD_SCHEMA = get_schema_type("com.linkedin.pegasus2avro.usage.FieldUsageCounts") + def __init__(self, + fieldName: str, + count: int, + ): + super().__init__() + + self.fieldName = fieldName + self.count = count + + @classmethod + def construct_with_defaults(cls) -> "FieldUsageCountsClass": + self = cls.construct({}) + self._restore_defaults() + + return self + + def _restore_defaults(self) -> None: + self.fieldName = str() + self.count = int() + + + @property + def fieldName(self) -> str: + # No docs available. + return self._inner_dict.get('fieldName') # type: ignore + + + @fieldName.setter + def fieldName(self, value: str) -> None: + # No docs available. + self._inner_dict['fieldName'] = value + + + @property + def count(self) -> int: + # No docs available. + return self._inner_dict.get('count') # type: ignore + + + @count.setter + def count(self, value: int) -> None: + # No docs available. + self._inner_dict['count'] = value + + class UsageAggregationClass(DictWrapper): """Usage data for a given resource, rolled up into a bucket.""" @@ -7695,6 +7744,7 @@ class UsageAggregationMetricsClass(DictWrapper): users: Union[None, List["UserUsageCountsClass"]]=None, totalSqlQueries: Union[None, int]=None, topSqlQueries: Union[None, List[str]]=None, + fields: Union[None, List["FieldUsageCountsClass"]]=None, ): super().__init__() @@ -7702,6 +7752,7 @@ class UsageAggregationMetricsClass(DictWrapper): self.users = users self.totalSqlQueries = totalSqlQueries self.topSqlQueries = topSqlQueries + self.fields = fields @classmethod def construct_with_defaults(cls) -> "UsageAggregationMetricsClass": @@ -7715,6 +7766,7 @@ class UsageAggregationMetricsClass(DictWrapper): self.users = self.RECORD_SCHEMA.field_map["users"].default self.totalSqlQueries = self.RECORD_SCHEMA.field_map["totalSqlQueries"].default self.topSqlQueries = self.RECORD_SCHEMA.field_map["topSqlQueries"].default + self.fields = self.RECORD_SCHEMA.field_map["fields"].default @property @@ -7765,6 +7817,18 @@ class UsageAggregationMetricsClass(DictWrapper): self._inner_dict['topSqlQueries'] = value + @property + def fields(self) -> Union[None, List["FieldUsageCountsClass"]]: + """Getter: Field-level usage stats """ + return self._inner_dict.get('fields') # type: ignore + + + @fields.setter + def fields(self, value: Union[None, List["FieldUsageCountsClass"]]) -> None: + """Setter: Field-level usage stats """ + self._inner_dict['fields'] = value + + class UserUsageCountsClass(DictWrapper): """ Records a single user's usage counts for a given resource """ @@ -7972,6 +8036,7 @@ __SCHEMA_TYPES = { 'com.linkedin.pegasus2avro.schema.UnionType': UnionTypeClass, 'com.linkedin.pegasus2avro.schema.UrnForeignKey': UrnForeignKeyClass, 'com.linkedin.pegasus2avro.tag.TagProperties': TagPropertiesClass, + 'com.linkedin.pegasus2avro.usage.FieldUsageCounts': FieldUsageCountsClass, 'com.linkedin.pegasus2avro.usage.UsageAggregation': UsageAggregationClass, 'com.linkedin.pegasus2avro.usage.UsageAggregationMetrics': UsageAggregationMetricsClass, 'com.linkedin.pegasus2avro.usage.UserUsageCounts': UserUsageCountsClass, @@ -8117,6 +8182,7 @@ __SCHEMA_TYPES = { 'UnionType': UnionTypeClass, 'UrnForeignKey': UrnForeignKeyClass, 'TagProperties': TagPropertiesClass, + 'FieldUsageCounts': FieldUsageCountsClass, 'UsageAggregation': UsageAggregationClass, 'UsageAggregationMetrics': UsageAggregationMetricsClass, 'UserUsageCounts': UserUsageCountsClass, diff --git a/metadata-ingestion/src/datahub/metadata/schemas/UsageAggregation.avsc b/metadata-ingestion/src/datahub/metadata/schemas/UsageAggregation.avsc index 2175dc45e5..4dea9af6f8 100644 --- a/metadata-ingestion/src/datahub/metadata/schemas/UsageAggregation.avsc +++ b/metadata-ingestion/src/datahub/metadata/schemas/UsageAggregation.avsc @@ -112,6 +112,32 @@ ], "doc": " Frequent SQL queries; mostly makes sense for datasets in SQL databases ", "default": null + }, + { + "name": "fields", + "type": [ + "null", + { + "type": "array", + "items": { + "type": "record", + "name": "FieldUsageCounts", + "doc": " Records field-level usage counts for a given resource ", + "fields": [ + { + "name": "fieldName", + "type": "string" + }, + { + "name": "count", + "type": "int" + } + ] + } + } + ], + "doc": " Field-level usage stats ", + "default": null } ] }, diff --git a/metadata-ingestion/tests/integration/bigquery-usage/bigquery_usages_golden.json b/metadata-ingestion/tests/integration/bigquery-usage/bigquery_usages_golden.json index c63dec2bfd..1531485fa2 100644 --- a/metadata-ingestion/tests/integration/bigquery-usage/bigquery_usages_golden.json +++ b/metadata-ingestion/tests/integration/bigquery-usage/bigquery_usages_golden.json @@ -13,7 +13,105 @@ } ], "totalSqlQueries": 0, - "topSqlQueries": [] + "topSqlQueries": [], + "fields": [ + { + "fieldName": "unique_key", + "count": 1 + }, + { + "fieldName": "complaint_type", + "count": 1 + }, + { + "fieldName": "complaint_description", + "count": 1 + }, + { + "fieldName": "owning_department", + "count": 1 + }, + { + "fieldName": "source", + "count": 1 + }, + { + "fieldName": "status", + "count": 1 + }, + { + "fieldName": "status_change_date", + "count": 1 + }, + { + "fieldName": "created_date", + "count": 1 + }, + { + "fieldName": "last_update_date", + "count": 1 + }, + { + "fieldName": "close_date", + "count": 1 + }, + { + "fieldName": "incident_address", + "count": 1 + }, + { + "fieldName": "street_number", + "count": 1 + }, + { + "fieldName": "street_name", + "count": 1 + }, + { + "fieldName": "city", + "count": 1 + }, + { + "fieldName": "incident_zip", + "count": 1 + }, + { + "fieldName": "county", + "count": 1 + }, + { + "fieldName": "state_plane_x_coordinate", + "count": 1 + }, + { + "fieldName": "state_plane_y_coordinate", + "count": 1 + }, + { + "fieldName": "latitude", + "count": 1 + }, + { + "fieldName": "longitude", + "count": 1 + }, + { + "fieldName": "location", + "count": 1 + }, + { + "fieldName": "council_district_code", + "count": 1 + }, + { + "fieldName": "map_page", + "count": 1 + }, + { + "fieldName": "map_tile", + "count": 1 + } + ] } }, { @@ -32,6 +130,2640 @@ "totalSqlQueries": 3, "topSqlQueries": [ "SELECT * FROM `harshal-playground-306419.bigquery_usage_logs.cloudaudit_googleapis_com_data_access_20210526`" + ], + "fields": [ + { + "fieldName": "logName", + "count": 9 + }, + { + "fieldName": "resource.type", + "count": 9 + }, + { + "fieldName": "resource.labels.project_id", + "count": 9 + }, + { + "fieldName": "resource.labels.location", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.serviceName", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.methodName", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.resourceName", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.currentLocations", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.originalLocations", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.numResponseItems", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.status.code", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.status.message", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalEmail", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.authoritySelector", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountKeyName", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.principalSubject", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal.principalEmail", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalSubject", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resource", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.permission", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.granted", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.service", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.name", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.type", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.key", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.value", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.uid", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.key", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.value", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.displayName", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.createTime", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.updateTime", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.deleteTime", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.etag", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.location", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerIp", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerSuppliedUserAgent", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerNetwork", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.id", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.method", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.key", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.value", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.path", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.host", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.scheme", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.query", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.time", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.size", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.protocol", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.reason", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.principal", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.audiences", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.presenter", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.accessLevels", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.ip", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.port", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.key", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.value", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.principal", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.regionCode", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.metadataJson", + "count": 9 + }, + { + "fieldName": "textPayload", + "count": 9 + }, + { + "fieldName": "timestamp", + "count": 9 + }, + { + "fieldName": "receiveTimestamp", + "count": 9 + }, + { + "fieldName": "severity", + "count": 9 + }, + { + "fieldName": "insertId", + "count": 9 + }, + { + "fieldName": "httpRequest.requestMethod", + "count": 9 + }, + { + "fieldName": "httpRequest.requestUrl", + "count": 9 + }, + { + "fieldName": "httpRequest.requestSize", + "count": 9 + }, + { + "fieldName": "httpRequest.status", + "count": 9 + }, + { + "fieldName": "httpRequest.responseSize", + "count": 9 + }, + { + "fieldName": "httpRequest.userAgent", + "count": 9 + }, + { + "fieldName": "httpRequest.remoteIp", + "count": 9 + }, + { + "fieldName": "httpRequest.serverIp", + "count": 9 + }, + { + "fieldName": "httpRequest.referer", + "count": 9 + }, + { + "fieldName": "httpRequest.cacheLookup", + "count": 9 + }, + { + "fieldName": "httpRequest.cacheHit", + "count": 9 + }, + { + "fieldName": "httpRequest.cacheValidatedWithOriginServer", + "count": 9 + }, + { + "fieldName": "httpRequest.cacheFillBytes", + "count": 9 + }, + { + "fieldName": "httpRequest.protocol", + "count": 9 + }, + { + "fieldName": "operation.id", + "count": 9 + }, + { + "fieldName": "operation.producer", + "count": 9 + }, + { + "fieldName": "operation.first", + "count": 9 + }, + { + "fieldName": "operation.last", + "count": 9 + }, + { + "fieldName": "trace", + "count": 9 + }, + { + "fieldName": "spanId", + "count": 9 + }, + { + "fieldName": "traceSampled", + "count": 9 + }, + { + "fieldName": "sourceLocation.file", + "count": 9 + }, + { + "fieldName": "sourceLocation.line", + "count": 9 + }, + { + "fieldName": "sourceLocation.function", + "count": 9 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes", + "count": 3 + }, + { + "fieldName": "operation", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog", + "count": 3 + }, + { + "fieldName": "resource.labels", + "count": 3 + }, + { + "fieldName": "sourceLocation", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.status", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation", + "count": 3 + }, + { + "fieldName": "resource", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata", + "count": 3 + }, + { + "fieldName": "httpRequest", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels", + "count": 3 + }, + { + "fieldName": "resource.labels.dataset_id", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.tableName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.tableName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.tableName.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info.friendlyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.view.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.expireTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.truncateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.updateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.encryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.tableName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.tableName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.tableName.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info.friendlyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.view.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.expireTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.truncateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.updateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.encryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetListRequest.listAll", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.datasetName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.datasetName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info.friendlyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.updateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.role", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.groupEmail", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.userEmail", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.domain", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.specialGroup", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.viewName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.viewName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.viewName.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.datasetName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.datasetName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info.friendlyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.updateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.role", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.groupEmail", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.userEmail", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.domain", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.specialGroup", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.viewName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.viewName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.viewName.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobName.jobId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobName.location", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.defaultDataset.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.defaultDataset.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.tableDefinitions.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.queryPriority", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.statementType", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract.destinationUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract.sourceTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract.sourceTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract.sourceTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.dryRun", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.state", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.error.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.error.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.additionalErrors.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.additionalErrors.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.startTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.endTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalProcessedBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalBilledBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.billingTier", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalSlotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.reservationUsage.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.reservationUsage.slotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalTablesProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedViews.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedViews.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedViews.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalViewsProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.queryOutputRowCount", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalLoadOutputBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.maxResults", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.defaultDataset.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.defaultDataset.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.dryRun", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsRequest.maxResults", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsRequest.startRow", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataListRequest.startRow", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataListRequest.maxResults", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.resource", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.version", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.role", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.members", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.condition.expression", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.condition.title", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.condition.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.condition.location", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.auditConfigs.service", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.auditConfigs.auditLogConfigs.logType", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.auditConfigs.auditLogConfigs.exemptedMembers", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.etag", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.updateMask.paths", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.tableName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.tableName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.tableName.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info.friendlyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.view.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.expireTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.truncateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.updateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.encryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.tableName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.tableName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.tableName.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info.friendlyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.view.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.expireTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.truncateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.updateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.encryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.datasetName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.datasetName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info.friendlyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.updateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.role", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.groupEmail", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.userEmail", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.domain", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.specialGroup", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.viewName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.viewName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.viewName.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.datasetName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.datasetName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info.friendlyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.updateTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.role", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.groupEmail", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.userEmail", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.domain", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.specialGroup", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.viewName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.viewName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.viewName.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobName.jobId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobName.location", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.defaultDataset.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.defaultDataset.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.tableDefinitions.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.queryPriority", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.statementType", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract.destinationUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract.sourceTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract.sourceTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract.sourceTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.dryRun", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.state", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.error.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.error.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.additionalErrors.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.additionalErrors.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.startTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.endTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalProcessedBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalBilledBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.billingTier", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalSlotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.reservationUsage.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.reservationUsage.slotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalTablesProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedViews.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedViews.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedViews.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalViewsProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.queryOutputRowCount", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalLoadOutputBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.totalResults", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobName.jobId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobName.location", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.defaultDataset.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.defaultDataset.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.tableDefinitions.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.queryPriority", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.statementType", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract.destinationUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract.sourceTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract.sourceTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract.sourceTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.dryRun", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.state", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.error.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.error.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.additionalErrors.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.additionalErrors.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.startTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.endTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalProcessedBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalBilledBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.billingTier", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalSlotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.reservationUsage.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.reservationUsage.slotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalTablesProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedViews.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedViews.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedViews.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalViewsProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.queryOutputRowCount", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalLoadOutputBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.totalResults", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobName.jobId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobName.location", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.defaultDataset.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.defaultDataset.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.tableDefinitions.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.queryPriority", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.statementType", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract.destinationUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract.sourceTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract.sourceTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract.sourceTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.dryRun", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.state", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.error.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.error.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.additionalErrors.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.additionalErrors.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.startTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.endTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalProcessedBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalBilledBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.billingTier", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalSlotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.reservationUsage.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.reservationUsage.slotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalTablesProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedViews.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedViews.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedViews.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalViewsProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.queryOutputRowCount", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalLoadOutputBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobName.jobId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobName.location", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.defaultDataset.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.defaultDataset.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.tableDefinitions.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.queryPriority", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.statementType", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract.destinationUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract.sourceTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract.sourceTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract.sourceTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.dryRun", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.state", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.error.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.error.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.additionalErrors.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.additionalErrors.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.startTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.endTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalProcessedBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalBilledBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.billingTier", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalSlotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.reservationUsage.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.reservationUsage.slotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalTablesProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedViews.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedViews.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedViews.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalViewsProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.queryOutputRowCount", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalLoadOutputBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.version", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.role", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.members", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.condition.expression", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.condition.title", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.condition.description", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.condition.location", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.auditConfigs.service", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.auditConfigs.auditLogConfigs.logType", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.auditConfigs.auditLogConfigs.exemptedMembers", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.etag", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.eventName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobName.jobId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobName.location", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.query", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.defaultDataset.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.defaultDataset.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.tableDefinitions.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.queryPriority", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.statementType", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.sourceUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.schemaJson", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract.destinationUris", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract.sourceTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract.sourceTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract.sourceTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.createDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.writeDisposition", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.dryRun", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.labels.key", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.labels.value", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.state", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.error.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.error.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.additionalErrors.code", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.additionalErrors.message", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.createTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.startTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.endTime", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalProcessedBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalBilledBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.billingTier", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalSlotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.reservationUsage.name", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.reservationUsage.slotMs", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedTables.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedTables.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedTables.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalTablesProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedViews.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedViews.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedViews.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalViewsProcessed", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.queryOutputRowCount", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalLoadOutputBytes", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents.tableName.projectId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents.tableName.datasetId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents.tableName.tableId", + "count": 2 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents.referencedFields", + "count": 2 + } ] } }, @@ -51,6 +2783,464 @@ "totalSqlQueries": 1, "topSqlQueries": [ "SELECT * FROM `harshal-playground-306419.bigquery_usage_logs.cloudaudit_googleapis_com_activity_20210527` LIMIT 1000" + ], + "fields": [ + { + "fieldName": "logName", + "count": 10 + }, + { + "fieldName": "resource.type", + "count": 10 + }, + { + "fieldName": "resource.labels.project_id", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.serviceName", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.methodName", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.resourceName", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.currentLocations", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.originalLocations", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.numResponseItems", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.status.code", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.status.message", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalEmail", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.authoritySelector", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountKeyName", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.principalSubject", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal.principalEmail", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalSubject", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resource", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.permission", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.granted", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.service", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.name", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.type", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.key", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.value", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.uid", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.key", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.value", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.displayName", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.createTime", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.updateTime", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.deleteTime", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.etag", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.location", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerIp", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerSuppliedUserAgent", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerNetwork", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.id", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.method", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.key", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.value", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.path", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.host", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.scheme", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.query", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.time", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.size", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.protocol", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.reason", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.principal", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.audiences", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.presenter", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.accessLevels", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.ip", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.port", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.key", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.value", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.principal", + "count": 10 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.regionCode", + "count": 10 + }, + { + "fieldName": "textPayload", + "count": 10 + }, + { + "fieldName": "timestamp", + "count": 10 + }, + { + "fieldName": "receiveTimestamp", + "count": 10 + }, + { + "fieldName": "severity", + "count": 10 + }, + { + "fieldName": "insertId", + "count": 10 + }, + { + "fieldName": "httpRequest.requestMethod", + "count": 10 + }, + { + "fieldName": "httpRequest.requestUrl", + "count": 10 + }, + { + "fieldName": "httpRequest.requestSize", + "count": 10 + }, + { + "fieldName": "httpRequest.status", + "count": 10 + }, + { + "fieldName": "httpRequest.responseSize", + "count": 10 + }, + { + "fieldName": "httpRequest.userAgent", + "count": 10 + }, + { + "fieldName": "httpRequest.remoteIp", + "count": 10 + }, + { + "fieldName": "httpRequest.serverIp", + "count": 10 + }, + { + "fieldName": "httpRequest.referer", + "count": 10 + }, + { + "fieldName": "httpRequest.cacheLookup", + "count": 10 + }, + { + "fieldName": "httpRequest.cacheHit", + "count": 10 + }, + { + "fieldName": "httpRequest.cacheValidatedWithOriginServer", + "count": 10 + }, + { + "fieldName": "httpRequest.cacheFillBytes", + "count": 10 + }, + { + "fieldName": "httpRequest.protocol", + "count": 10 + }, + { + "fieldName": "operation.id", + "count": 10 + }, + { + "fieldName": "operation.producer", + "count": 10 + }, + { + "fieldName": "operation.first", + "count": 10 + }, + { + "fieldName": "operation.last", + "count": 10 + }, + { + "fieldName": "trace", + "count": 10 + }, + { + "fieldName": "spanId", + "count": 10 + }, + { + "fieldName": "traceSampled", + "count": 10 + }, + { + "fieldName": "sourceLocation.file", + "count": 10 + }, + { + "fieldName": "sourceLocation.line", + "count": 10 + }, + { + "fieldName": "sourceLocation.function", + "count": 10 + }, + { + "fieldName": "resource.labels.dataset_id", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.metadataJson", + "count": 7 + }, + { + "fieldName": "resource.labels.name", + "count": 3 + }, + { + "fieldName": "resource.labels.destination", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.requestJson", + "count": 3 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal", + "count": 1 + }, + { + "fieldName": "resource.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo", + "count": 1 + }, + { + "fieldName": "operation", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.status", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels", + "count": 1 + }, + { + "fieldName": "sourceLocation", + "count": 1 + }, + { + "fieldName": "httpRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog", + "count": 1 + }, + { + "fieldName": "resource", + "count": 1 + } ] } }, @@ -71,6 +3261,56 @@ "topSqlQueries": [ "\nSELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`;\n\n", "SELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`" + ], + "fields": [ + { + "fieldName": "placename", + "count": 4 + }, + { + "fieldName": "excess_deaths", + "count": 4 + }, + { + "fieldName": "deaths", + "count": 4 + }, + { + "fieldName": "end_date", + "count": 4 + }, + { + "fieldName": "frequency", + "count": 4 + }, + { + "fieldName": "expected_deaths", + "count": 4 + }, + { + "fieldName": "start_date", + "count": 4 + }, + { + "fieldName": "baseline", + "count": 4 + }, + { + "fieldName": "year", + "count": 4 + }, + { + "fieldName": "month", + "count": 4 + }, + { + "fieldName": "week", + "count": 4 + }, + { + "fieldName": "country", + "count": 4 + } ] } }, @@ -90,6 +3330,452 @@ "totalSqlQueries": 1, "topSqlQueries": [ "SELECT * FROM `harshal-playground-306419.bq_audit.cloudaudit_googleapis_com_activity` WHERE DATE(timestamp) = \"2021-05-27\" LIMIT 1000" + ], + "fields": [ + { + "fieldName": "logName", + "count": 4 + }, + { + "fieldName": "resource.type", + "count": 4 + }, + { + "fieldName": "resource.labels.project_id", + "count": 4 + }, + { + "fieldName": "resource.labels.dataset_id", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.serviceName", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.methodName", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.resourceName", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.currentLocations", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.originalLocations", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.numResponseItems", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.status.code", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.status.message", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalEmail", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.authoritySelector", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountKeyName", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.principalSubject", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal.principalEmail", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalSubject", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resource", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.permission", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.granted", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.service", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.name", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.type", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.key", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.value", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.uid", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.key", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.value", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.displayName", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.createTime", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.updateTime", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.deleteTime", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.etag", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.location", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerIp", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerSuppliedUserAgent", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerNetwork", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.id", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.method", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.key", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.value", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.path", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.host", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.scheme", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.query", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.time", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.size", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.protocol", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.reason", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.principal", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.audiences", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.presenter", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.accessLevels", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.ip", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.port", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.key", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.value", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.principal", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.regionCode", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.metadataJson", + "count": 4 + }, + { + "fieldName": "textPayload", + "count": 4 + }, + { + "fieldName": "timestamp", + "count": 4 + }, + { + "fieldName": "receiveTimestamp", + "count": 4 + }, + { + "fieldName": "severity", + "count": 4 + }, + { + "fieldName": "insertId", + "count": 4 + }, + { + "fieldName": "httpRequest.requestMethod", + "count": 4 + }, + { + "fieldName": "httpRequest.requestUrl", + "count": 4 + }, + { + "fieldName": "httpRequest.requestSize", + "count": 4 + }, + { + "fieldName": "httpRequest.status", + "count": 4 + }, + { + "fieldName": "httpRequest.responseSize", + "count": 4 + }, + { + "fieldName": "httpRequest.userAgent", + "count": 4 + }, + { + "fieldName": "httpRequest.remoteIp", + "count": 4 + }, + { + "fieldName": "httpRequest.serverIp", + "count": 4 + }, + { + "fieldName": "httpRequest.referer", + "count": 4 + }, + { + "fieldName": "httpRequest.cacheLookup", + "count": 4 + }, + { + "fieldName": "httpRequest.cacheHit", + "count": 4 + }, + { + "fieldName": "httpRequest.cacheValidatedWithOriginServer", + "count": 4 + }, + { + "fieldName": "httpRequest.cacheFillBytes", + "count": 4 + }, + { + "fieldName": "httpRequest.protocol", + "count": 4 + }, + { + "fieldName": "operation.id", + "count": 4 + }, + { + "fieldName": "operation.producer", + "count": 4 + }, + { + "fieldName": "operation.first", + "count": 4 + }, + { + "fieldName": "operation.last", + "count": 4 + }, + { + "fieldName": "trace", + "count": 4 + }, + { + "fieldName": "spanId", + "count": 4 + }, + { + "fieldName": "traceSampled", + "count": 4 + }, + { + "fieldName": "sourceLocation.file", + "count": 4 + }, + { + "fieldName": "sourceLocation.line", + "count": 4 + }, + { + "fieldName": "sourceLocation.function", + "count": 4 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes", + "count": 1 + }, + { + "fieldName": "sourceLocation", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo", + "count": 1 + }, + { + "fieldName": "operation", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels", + "count": 1 + }, + { + "fieldName": "resource.labels", + "count": 1 + }, + { + "fieldName": "httpRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.status", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog", + "count": 1 + }, + { + "fieldName": "resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes", + "count": 1 + } ] } }, @@ -109,6 +3795,3572 @@ "totalSqlQueries": 1, "topSqlQueries": [ "SELECT * FROM `harshal-playground-306419.bq_audit.cloudaudit_googleapis_com_data_access` WHERE DATE(timestamp) = \"2021-05-27\" LIMIT 1000" + ], + "fields": [ + { + "fieldName": "logName", + "count": 7 + }, + { + "fieldName": "resource.type", + "count": 7 + }, + { + "fieldName": "resource.labels.project_id", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.serviceName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.methodName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.resourceName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.currentLocations", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.originalLocations", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.numResponseItems", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.status.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.status.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.authoritySelector", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.principalSubject", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal.principalEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalSubject", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resource", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.permission", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.granted", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.service", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.type", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.uid", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.displayName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.updateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.deleteTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.etag", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.location", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerIp", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerSuppliedUserAgent", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerNetwork", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.id", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.method", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.path", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.host", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.scheme", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.time", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.size", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.protocol", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.reason", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.principal", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.audiences", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.presenter", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.accessLevels", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.ip", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.port", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.principal", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.regionCode", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.tableName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.tableName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.tableName.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info.friendlyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.view.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.expireTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.truncateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.updateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.encryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.tableName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.tableName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.tableName.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info.friendlyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.view.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.expireTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.truncateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.updateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.encryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetListRequest.listAll", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.datasetName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.datasetName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info.friendlyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.updateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.role", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.groupEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.userEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.domain", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.specialGroup", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.viewName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.viewName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.viewName.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.datasetName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.datasetName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info.friendlyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.updateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.role", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.groupEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.userEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.domain", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.specialGroup", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.viewName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.viewName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.viewName.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobName.jobId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobName.location", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.defaultDataset.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.defaultDataset.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.tableDefinitions.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.queryPriority", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.statementType", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract.destinationUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract.sourceTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract.sourceTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract.sourceTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.dryRun", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.state", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.error.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.error.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.additionalErrors.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.additionalErrors.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.startTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.endTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalProcessedBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalBilledBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.billingTier", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalSlotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.reservationUsage.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.reservationUsage.slotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalTablesProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedViews.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedViews.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedViews.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalViewsProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.queryOutputRowCount", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.totalLoadOutputBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.maxResults", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.defaultDataset.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.defaultDataset.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.dryRun", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsRequest.maxResults", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsRequest.startRow", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataListRequest.startRow", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataListRequest.maxResults", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.resource", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.version", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.role", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.members", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.condition.expression", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.condition.title", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.condition.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.condition.location", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.auditConfigs.service", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.auditConfigs.auditLogConfigs.logType", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.auditConfigs.auditLogConfigs.exemptedMembers", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.etag", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.updateMask.paths", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.tableName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.tableName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.tableName.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info.friendlyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.view.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.expireTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.truncateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.updateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.encryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.tableName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.tableName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.tableName.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info.friendlyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.view.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.expireTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.truncateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.updateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.encryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.datasetName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.datasetName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info.friendlyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.updateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.role", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.groupEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.userEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.domain", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.specialGroup", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.viewName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.viewName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.viewName.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.datasetName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.datasetName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info.friendlyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.updateTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.role", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.groupEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.userEmail", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.domain", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.specialGroup", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.viewName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.viewName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.viewName.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobName.jobId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobName.location", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.defaultDataset.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.defaultDataset.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.tableDefinitions.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.queryPriority", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.statementType", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract.destinationUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract.sourceTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract.sourceTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract.sourceTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.dryRun", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.state", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.error.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.error.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.additionalErrors.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.additionalErrors.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.startTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.endTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalProcessedBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalBilledBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.billingTier", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalSlotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.reservationUsage.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.reservationUsage.slotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalTablesProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedViews.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedViews.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedViews.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalViewsProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.queryOutputRowCount", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.totalLoadOutputBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.totalResults", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobName.jobId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobName.location", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.defaultDataset.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.defaultDataset.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.tableDefinitions.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.queryPriority", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.statementType", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract.destinationUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract.sourceTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract.sourceTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract.sourceTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.dryRun", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.state", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.error.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.error.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.additionalErrors.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.additionalErrors.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.startTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.endTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalProcessedBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalBilledBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.billingTier", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalSlotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.reservationUsage.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.reservationUsage.slotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalTablesProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedViews.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedViews.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedViews.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalViewsProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.queryOutputRowCount", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.totalLoadOutputBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.totalResults", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobName.jobId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobName.location", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.defaultDataset.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.defaultDataset.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.tableDefinitions.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.queryPriority", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.statementType", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract.destinationUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract.sourceTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract.sourceTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract.sourceTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.dryRun", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.state", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.error.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.error.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.additionalErrors.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.additionalErrors.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.startTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.endTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalProcessedBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalBilledBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.billingTier", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalSlotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.reservationUsage.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.reservationUsage.slotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalTablesProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedViews.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedViews.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedViews.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalViewsProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.queryOutputRowCount", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.totalLoadOutputBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobName.jobId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobName.location", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.defaultDataset.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.defaultDataset.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.tableDefinitions.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.queryPriority", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.statementType", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract.destinationUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract.sourceTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract.sourceTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract.sourceTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.dryRun", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.state", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.error.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.error.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.additionalErrors.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.additionalErrors.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.startTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.endTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalProcessedBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalBilledBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.billingTier", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalSlotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.reservationUsage.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.reservationUsage.slotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalTablesProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedViews.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedViews.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedViews.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalViewsProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.queryOutputRowCount", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.totalLoadOutputBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.version", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.role", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.members", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.condition.expression", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.condition.title", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.condition.description", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.condition.location", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.auditConfigs.service", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.auditConfigs.auditLogConfigs.logType", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.auditConfigs.auditLogConfigs.exemptedMembers", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.etag", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.eventName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobName.jobId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobName.location", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.query", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.defaultDataset.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.defaultDataset.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.tableDefinitions.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.tableDefinitions.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.queryPriority", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.statementType", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.sourceUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.schemaJson", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract.destinationUris", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract.sourceTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract.sourceTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract.sourceTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.sourceTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.sourceTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.sourceTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTable.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTable.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTable.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.createDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.writeDisposition", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTableEncryption.kmsKeyName", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.dryRun", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.labels.key", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.labels.value", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.state", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.error.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.error.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.additionalErrors.code", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.additionalErrors.message", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.createTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.startTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.endTime", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalProcessedBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalBilledBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.billingTier", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalSlotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.reservationUsage.name", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.reservationUsage.slotMs", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedTables.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedTables.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedTables.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalTablesProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedViews.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedViews.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedViews.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalViewsProcessed", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.queryOutputRowCount", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.totalLoadOutputBytes", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents.tableName.projectId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents.tableName.datasetId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents.tableName.tableId", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents.referencedFields", + "count": 7 + }, + { + "fieldName": "textPayload", + "count": 7 + }, + { + "fieldName": "timestamp", + "count": 7 + }, + { + "fieldName": "receiveTimestamp", + "count": 7 + }, + { + "fieldName": "severity", + "count": 7 + }, + { + "fieldName": "insertId", + "count": 7 + }, + { + "fieldName": "httpRequest.requestMethod", + "count": 7 + }, + { + "fieldName": "httpRequest.requestUrl", + "count": 7 + }, + { + "fieldName": "httpRequest.requestSize", + "count": 7 + }, + { + "fieldName": "httpRequest.status", + "count": 7 + }, + { + "fieldName": "httpRequest.responseSize", + "count": 7 + }, + { + "fieldName": "httpRequest.userAgent", + "count": 7 + }, + { + "fieldName": "httpRequest.remoteIp", + "count": 7 + }, + { + "fieldName": "httpRequest.serverIp", + "count": 7 + }, + { + "fieldName": "httpRequest.referer", + "count": 7 + }, + { + "fieldName": "httpRequest.cacheLookup", + "count": 7 + }, + { + "fieldName": "httpRequest.cacheHit", + "count": 7 + }, + { + "fieldName": "httpRequest.cacheValidatedWithOriginServer", + "count": 7 + }, + { + "fieldName": "httpRequest.cacheFillBytes", + "count": 7 + }, + { + "fieldName": "httpRequest.protocol", + "count": 7 + }, + { + "fieldName": "operation.id", + "count": 7 + }, + { + "fieldName": "operation.producer", + "count": 7 + }, + { + "fieldName": "operation.first", + "count": 7 + }, + { + "fieldName": "operation.last", + "count": 7 + }, + { + "fieldName": "trace", + "count": 7 + }, + { + "fieldName": "spanId", + "count": 7 + }, + { + "fieldName": "traceSampled", + "count": 7 + }, + { + "fieldName": "sourceLocation.file", + "count": 7 + }, + { + "fieldName": "sourceLocation.line", + "count": 7 + }, + { + "fieldName": "sourceLocation.function", + "count": 7 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries.viewName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.reservationUsage", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract.sourceTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.reservationUsage", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedViews", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.defaultDataset", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.additionalErrors", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.tableName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.error", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.defaultDataset", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedViews", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.tableDefinitions", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.referencedTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.tableDefinitions", + "count": 1 + }, + { + "fieldName": "resource.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings.condition", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.sourceTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.load.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "sourceLocation", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.extract.sourceTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.view", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.extract", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract.sourceTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest", + "count": 1 + }, + { + "fieldName": "httpRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataListRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.view", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.sourceTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedViews", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest.defaultDataset", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries.viewName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.reservationUsage", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetListRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.auditConfigs.auditLogConfigs", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.defaultDataset", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.defaultDataset", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.defaultDataset", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.info", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableDataReadEvents.tableName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.extract", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.datasetName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.datasetName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.additionalErrors", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.info.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.auditConfigs", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.info.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.tableCopy.sourceTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.encryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.datasetName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.error", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl.entries.viewName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.tableDefinitions", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.encryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics.reservationUsage", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource.encryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics.referencedViews", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.sourceTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.info", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.referencedTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.reservationUsage", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.auditConfigs.auditLogConfigs", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.defaultDataset", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertResponse.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.encryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatus.error", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatistics.reservationUsage", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.bindings", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.query.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics.referencedTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertRequest.resource.acl.entries.viewName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.datasetName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.sourceTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.load.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatus.additionalErrors", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.tableName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobStatistics.referencedViews", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedViews", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract.sourceTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract.sourceTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatus.error", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource.info.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobStatistics", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.tableName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.load", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.policy.auditConfigs", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobStatistics", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource.view", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.load.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.tableDefinitions", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.view", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateRequest.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.error", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.error", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatistics.referencedTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.acl.entries", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus.additionalErrors", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobStatus", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobGetQueryResultsResponse.job.jobConfiguration.query.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.query.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.info", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.setIamPolicyRequest.updateMask", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.tableCopy.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableUpdateResponse.resource.tableName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings.condition", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateResponse.resource.info", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus", + "count": 1 + }, + { + "fieldName": "operation", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.extract", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.tableCopy.sourceTables", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatistics", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.query.tableDefinitions", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.load", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobStatus.additionalErrors", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.info.labels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryDoneResponse.job.jobConfiguration.query.tableDefinitions", + "count": 1 + }, + { + "fieldName": "resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.tableCopy", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.tableCopy", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.policyResponse.bindings", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobStatus.additionalErrors", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertRequest.resource.jobConfiguration.extract", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetInsertResponse.resource.acl", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.tableCopy.destinationTableEncryption", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobCompletedEvent.job.jobConfiguration.extract.sourceTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.status", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobInsertResponse.resource.jobConfiguration.load", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.tableInsertRequest.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.jobQueryResponse.job.jobConfiguration.query.destinationTable", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.servicedata_v1_bigquery.datasetUpdateRequest.resource.acl.entries", + "count": 1 + } ] } }, @@ -126,7 +7378,369 @@ } ], "totalSqlQueries": 0, - "topSqlQueries": [] + "topSqlQueries": [], + "fields": [ + { + "fieldName": "logName", + "count": 1 + }, + { + "fieldName": "resource.type", + "count": 1 + }, + { + "fieldName": "resource.labels.project_id", + "count": 1 + }, + { + "fieldName": "resource.labels.dataset_id", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.serviceName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.methodName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.resourceName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.currentLocations", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.originalLocations", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.numResponseItems", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.status.code", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.status.message", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalEmail", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.authoritySelector", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountKeyName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.principalSubject", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal.principalEmail", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalSubject", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.permission", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.granted", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.service", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.name", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.type", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.key", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.value", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.uid", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.key", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.value", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.displayName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.createTime", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.updateTime", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.deleteTime", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.etag", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.location", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerIp", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerSuppliedUserAgent", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerNetwork", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.id", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.method", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.key", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.value", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.path", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.host", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.scheme", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.query", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.time", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.size", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.protocol", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.reason", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.principal", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.audiences", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.presenter", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.accessLevels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.ip", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.port", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.key", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.value", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.principal", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.regionCode", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.metadataJson", + "count": 1 + }, + { + "fieldName": "textPayload", + "count": 1 + }, + { + "fieldName": "timestamp", + "count": 1 + }, + { + "fieldName": "receiveTimestamp", + "count": 1 + }, + { + "fieldName": "severity", + "count": 1 + }, + { + "fieldName": "insertId", + "count": 1 + }, + { + "fieldName": "httpRequest.requestMethod", + "count": 1 + }, + { + "fieldName": "httpRequest.requestUrl", + "count": 1 + }, + { + "fieldName": "httpRequest.requestSize", + "count": 1 + }, + { + "fieldName": "httpRequest.status", + "count": 1 + }, + { + "fieldName": "httpRequest.responseSize", + "count": 1 + }, + { + "fieldName": "httpRequest.userAgent", + "count": 1 + }, + { + "fieldName": "httpRequest.remoteIp", + "count": 1 + }, + { + "fieldName": "httpRequest.serverIp", + "count": 1 + }, + { + "fieldName": "httpRequest.referer", + "count": 1 + }, + { + "fieldName": "httpRequest.cacheLookup", + "count": 1 + }, + { + "fieldName": "httpRequest.cacheHit", + "count": 1 + }, + { + "fieldName": "httpRequest.cacheValidatedWithOriginServer", + "count": 1 + }, + { + "fieldName": "httpRequest.cacheFillBytes", + "count": 1 + }, + { + "fieldName": "httpRequest.protocol", + "count": 1 + }, + { + "fieldName": "operation.id", + "count": 1 + }, + { + "fieldName": "operation.producer", + "count": 1 + }, + { + "fieldName": "operation.first", + "count": 1 + }, + { + "fieldName": "operation.last", + "count": 1 + }, + { + "fieldName": "trace", + "count": 1 + }, + { + "fieldName": "spanId", + "count": 1 + }, + { + "fieldName": "traceSampled", + "count": 1 + }, + { + "fieldName": "sourceLocation.file", + "count": 1 + }, + { + "fieldName": "sourceLocation.line", + "count": 1 + }, + { + "fieldName": "sourceLocation.function", + "count": 1 + } + ] } }, { @@ -146,6 +7760,56 @@ "topSqlQueries": [ "SELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`", "# CREATE OR REPLACE TABLE test_schema.excess_deaths_derived AS (SELECT * FROM `bigquery-public-data.covid19_nyt.excess_deaths` LIMIT 10);\n\nSELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`;\n" + ], + "fields": [ + { + "fieldName": "deaths", + "count": 2 + }, + { + "fieldName": "end_date", + "count": 2 + }, + { + "fieldName": "excess_deaths", + "count": 2 + }, + { + "fieldName": "frequency", + "count": 2 + }, + { + "fieldName": "placename", + "count": 2 + }, + { + "fieldName": "start_date", + "count": 2 + }, + { + "fieldName": "week", + "count": 2 + }, + { + "fieldName": "baseline", + "count": 2 + }, + { + "fieldName": "country", + "count": 2 + }, + { + "fieldName": "month", + "count": 2 + }, + { + "fieldName": "expected_deaths", + "count": 2 + }, + { + "fieldName": "year", + "count": 2 + } ] } }, @@ -165,6 +7829,56 @@ "totalSqlQueries": 1, "topSqlQueries": [ "# CREATE OR REPLACE TABLE test_schema.excess_deaths_derived AS (SELECT * FROM `bigquery-public-data.covid19_nyt.excess_deaths` LIMIT 10);\n\nSELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`;\n" + ], + "fields": [ + { + "fieldName": "excess_deaths", + "count": 1 + }, + { + "fieldName": "frequency", + "count": 1 + }, + { + "fieldName": "deaths", + "count": 1 + }, + { + "fieldName": "baseline", + "count": 1 + }, + { + "fieldName": "week", + "count": 1 + }, + { + "fieldName": "month", + "count": 1 + }, + { + "fieldName": "placename", + "count": 1 + }, + { + "fieldName": "country", + "count": 1 + }, + { + "fieldName": "start_date", + "count": 1 + }, + { + "fieldName": "year", + "count": 1 + }, + { + "fieldName": "expected_deaths", + "count": 1 + }, + { + "fieldName": "end_date", + "count": 1 + } ] } }, @@ -184,6 +7898,104 @@ "totalSqlQueries": 1, "topSqlQueries": [ "# CREATE OR REPLACE TABLE test_schema.excess_deaths_derived AS (SELECT * FROM `bigquery-public-data.covid19_nyt.excess_deaths` LIMIT 10);\n\nSELECT * FROM `harshal-playground-306419.test_schema.austin311_derived`;\n" + ], + "fields": [ + { + "fieldName": "last_update_date", + "count": 1 + }, + { + "fieldName": "created_date", + "count": 1 + }, + { + "fieldName": "location", + "count": 1 + }, + { + "fieldName": "city", + "count": 1 + }, + { + "fieldName": "complaint_type", + "count": 1 + }, + { + "fieldName": "status_change_date", + "count": 1 + }, + { + "fieldName": "street_number", + "count": 1 + }, + { + "fieldName": "state_plane_x_coordinate", + "count": 1 + }, + { + "fieldName": "incident_zip", + "count": 1 + }, + { + "fieldName": "source", + "count": 1 + }, + { + "fieldName": "council_district_code", + "count": 1 + }, + { + "fieldName": "map_tile", + "count": 1 + }, + { + "fieldName": "state_plane_y_coordinate", + "count": 1 + }, + { + "fieldName": "map_page", + "count": 1 + }, + { + "fieldName": "unique_key", + "count": 1 + }, + { + "fieldName": "owning_department", + "count": 1 + }, + { + "fieldName": "street_name", + "count": 1 + }, + { + "fieldName": "complaint_description", + "count": 1 + }, + { + "fieldName": "longitude", + "count": 1 + }, + { + "fieldName": "incident_address", + "count": 1 + }, + { + "fieldName": "status", + "count": 1 + }, + { + "fieldName": "close_date", + "count": 1 + }, + { + "fieldName": "latitude", + "count": 1 + }, + { + "fieldName": "county", + "count": 1 + } ] } }, @@ -201,7 +8013,369 @@ } ], "totalSqlQueries": 0, - "topSqlQueries": [] + "topSqlQueries": [], + "fields": [ + { + "fieldName": "logName", + "count": 1 + }, + { + "fieldName": "resource.type", + "count": 1 + }, + { + "fieldName": "resource.labels.project_id", + "count": 1 + }, + { + "fieldName": "resource.labels.dataset_id", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.serviceName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.methodName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.resourceName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.currentLocations", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.resourceLocation.originalLocations", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.numResponseItems", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.status.code", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.status.message", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalEmail", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.authoritySelector", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountKeyName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.principalSubject", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.serviceAccountDelegationInfo.firstPartyPrincipal.principalEmail", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authenticationInfo.principalSubject", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resource", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.permission", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.granted", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.service", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.name", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.type", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.key", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.labels.value", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.uid", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.key", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.annotations.value", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.displayName", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.createTime", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.updateTime", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.deleteTime", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.etag", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.authorizationInfo.resourceAttributes.location", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerIp", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerSuppliedUserAgent", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.callerNetwork", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.id", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.method", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.key", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.headers.value", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.path", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.host", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.scheme", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.query", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.time", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.size", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.protocol", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.reason", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.principal", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.audiences", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.presenter", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.requestAttributes.auth.accessLevels", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.ip", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.port", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.key", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.labels.value", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.principal", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.requestMetadata.destinationAttributes.regionCode", + "count": 1 + }, + { + "fieldName": "protopayload_auditlog.metadataJson", + "count": 1 + }, + { + "fieldName": "textPayload", + "count": 1 + }, + { + "fieldName": "timestamp", + "count": 1 + }, + { + "fieldName": "receiveTimestamp", + "count": 1 + }, + { + "fieldName": "severity", + "count": 1 + }, + { + "fieldName": "insertId", + "count": 1 + }, + { + "fieldName": "httpRequest.requestMethod", + "count": 1 + }, + { + "fieldName": "httpRequest.requestUrl", + "count": 1 + }, + { + "fieldName": "httpRequest.requestSize", + "count": 1 + }, + { + "fieldName": "httpRequest.status", + "count": 1 + }, + { + "fieldName": "httpRequest.responseSize", + "count": 1 + }, + { + "fieldName": "httpRequest.userAgent", + "count": 1 + }, + { + "fieldName": "httpRequest.remoteIp", + "count": 1 + }, + { + "fieldName": "httpRequest.serverIp", + "count": 1 + }, + { + "fieldName": "httpRequest.referer", + "count": 1 + }, + { + "fieldName": "httpRequest.cacheLookup", + "count": 1 + }, + { + "fieldName": "httpRequest.cacheHit", + "count": 1 + }, + { + "fieldName": "httpRequest.cacheValidatedWithOriginServer", + "count": 1 + }, + { + "fieldName": "httpRequest.cacheFillBytes", + "count": 1 + }, + { + "fieldName": "httpRequest.protocol", + "count": 1 + }, + { + "fieldName": "operation.id", + "count": 1 + }, + { + "fieldName": "operation.producer", + "count": 1 + }, + { + "fieldName": "operation.first", + "count": 1 + }, + { + "fieldName": "operation.last", + "count": 1 + }, + { + "fieldName": "trace", + "count": 1 + }, + { + "fieldName": "spanId", + "count": 1 + }, + { + "fieldName": "traceSampled", + "count": 1 + }, + { + "fieldName": "sourceLocation.file", + "count": 1 + }, + { + "fieldName": "sourceLocation.line", + "count": 1 + }, + { + "fieldName": "sourceLocation.function", + "count": 1 + } + ] } }, { @@ -221,6 +8395,104 @@ "topSqlQueries": [ "select * from `harshal-playground-306419.test_schema.austin311_derived`", "select complaint_description, complaint_type, unique_key, last_update_date from `harshal-playground-306419.test_schema.austin311_derived`" + ], + "fields": [ + { + "fieldName": "complaint_description", + "count": 2 + }, + { + "fieldName": "last_update_date", + "count": 2 + }, + { + "fieldName": "complaint_type", + "count": 2 + }, + { + "fieldName": "unique_key", + "count": 2 + }, + { + "fieldName": "source", + "count": 1 + }, + { + "fieldName": "city", + "count": 1 + }, + { + "fieldName": "map_tile", + "count": 1 + }, + { + "fieldName": "longitude", + "count": 1 + }, + { + "fieldName": "state_plane_y_coordinate", + "count": 1 + }, + { + "fieldName": "map_page", + "count": 1 + }, + { + "fieldName": "status_change_date", + "count": 1 + }, + { + "fieldName": "latitude", + "count": 1 + }, + { + "fieldName": "incident_zip", + "count": 1 + }, + { + "fieldName": "status", + "count": 1 + }, + { + "fieldName": "created_date", + "count": 1 + }, + { + "fieldName": "county", + "count": 1 + }, + { + "fieldName": "owning_department", + "count": 1 + }, + { + "fieldName": "street_name", + "count": 1 + }, + { + "fieldName": "close_date", + "count": 1 + }, + { + "fieldName": "street_number", + "count": 1 + }, + { + "fieldName": "incident_address", + "count": 1 + }, + { + "fieldName": "state_plane_x_coordinate", + "count": 1 + }, + { + "fieldName": "council_district_code", + "count": 1 + }, + { + "fieldName": "location", + "count": 1 + } ] } } diff --git a/metadata-ingestion/tests/test_helpers/mce_helpers.py b/metadata-ingestion/tests/test_helpers/mce_helpers.py index 5f100b99c5..e79415b94e 100644 --- a/metadata-ingestion/tests/test_helpers/mce_helpers.py +++ b/metadata-ingestion/tests/test_helpers/mce_helpers.py @@ -23,4 +23,4 @@ def assert_mces_equal(output: object, golden: object) -> None: r"root\[\d+\]\['proposedSnapshot'\].+\['aspects'\].+\['createStamp'\]\['time'\]", } diff = deepdiff.DeepDiff(golden, output, exclude_regex_paths=ignore_paths) - assert not diff + assert not diff, str(diff) diff --git a/metadata-ingestion/tests/unit/serde/test_serde_usage.json b/metadata-ingestion/tests/unit/serde/test_serde_usage.json index 9538f6b064..85f80d5836 100644 --- a/metadata-ingestion/tests/unit/serde/test_serde_usage.json +++ b/metadata-ingestion/tests/unit/serde/test_serde_usage.json @@ -13,7 +13,105 @@ } ], "totalSqlQueries": 0, - "topSqlQueries": [] + "topSqlQueries": [], + "fields": [ + { + "fieldName": "unique_key", + "count": 1 + }, + { + "fieldName": "complaint_type", + "count": 1 + }, + { + "fieldName": "complaint_description", + "count": 1 + }, + { + "fieldName": "owning_department", + "count": 1 + }, + { + "fieldName": "source", + "count": 1 + }, + { + "fieldName": "status", + "count": 1 + }, + { + "fieldName": "status_change_date", + "count": 1 + }, + { + "fieldName": "created_date", + "count": 1 + }, + { + "fieldName": "last_update_date", + "count": 1 + }, + { + "fieldName": "close_date", + "count": 1 + }, + { + "fieldName": "incident_address", + "count": 1 + }, + { + "fieldName": "street_number", + "count": 1 + }, + { + "fieldName": "street_name", + "count": 1 + }, + { + "fieldName": "city", + "count": 1 + }, + { + "fieldName": "incident_zip", + "count": 1 + }, + { + "fieldName": "county", + "count": 1 + }, + { + "fieldName": "state_plane_x_coordinate", + "count": 1 + }, + { + "fieldName": "state_plane_y_coordinate", + "count": 1 + }, + { + "fieldName": "latitude", + "count": 1 + }, + { + "fieldName": "longitude", + "count": 1 + }, + { + "fieldName": "location", + "count": 1 + }, + { + "fieldName": "council_district_code", + "count": 1 + }, + { + "fieldName": "map_page", + "count": 1 + }, + { + "fieldName": "map_tile", + "count": 1 + } + ] } }, { @@ -33,84 +131,56 @@ "topSqlQueries": [ "\nSELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`;\n\n", "SELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`" - ] - } - }, - { - "bucket": 1622160000000, - "duration": "DAY", - "resource": "urn:li:dataset:(urn:li:dataPlatform:bigquery,harshal-playground-306419.test_schema.excess_deaths_derived,PROD)", - "metrics": { - "uniqueUserCount": 1, - "users": [ - { - "user": "urn:li:corpuser:unknown", - "count": 2, - "userEmail": "harshal@acryl.io" - } ], - "totalSqlQueries": 2, - "topSqlQueries": [ - "SELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`", - "# CREATE OR REPLACE TABLE test_schema.excess_deaths_derived AS (SELECT * FROM `bigquery-public-data.covid19_nyt.excess_deaths` LIMIT 10);\n\nSELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`;\n" - ] - } - }, - { - "bucket": 1622505600000, - "duration": "DAY", - "resource": "urn:li:dataset:(urn:li:dataPlatform:bigquery,harshal-playground-306419.test_schema.excess_deaths_derived,PROD)", - "metrics": { - "uniqueUserCount": 1, - "users": [ + "fields": [ { - "user": "urn:li:corpuser:unknown", - "count": 1, - "userEmail": "harshal@acryl.io" - } - ], - "totalSqlQueries": 1, - "topSqlQueries": [ - "# CREATE OR REPLACE TABLE test_schema.excess_deaths_derived AS (SELECT * FROM `bigquery-public-data.covid19_nyt.excess_deaths` LIMIT 10);\n\nSELECT * FROM `harshal-playground-306419.test_schema.excess_deaths_derived`;\n" - ] - } - }, - { - "bucket": 1622505600000, - "duration": "DAY", - "resource": "urn:li:dataset:(urn:li:dataPlatform:bigquery,harshal-playground-306419.test_schema.austin311_derived,PROD)", - "metrics": { - "uniqueUserCount": 1, - "users": [ + "fieldName": "placename", + "count": 4 + }, { - "user": "urn:li:corpuser:unknown", - "count": 1, - "userEmail": "harshal@acryl.io" - } - ], - "totalSqlQueries": 1, - "topSqlQueries": [ - "# CREATE OR REPLACE TABLE test_schema.excess_deaths_derived AS (SELECT * FROM `bigquery-public-data.covid19_nyt.excess_deaths` LIMIT 10);\n\nSELECT * FROM `harshal-playground-306419.test_schema.austin311_derived`;\n" - ] - } - }, - { - "bucket": 1623888000000, - "duration": "DAY", - "resource": "urn:li:dataset:(urn:li:dataPlatform:bigquery,harshal-playground-306419.test_schema.austin311_derived,PROD)", - "metrics": { - "uniqueUserCount": 1, - "users": [ + "fieldName": "excess_deaths", + "count": 4 + }, { - "user": "urn:li:corpuser:unknown", - "count": 2, - "userEmail": "harshal@acryl.io" + "fieldName": "deaths", + "count": 4 + }, + { + "fieldName": "end_date", + "count": 4 + }, + { + "fieldName": "frequency", + "count": 4 + }, + { + "fieldName": "expected_deaths", + "count": 4 + }, + { + "fieldName": "start_date", + "count": 4 + }, + { + "fieldName": "baseline", + "count": 4 + }, + { + "fieldName": "year", + "count": 4 + }, + { + "fieldName": "month", + "count": 4 + }, + { + "fieldName": "week", + "count": 4 + }, + { + "fieldName": "country", + "count": 4 } - ], - "totalSqlQueries": 2, - "topSqlQueries": [ - "select * from `harshal-playground-306419.test_schema.austin311_derived`", - "select complaint_description, complaint_type, unique_key, last_update_date from `harshal-playground-306419.test_schema.austin311_derived`" ] } } diff --git a/metadata-io/src/main/java/com/linkedin/metadata/usage/elasticsearch/ElasticUsageService.java b/metadata-io/src/main/java/com/linkedin/metadata/usage/elasticsearch/ElasticUsageService.java index 3f0fe53576..142e0417a2 100644 --- a/metadata-io/src/main/java/com/linkedin/metadata/usage/elasticsearch/ElasticUsageService.java +++ b/metadata-io/src/main/java/com/linkedin/metadata/usage/elasticsearch/ElasticUsageService.java @@ -14,6 +14,8 @@ import com.linkedin.metadata.search.elasticsearch.update.BulkListener; import com.linkedin.metadata.usage.UsageService; import com.linkedin.metadata.utils.elasticsearch.IndexConvention; import com.linkedin.common.WindowDuration; +import com.linkedin.usage.FieldUsageCounts; +import com.linkedin.usage.FieldUsageCountsArray; import com.linkedin.usage.UsageAggregation; import com.linkedin.usage.UsageAggregationMetrics; import com.linkedin.usage.UserUsageCounts; @@ -139,6 +141,16 @@ public class ElasticUsageService implements UsageService { document.set("metrics.top_sql_queries", sqlQueriesDocument); }); + Optional.ofNullable(bucket.getMetrics().getFields()).ifPresent(fields -> { + ArrayNode fieldsDocument = JsonNodeFactory.instance.arrayNode(); + fields.forEach(fieldUsage -> { + ObjectNode fieldDocument = JsonNodeFactory.instance.objectNode(); + fieldDocument.set("field_name", JsonNodeFactory.instance.textNode(fieldUsage.getFieldName())); + fieldDocument.set("count", JsonNodeFactory.instance.numberNode(fieldUsage.getCount())); + fieldsDocument.add(fieldDocument); + }); + document.set("metrics.fields", fieldsDocument); + }); return document.toString(); } @@ -167,7 +179,6 @@ public class ElasticUsageService implements UsageService { if (endTime != null) { finalQuery.must(QueryBuilders.rangeQuery(ES_KEY_BUCKET_END).lte(endTime)); } - // TODO handle "latest N buckets" style queries final SearchSourceBuilder searchSourceBuilder = new SearchSourceBuilder(); searchSourceBuilder.query(finalQuery); @@ -231,6 +242,18 @@ public class ElasticUsageService implements UsageService { metrics.setTopSqlQueries(queries); } + if (docFields.containsKey("metrics.fields")) { + FieldUsageCountsArray fields = new FieldUsageCountsArray(); + List> docUsers = (List>) docFields.get("metrics.fields"); + for (Map map : docUsers) { + FieldUsageCounts fieldUsage = new FieldUsageCounts(); + fieldUsage.setFieldName((String) map.get("field_name")); + fieldUsage.setCount((Integer) map.get("count")); + fields.add(fieldUsage); + } + metrics.setFields(fields); + } + return agg; } catch (URISyntaxException e) { throw new IllegalArgumentException(e); diff --git a/metadata-models/src/main/pegasus/com/linkedin/usage/FieldUsageCounts.pdl b/metadata-models/src/main/pegasus/com/linkedin/usage/FieldUsageCounts.pdl new file mode 100644 index 0000000000..c2a29dcdba --- /dev/null +++ b/metadata-models/src/main/pegasus/com/linkedin/usage/FieldUsageCounts.pdl @@ -0,0 +1,7 @@ +namespace com.linkedin.usage + +/** Records field-level usage counts for a given resource */ +record FieldUsageCounts { + fieldName: string + count: int +} diff --git a/metadata-models/src/main/pegasus/com/linkedin/usage/UsageAggregationMetrics.pdl b/metadata-models/src/main/pegasus/com/linkedin/usage/UsageAggregationMetrics.pdl index 442ab8f814..a69ede7afd 100644 --- a/metadata-models/src/main/pegasus/com/linkedin/usage/UsageAggregationMetrics.pdl +++ b/metadata-models/src/main/pegasus/com/linkedin/usage/UsageAggregationMetrics.pdl @@ -16,4 +16,7 @@ record UsageAggregationMetrics { /** Frequent SQL queries; mostly makes sense for datasets in SQL databases */ topSqlQueries: optional array[string] + + /** Field-level usage stats */ + fields: optional array[FieldUsageCounts] } diff --git a/metadata-models/src/main/pegasus/com/linkedin/usage/UsageQueryResult.pdl b/metadata-models/src/main/pegasus/com/linkedin/usage/UsageQueryResult.pdl index d0b2269fea..0cdb692e9c 100644 --- a/metadata-models/src/main/pegasus/com/linkedin/usage/UsageQueryResult.pdl +++ b/metadata-models/src/main/pegasus/com/linkedin/usage/UsageQueryResult.pdl @@ -17,5 +17,7 @@ record UsageQueryResult { totalSqlQueries: optional int users: optional array[UserUsageCounts] + + fields: optional array[FieldUsageCounts] } } diff --git a/smoke-test/test_e2e.py b/smoke-test/test_e2e.py index 5ee68b4b01..0cd74b8d3a 100644 --- a/smoke-test/test_e2e.py +++ b/smoke-test/test_e2e.py @@ -10,6 +10,9 @@ FRONTEND_ENDPOINT = "http://localhost:9002" KAFKA_BROKER = "localhost:9092" bootstrap_sample_data = "../metadata-ingestion/examples/mce_files/bootstrap_mce.json" +usage_sample_data = ( + "../metadata-ingestion/tests/integration/bigquery-usage/bigquery_usages_golden.json" +) bq_sample_data = "./sample_bq_data.json" restli_default_headers = { "X-RestLi-Protocol-Version": "2.0.0", @@ -30,13 +33,12 @@ def test_healthchecks(wait_for_healthchecks): pass -@pytest.mark.dependency(depends=["test_healthchecks"]) -def test_ingestion_via_rest(wait_for_healthchecks): +def ingest_file(filename: str): pipeline = Pipeline.create( { "source": { "type": "file", - "config": {"filename": bootstrap_sample_data}, + "config": {"filename": filename}, }, "sink": { "type": "datahub-rest", @@ -48,6 +50,16 @@ def test_ingestion_via_rest(wait_for_healthchecks): pipeline.raise_from_status() +@pytest.mark.dependency(depends=["test_healthchecks"]) +def test_ingestion_via_rest(wait_for_healthchecks): + ingest_file(bootstrap_sample_data) + + +@pytest.mark.dependency(depends=["test_healthchecks"]) +def test_ingestion_usage_via_rest(wait_for_healthchecks): + ingest_file(usage_sample_data) + + @pytest.mark.dependency(depends=["test_healthchecks"]) def test_ingestion_via_kafka(wait_for_healthchecks): pipeline = Pipeline.create( @@ -74,7 +86,13 @@ def test_ingestion_via_kafka(wait_for_healthchecks): time.sleep(kafka_post_ingestion_wait_sec) -@pytest.mark.dependency(depends=["test_ingestion_via_rest", "test_ingestion_via_kafka"]) +@pytest.mark.dependency( + depends=[ + "test_ingestion_via_rest", + "test_ingestion_via_kafka", + "test_ingestion_usage_via_rest", + ] +) def test_run_ingestion(wait_for_healthchecks): # Dummy test so that future ones can just depend on this one. pass @@ -193,6 +211,39 @@ def test_gms_search_dataset(query, min_expected_results): assert data["elements"][0]["urn"] +@pytest.mark.dependency(depends=["test_healthchecks", "test_run_ingestion"]) +def test_gms_usage_fetch(): + response = requests.post( + f"{GMS_ENDPOINT}/usageStats?action=queryRange", + headers=restli_default_headers, + json={ + "resource": "urn:li:dataset:(urn:li:dataPlatform:bigquery,harshal-playground-306419.test_schema.excess_deaths_derived,PROD)", + "duration": "DAY", + "rangeFromEnd": "ALL", + }, + ) + response.raise_for_status() + + data = response.json()["value"] + + assert len(data["buckets"]) == 3 + assert data["buckets"][0]["metrics"]["topSqlQueries"] + + fields = data["aggregations"].pop("fields") + assert len(fields) == 12 + assert fields[0]["count"] == 7 + + users = data["aggregations"].pop("users") + assert len(users) == 1 + assert users[0]["count"] == 7 + + assert data["aggregations"] == { + # "fields" and "users" already popped out + "totalSqlQueries": 7, + "uniqueUserCount": 1, + } + + @pytest.fixture(scope="session") def frontend_session(wait_for_healthchecks): session = requests.Session()