Google workspace connection

You can set up a feed connection to the specific tenant you want and label it for advanced filtering:
https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-workspace-logs

​@Eoved 
Thanks for your answer. I know this solution but i need to set filter before i send the logs to secops, there are two tenants in our workspace and we dont want to ingest all them!

​@yasinmnk Hi,

I see multiple customers having this issue, have you been able to resolve it, I say posts from you ingesting via BigQuery, did that resolve your topic?

Thank you

Hi ​@Florian11_2  Unfortunately there is no solution if you want to ingest via feed i have tried to filter logs in bigquery but it was unsuccesfull , you can either seperate the tenants or use Bindplane to use regex filters, where you can set filter to send only the logs that you want.

There is a private preview feature - https://docs.cloud.google.com/chronicle/docs/ingestion/data-processing-pipeline - which enables you to filter logs (prior to ingestion and charging) so as long as there is an org or OU id in the workspace logs (which I’m pretty sure there is) you can filter

​@cmmartin_google is there any tutorial or walkthrough you can point to for how to filter specifically workspace logs using this method? This is a question that’s come up a lot