google/skills已通过检查
SKILL DETAIL
cloud-logging-query-generation
google/skills/cloud-logging-query-generation
此技能用于根据自然语言描述生成正确的 Logging Query Language (LQL) 查询，以查询 Google Cloud Logging 中的日志数据。它特别适用于调试问题和按 Google Cloud 服务过滤日志数据。该技能遵循严格的语法要求，例如使用双引号表示字符串、使用大写布尔运算符以及使用括号明确优先级。它提供了针对各种 Google Cloud 服务的参考文件，以确保资源类型和日志 ID 的准确性。 该技能强调避免常见陷阱，例如混淆实例 ID 和实例名称，或猜测资源类型。它指导用户使用 SEARCH 函数进行全局搜索，并在不确定字段结构时添加注释。输出仅为原始 LQL 查询文本，不包含对话性内容，除非用户明确要求，否则不使用 Markdown 代码块。
安装量 · 141查看来源
Installation
npx skills add https://github.com/google/skills --skill cloud-logging-query-generation
技能文件
SKILL.md
最近同步 · 2026年8月28日
references/api_reference.md›
# LQL syntax reference and guidelines
## Table of contents
- [Boolean operators](#boolean-operators) (L15-L20)
- [Comparison operators and matching patterns](#comparison-operators-and-matching-patterns) (L22-L30)
- [Null values and missing fields](#null-values-and-missing-fields) (L32-L41)
- [Escaping, quotes and case sensitivity](#escaping-quotes-and-case-sensitivity) (L43-L51)
- [Built-in SEARCH function](#built-in-search-function) (L53-L83)
- [Regular expressions](#regular-expressions) (L85-L93)
- [Timestamps and ranges](#timestamps-and-ranges) (L95-L98)
- [Additional built-in functions](#additional-built-in-functions) (L100-L117)
- [Comments](#comments) (L119-L122)
## Boolean operators
* **Implicit comparisons and minus sign:** `AND` can be omitted between
space-separated expressions. `NOT` can be replaced with `-`.
* *Example:* `a="b" AND c="d" AND NOT e="f"` is identical to `a="b" c="d"
-e="f"`.
## Comparison operators and matching patterns
* **Syntax Structure:** `[FIELD_NAME] [OP] [VALUE]`
* **Operators Supported:** `=` (equal), `!=` (not equal), `>`, `<`, `>=`, `<=`
(numeric ordering), `:` (substring search), `=~` (regex match), `!~` (regex
non-match).
* **Parenthesized Values:** An operator can be applied to a list of values.
* *Example:* `jsonPayload.cat = ("longhair" OR "shorthair")`
* *Example:* `jsonPayload.animal : ("nice" AND "pet")`
## Null values and missing fields
* **JSON Null Handling:** Filter for explicit null values using `NULL_VALUE`.
* *Example:* `jsonPayload.field = NULL_VALUE`
* **Missing Fields:** If a field is entirely absent from a log entry,
comparisons return false for equality operations but true for negations.
* *Example:* `NOT missingField="some value"` returns `TRUE`.
* *Example:* `missingField!="some value"` returns `FALSE`.
* **Field-Exists Check:** Use the `:*` wildcard to verify a field exists.
* *Example:* `operation.id:*`
## Escaping, quotes and case sensitivity
* Field paths mapping keys to struct/map fields (like `jsonPayload` and
`labels`) are **case-sensitive** (for example, `jsonPayload.endTime` vs
`jsonPayload.end_time`).
* If a field path contains special characters (like slashes or periods), it
must be inside double quotes: `labels."compute.googleapis.com/resource_id"`.
* Embedded double quotes must be backslash-escaped: `jsonPayload.message =~
"location=\"europe-west.*\""`.
## Built-in SEARCH function
* **Argument Restriction:** The query argument must be a **single string
literal**.
* **No Boolean Expressions in Arguments:** Do NOT pass boolean expressions
(using `OR`, `AND`, `NOT` as operators) directly as arguments to the
`SEARCH` function.
* *Example:* `SEARCH("OOM") OR SEARCH("Out of memory")`
* *Example:* ``SEARCH("OOM OR `Out of memory`")`` (evaluates "OR" as part
of the search string, not as a boolean condition)
* Case-insensitive substring search that splits strings into tokens.
* *Example (Global search):* Matches log entries containing both tokens
anywhere.
```
SEARCH("hello world")
```
* *Example (Targeted search):* Matches log entries containing both tokens
within `textPayload` field only.
```
SEARCH(textPayload, "hello world")
```
* *Example (Exact phrase):* Enforces token order and adjacency.
```
SEARCH("`exact phrase match`")
```
## Regular expressions
* Regular expressions use RE2 syntax, are case sensitive, and are unanchored.
* *Example (Anchored matching):* `logName =~ "^foo"` or `logName =~
"foo$"`
* *Example (OR condition inside regex):* `labels.pod_name =~ "(foo|bar)"`
* *Example (Combined OR on the right side):* `labels.env =~
("^prod.*server" OR "^staging.*server")`
* *Example (Case-insensitive flag):* `labels.subnetwork_name =~ "(?i)foo"`
## Timestamps and ranges
* Strict RFC 3339 bounds: `timestamp >= "2023-11-29T23:00:00Z"`
* Date shortcuts: `timestamp > "2023-11-29"`
## Additional built-in functions
* **`log_id`**: Matches non-URL-encoded log IDs.
* *Example:* `log_id("cloudaudit.googleapis.com/activity")`
* **`source`**: Matches logs derived from a specific level of the Google Cloud
resource hierarchy.
* *Example:* `source(folders/folder_123)`
* **`sample`**: Selects a fraction of total log entries using deterministic
hashing.
* *Example:* `sample(insertId, 0.01)`
* **`cast`**: Converts a field into another data type.
* *Example:* `cast(timestamp, STRING, TIME_ZONE("America/New_York")) =~
"^2025-04-02.*"`
* **`regexp_extract`**: Extracts part of a field using an RE2 capture group.
* *Example:* `CAST(REGEXP_EXTRACT(CAST(timestamp, STRING),
"\\d+:\\d+:(\\d+)"), INT64) < 30`
* **`ip_in_net`**: Determines if an IP address belongs to a subnet block.
* *Example:* `ip_in_net(jsonPayload.realClientIP, "10.1.2.0/24")`
## Comments
* Prepend double dashes `--` to add single-line annotations.
* *Example:* `-- Looking for logs from "alex"`
references/query_app_engine.md›
# App Engine LQL queries
## Base schema and structural patterns
App Engine logs are anchored to the `gae_app` resource type.
### Targeting specific workloads
* **Service and Version Isolation**: Filter using
`resource.labels.module_id="<MODULE_ID>"` (for the Service) and
`resource.labels.version_id="<VERSION_ID>"` (for the Version).
### Log routing and correlation
* **Request Logs**: Use `log_id("appengine.googleapis.com/request_log")` to
capture HTTP ingress telemetry.
* **Audit Logs**: Inspect deployment operations by validating
`protoPayload.serviceName="appengine.googleapis.com"`.
* **Trace ID**: Correlate all logs emitted during a single HTTP request
execution by filtering via
`trace="projects/<PROJECT_ID>/traces/<TRACE_ID>"`.
## Example queries
### High severity errors in a specific time range
**Variables to replace:** `<START_TIME>`, `<END_TIME>`
```lql
resource.type="gae_app"
severity >= ERROR
timestamp >= "<START_TIME>"
timestamp <= "<END_TIME>"
```
### HTTP requests that resulted in a 5xx server error
**Variables to replace:** None
```lql
resource.type="gae_app"
log_id("appengine.googleapis.com/request_log")
httpRequest.status >= 500
```
### App Engine logs from New Year's Eve (in UTC time)
**Variables to replace:** None
```lql
resource.type="gae_app" AND
severity>=ERROR AND
timestamp>="2025-12-31T00:00:00Z" AND timestamp<="2026-01-01T00:00:00Z"
```
### Sampled HTTP error logs
**Variables to replace:** None
```lql
resource.type="gae_app" AND
protoPayload.status >= 400 AND
sample(insertId, 0.1)
```
### App Engine log entries with a trace ID
**Variables to replace:** `<PROJECT_ID>`, `<TRACE_ID>`
```lql
resource.type="gae_app" AND
trace="projects/<PROJECT_ID>/traces/<TRACE_ID>"
```
### App Engine logs
**Variables to replace:** `<MODULE_ID>`, `<VERSION_ID>`
```lql
resource.type="gae_app" AND
resource.labels.module_id="<MODULE_ID>" AND
resource.labels.version_id="<VERSION_ID>"
```
### Log entries from App Engine deployments
**Variables to replace:** None
```lql
resource.type="gae_app" AND
protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND
protoPayload.serviceName="appengine.googleapis.com"
```
references/query_audit_logs.md›
# Audit logs reference
## Table of contents
- [Log types (log_id)](#log-types-log_id) (L19-L35)
- [Base schema (protoPayload)](#base-schema-protopayload) (L37-L75)
- [Common structural patterns](#common-structural-patterns) (L77-L112)
- [The policy and IAM mutation pattern](#the-policy-and-iam-mutation-pattern) (L82-L89)
- [The client configuration pattern](#the-client-configuration-pattern) (L91-L112)
- [Example queries](#example-queries) (L114-L199)
- [IAM role added or removed for a principal (Admin Activity)](#iam-role-added-or-removed-for-a-principal-admin-activity) (L116-L129)
- [GCE Firewall rule logging disabled (Admin Activity)](#gce-firewall-rule-logging-disabled-admin-activity) (L131-L140)
- [VPC SC access level attached to a perimeter (Admin Activity)](#vpc-sc-access-level-attached-to-a-perimeter-admin-activity) (L142-L152)
- [API service disabled (Admin Activity)](#api-service-disabled-admin-activity) (L154-L165)
- [BigQuery job execution (Data Access)](#bigquery-job-execution-data-access) (L167-L176)
- [GCE node preempted (System Event)](#gce-node-preempted-system-event) (L178-L187)
- [VPC Service Controls access blocked (Policy Denied)](#vpc-service-controls-access-blocked-policy-denied) (L189-L199)
## Log types (log_id)
GCP Audit logs are strictly categorized into 4 types. Depending on the intent,
filter your queries using the corresponding `log_id()`:
* **Admin Activity** (`log_id("cloudaudit.googleapis.com/activity")`):
User-driven API calls that **modify** configuration or metadata (for
example, creating VMs, changing IAM roles).
* **Data Access** (`log_id("cloudaudit.googleapis.com/data_access")`): API
calls that **read** configuration/metadata, or user-driven calls that
create, modify, or read user-provided *data*.
* **System Event** (`log_id("cloudaudit.googleapis.com/system_event")`):
**Google Cloud systems** modifying resources automatically (not driven by
direct user action, like autoscalers).
* **Policy Denied** (`log_id("cloudaudit.googleapis.com/policy")`): A Google
Cloud service denies access because of a security policy violation (for
example, VPC Service Controls blocking access).
## Base schema (protoPayload)
**Actor details (Who did it?)**
* `protoPayload.authenticationInfo.principalEmail`: The email of the
authenticated user or service account. (Example: `="[email protected]"`)
**Action details (What was done?)**
* `protoPayload.methodName`: The API method called.
* *Gotcha:* Prefer the exact match operator (`=`) when you know the exact
API string. Use the scoped `SEARCH()` function (e.g.,
`SEARCH(protoPayload.methodName, "compute.instances.insert")`) as a
fallback if you do not reliably know the full method name prefix. Do NOT
use the colon operator (`:`) as it may cause false positives by matching
a substring.
* `protoPayload.resourceName`: The exact resource being acted upon.
**Network and Context (From where/how?)**
* `protoPayload.requestMetadata.callerIp`: The IP address of the caller.
(Example: `="192.168.1.1"`)
* `protoPayload.requestMetadata.requestAttributes.*`: Context used for IAM
condition evaluations (for example, `.time` or `.reason`).
**Authorization and Permissions (Why was it allowed/denied?)**
* `protoPayload.authorizationInfo.permission`: The IAM permission checked.
(Example: `="compute.instances.delete"`)
* `protoPayload.authorizationInfo.granted`: Whether the permission check
succeeded (`true` or `false`).
* `protoPayload.authorizationInfo.resource`: The specific resource the
permission was checked against.
**Outcomes (Did it succeed?)**
* `protoPayload.status.code`: The RPC status code (0 means success). To find
failures, use `protoPayload.status.code!=0`.
* `protoPayload.status.message`: The developer-facing error message.
## Common structural patterns
Audit log custom payloads structure information differently depending on the
intent. Use these patterns to synthesize queries.
### The policy and IAM mutation pattern
When a user asks about changes to permissions, roles, or access rules across
*any* service (IAM, Storage, and others), GCP almost always puts this in
`policyDelta` rather than the raw request.
**Rule:** For role or permission changes, look under
`protoPayload.serviceData.policyDelta` (or `metadata.policyDelta`).
### The client configuration pattern
When a user wants to know if a specific configuration setting was applied (for
example, "was logging disabled?", "what IP was assigned?"), that data lives in
the `request` payload.
**Rule:** For user-provided configuration values, look under
`protoPayload.request`.
**Warning:** The structure of `protoPayload.request` maps exactly to the
underlying REST/gRPC API schema of each individual service and varies
drastically between them. Do not assume its structure, but you may cautiously
inspect `protoPayload.request` (for example, `protoPayload.request.account_id`)
or `protoPayload.response` if it logically maps to the user's intent. Do not
fall back to `protoPayload.resourceName` for identifying newly created target
resources, as `resourceName` often reflects the parent scope (e.g., the
Project).
**Note:** For state diffs and update verifications (to ensure something was
*newly* added rather than just present in a broader update), you must also use
the `protoPayload.metadata.previousState` object (for example, negating it to
ensure it wasn't there before).
## Example queries
### IAM role added or removed for a principal (Admin Activity)
**Variables to replace:** `<USER_EMAIL>` *(Note: Change resource.type to
"folder" or "organization" for higher-level changes)*
```lql
log_id("cloudaudit.googleapis.com/activity") AND
resource.type="project" AND
protoPayload.methodName="SetIamPolicy" AND
protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND
(protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" OR
protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE") AND
protoPayload.serviceData.policyDelta.bindingDeltas.member="user:<USER_EMAIL>"
```
### GCE Firewall rule logging disabled (Admin Activity)
**Variables to replace:** None
```lql
log_id("cloudaudit.googleapis.com/activity") AND
resource.type="gce_firewall_rule" AND
protoPayload.methodName="v1.compute.firewalls.patch" AND
protoPayload.request.logConfig.enable="false"
```
### VPC SC access level attached to a perimeter (Admin Activity)
**Variables to replace:** `<ACCESS_LEVEL_NAME>`
```lql
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="accesscontextmanager.googleapis.com" AND
SEARCH(protoPayload.methodName, "UpdateServicePerimeter") AND
protoPayload.request.servicePerimeter.spec.accessLevels:"<ACCESS_LEVEL_NAME>" AND
-protoPayload.metadata.previousState:"<ACCESS_LEVEL_NAME>"
```
### API service disabled (Admin Activity)
**Variables to replace:** `<API_NAME>` *(Note: To find when a generic API was
disabled, use `audited_resource`, which differs from normal service endpoints.)*
```lql
log_id("cloudaudit.googleapis.com/activity") AND
resource.type="audited_resource" AND
protoPayload.methodName="google.api.serviceusage.v1.ServiceUsage.DisableService" AND
protoPayload.authorizationInfo.granted="true" AND
protoPayload.authorizationInfo.resource:"services/<API_NAME>.googleapis.com"
```
### BigQuery job execution (Data Access)
**Variables to replace:** `<USER_EMAIL>`
```lql
log_id("cloudaudit.googleapis.com/data_access") AND
resource.type="bigquery_project" AND
protoPayload.methodName=("google.cloud.bigquery.v2.JobService.InsertJob" OR "google.cloud.bigquery.v2.JobService.Query") AND
protoPayload.authenticationInfo.principalEmail="<USER_EMAIL>"
```
### GCE node preempted (System Event)
**Variables to replace:** `<INSTANCE_ID>`
```lql
log_id("cloudaudit.googleapis.com/system_event") AND
resource.type="gce_instance" AND
protoPayload.methodName="compute.instances.preempted" AND
resource.labels.instance_id="<INSTANCE_ID>"
```
### VPC Service Controls access blocked (Policy Denied)
**Variables to replace:** `<UNIQUE_ID>`
```lql
log_id("cloudaudit.googleapis.com/policy") AND
severity=ERROR AND
resource.type="audited_resource" AND
protoPayload.metadata.@type="type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata" AND
protoPayload.metadata.vpcServiceControlsUniqueId="<UNIQUE_ID>"
```
references/query_bigquery.md›
# BigQuery LQL queries
## Table of contents
- [Base schema and structural patterns](#base-schema-and-structural-patterns) (L25-L54)
- [Core resource types](#core-resource-types) (L31-L39)
- [The metadata abstraction](#the-metadata-abstraction) (L41-L54)
- [Example queries](#example-queries) (L56-L203)
- [BigQuery audit logs related to datasets or projects](#bigquery-audit-logs-related-to-datasets-or-projects) (L58-L65)
- [Logs for queries that billed more than 1GB (1073741824 bytes)](#logs-for-queries-that-billed-more-than-1gb-1073741824-bytes) (L67-L74)
- [BigQuery audit logs for a project](#bigquery-audit-logs-for-a-project) (L76-L83)
- [BigQuery audit logs for a dataset](#bigquery-audit-logs-for-a-dataset) (L85-L92)
- [BigQuery audit logs for BI Engine model](#bigquery-audit-logs-for-bi-engine-model) (L94-L101)
- [BigQuery audit logs for a Data Transfer Service run.](#bigquery-audit-logs-for-a-data-transfer-service-run) (L103-L110)
- [BigQuery audit logs for a Data Transfer Service configuration.](#bigquery-audit-logs-for-a-data-transfer-service-configuration) (L112-L119)
- [BigQuery Data Transfer Service jobs](#bigquery-data-transfer-service-jobs) (L121-L131)
- [BigQuery transfer run logs](#bigquery-transfer-run-logs) (L133-L141)
- [BigQuery dataset updates](#bigquery-dataset-updates) (L143-L151)
- [BigQuery jobs completed](#bigquery-jobs-completed) (L153-L162)
- [BigQuery quota exceeded](#bigquery-quota-exceeded) (L164-L173)
- [BigQuery query started](#bigquery-query-started) (L175-L182)
- [BigQuery concurrent load/extract jobs](#bigquery-concurrent-loadextract-jobs) (L184-L193)
- [BigQuery audit logs for row access policy](#bigquery-audit-logs-for-row-access-policy) (L195-L203)
## Base schema and structural patterns
BigQuery telemetry fundamentally operates through Google Cloud Audit Logs.
Unlike standard application logs, BigQuery execution telemetry relies on
`protoPayload.metadata` structures rather than `jsonPayload`.
### Core resource types
* **Projects (`bigquery_project`)**: The high-level anchor. This captures
top-level job operations, project-wide auditing, and overarching query
telemetry.
* **Datasets (`bigquery_dataset`)**: Captures table/data access operations and
dataset configuration telemetry.
* **Data Transfer Service (`bigquery_dts_run`, `bigquery_dts_config`)**:
Captures telemetry for scheduled data movement pipelines.
### The metadata abstraction
When searching for "query execution", "query costs", "bytes billed", or "table
data access", you must target the `metadata` object within the Audit Log
`protoPayload`. Do NOT use `jsonPayload` or `textPayload` for BigQuery execution
tracking.
* **Targeting Jobs / Executions:** Search within
`protoPayload.metadata.jobChange.job` (for example:
`protoPayload.metadata.jobChange.job.jobStats.queryStats.totalBilledBytes`).
* **Targeting Data Reads:** Search within
`protoPayload.metadata.tableDataRead`.
* **Targeting Identity:** All actors issuing BigQuery jobs will be recorded in
`protoPayload.authenticationInfo.principalEmail`.
## Example queries
### BigQuery audit logs related to datasets or projects
**Variables to replace:** None
```lql
resource.type=("bigquery_dataset" OR "bigquery_project")
logName:"cloudaudit.googleapis.com"
```
### Logs for queries that billed more than 1GB (1073741824 bytes)
**Variables to replace:** None
```lql
resource.type="bigquery_project"
protoPayload.metadata.jobChange.job.jobStats.queryStats.totalBilledBytes > 1073741824
```
### BigQuery audit logs for a project
**Variables to replace:** None
```lql
resource.type="bigquery_project" AND
logName:"cloudaudit.googleapis.com"
```
### BigQuery audit logs for a dataset
**Variables to replace:** None
```lql
resource.type="bigquery_dataset" AND
logName:"cloudaudit.googleapis.com"
```
### BigQuery audit logs for BI Engine model
**Variables to replace:** None
```lql
resource.type="bigquery_biengine_model" AND
logName:"cloudaudit.googleapis.com"
```
### BigQuery audit logs for a Data Transfer Service run.
**Variables to replace:** None
```lql
resource.type="bigquery_dts_run" AND
logName:"cloudaudit.googleapis.com"
```
### BigQuery audit logs for a Data Transfer Service configuration.
**Variables to replace:** None
```lql
resource.type="bigquery_dts_config" AND
logName:"cloudaudit.googleapis.com"
```
### BigQuery Data Transfer Service jobs
**Variables to replace:** None
```lql
resource.type="bigquery_project" AND
protoPayload.requestMetadata.callerSuppliedUserAgent=
"BigQuery Data Transfer Service" AND
protoPayload.methodName=("google.cloud.bigquery.v2.JobService.InsertJob" OR
"google.cloud.bigquery.v2.JobService.Query")
```
### BigQuery transfer run logs
**Variables to replace:** `<CONFIG_ID>`, `<RUN_ID>`
```lql
resource.type="bigquery_dts_config" AND
labels.run_id="<RUN_ID>" AND
resource.labels.config_id="<CONFIG_ID>"
```
### BigQuery dataset updates
**Variables to replace:** None
```lql
resource.type="bigquery_dataset" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.cloud.bigquery.v2.DatasetService.UpdateDataset"
```
### BigQuery jobs completed
**Variables to replace:** None
```lql
resource.type="bigquery_project" AND
log_id("cloudaudit.googleapis.com/data_access") AND
protoPayload.methodName=("google.cloud.bigquery.v2.JobService.InsertJob"
OR "google.cloud.bigquery.v2.JobService.Query")
```
### BigQuery quota exceeded
**Variables to replace:** None
```lql
resource.type=("bigquery_dataset" OR "bigquery_project")
AND
protoPayload.status.code=8 AND
severity>=WARNING
```
### BigQuery query started
**Variables to replace:** None
```lql
resource.type="bigquery_project" AND
protoPayload.metadata.jobInsertion.reason:*
```
### BigQuery concurrent load/extract jobs
**Variables to replace:** None
```lql
resource.type="bigquery_resource" AND
protoPayload.methodName="jobservice.insert" AND
protoPayload.serviceData.jobInsertRequest.resource.jobConfiguration.query.query:
"extract"
```
### BigQuery audit logs for row access policy
**Variables to replace:** None
```lql
resource.type="bigquery_resource" AND
protoPayload.methodName="jobservice.insert" AND
protoPayload.serviceData.jobInsertRequest.resource.jobConfiguration.query.query:"ROW ACCESS POLICY"
```
references/query_cloud_functions.md›
# Cloud Run Functions LQL queries
## Base schema and structural patterns
Cloud Functions logs differ significantly depending on whether you are targeting
1st Gen or 2nd Gen functions.
### 1st Gen Functions
* **Resource Type**: `resource.type="cloud_function"`
* **Log ID**: `log_id("cloudfunctions.googleapis.com/cloud-functions")`
* **Execution Correlation**: To find all logs for a single execution, filter
by `labels.execution_id="<EXECUTION_ID>"`.
* **Targeting**: Filter by `resource.labels.function_name="<FUNCTION_NAME>"`
and `resource.labels.region="<REGION>"`.
### 2nd Gen Functions (Cloud Run Functions)
Because 2nd Gen runs natively on Cloud Run infrastructure, its logs share the
standard Cloud Run schema and suffer from interleaved concurrency.
* **Resource Type**: `resource.type="cloud_run_revision"`
* **Log ID**: Use `log_id("run.googleapis.com/requests")` for invocation
telemetry (latency, HTTP status codes, request URLs). Use
`log_id("run.googleapis.com/stdout")` or
`log_id("run.googleapis.com/stderr")` for application container output.
* **Execution Correlation**: The most reliable way to correlate a single
concurrent execution is via trace ID:
`trace="projects/<PROJECT_ID>/traces/<TRACE_ID>"`. (Fallback:
`labels.execution_id` only if the user's runtime SDK is explicitly injecting
it).
* **Targeting**: Filter by `resource.labels.service_name="<FUNCTION_NAME>"`
and `resource.labels.location="<REGION>"`.
## Example queries
### Finds execution errors for 1st generation Cloud Functions.
**Variables to replace:** None
```lql
resource.type="cloud_function" AND
log_id("cloudfunctions.googleapis.com/cloud-functions") AND
severity >= ERROR
```
### Finds execution errors for 2nd generation Cloud Functions.
**Variables to replace:** None
```lql
resource.type="cloud_run_revision" AND
(log_id("run.googleapis.com/stdout") OR
log_id("run.googleapis.com/stderr") OR
log_id("run.googleapis.com/requests")) AND
severity >= ERROR
```
references/query_cloud_observability.md›
# Cloud Observability and Monitoring LQL queries
## Example queries
### Log sink activities
**Variables to replace:** None
```lql
resource.type="logging_sink" AND
log_id("cloudaudit.googleapis.com/activity")
```
### Log-based metric create or update activities
**Variables to replace:** None
```lql
resource.type="metric" AND
log_id("cloudaudit.googleapis.com/activity") AND
(SEARCH(protoPayload.methodName, "UpdateLogMetric") OR SEARCH(protoPayload.methodName, "CreateLogMetric"))
```
### Notification channel errors
**Variables to replace:** None
```lql
resource.type="stackdriver_notification_channel" AND
severity >= ERROR
```
### Notification channel errors due to throttling
**Variables to replace:** None
```lql
resource.type="stackdriver_notification_channel" AND
severity>=ERROR AND
jsonPayload.summary="Notification delivery throttled."
```
### Uptime checks - all logs
**Variables to replace:** None
```lql
resource.type="uptime_url"
```
### Uptime checks for a specific host
**Variables to replace:** `<URL>`
```lql
resource.type="uptime_url" AND
resource.labels.host="<URL>"
```
### Audit logs configuration removed or disabled
**Variables to replace:** None
```lql
log_id("cloudaudit.googleapis.com/activity") AND
resource.type=("organization" OR "project" OR "folder") AND
protoPayload.serviceData.policyDelta.auditConfigDeltas.action="REMOVE"
```
references/query_cloud_run.md›
# Cloud Run LQL queries
## Base schema and structural patterns
Cloud Run workloads are split into two primary paradigms: Services (which
respond to HTTP requests) and Jobs (which execute to completion). Determine
which resource is being targeted before querying.
### Core resource types
* **Cloud Run Services (`cloud_run_revision`)**: Use this when querying logs
for an HTTP-driven service deployed to Cloud Run.
* **Cloud Run Jobs (`cloud_run_job`)**: Use this when querying logs for a
batch or parallel execution pipeline deployed to Cloud Run.
### Log types (service invocations and stdout)
Cloud Run splits infrastructure routing telemetry away from the application's
actual standard streams:
* **Ingress Telemetry**: Use `log_id("run.googleapis.com/requests")` to
capture the HTTP metadata (status codes, latency, caller IP, URL) generated
by the Cloud Run gateway receiving the request.
* **Application Payload**: Use `log_id("run.googleapis.com/stdout")` or
`log_id("run.googleapis.com/stderr")` to capture logs explicitly printed by
the container.
### Execution correlation and concurrency
Cloud Run handles concurrent requests out of the box. Therefore, attempting to
correlate logs via a simple execution ID label is usually an anti-pattern.
* **Trace ID**: To trace all `stdout`/`stderr` payloads belonging to a single
specific HTTP `request` log, apply a filter matching the `trace` string.
(For example: `trace="projects/<PROJECT_ID>/traces/<TRACE_ID>"`).
## Example queries
### Cloud Run logs for a specific job
**Variables to replace:** `<JOB_NAME>`
```lql
resource.type="cloud_run_job" AND
resource.labels.job_name="<JOB_NAME>"
```
### Cloud Run logs for a specific revision and service
**Variables to replace:** `<SERVICE_NAME>`
```lql
resource.type="cloud_run_revision" AND
resource.labels.service_name="<SERVICE_NAME>"
```
references/query_cloud_source_repositories.md›
# Cloud Source Repositories LQL queries
## Example queries
### Cloud Source Repository logs
**Variables to replace:** `<REPOSITORY_NAME>`
```lql
resource.type="csr_repository" AND
resource.labels.name="<REPOSITORY_NAME>"
```
references/query_cloud_sql.md›
# Cloud SQL LQL queries
## Base schema and structural patterns
Cloud SQL logs use a unified resource type across all database engines but
drastically diverge in their specific `log_id` paths depending on whether the
instance is running MySQL, PostgreSQL, or SQL Server.
### Core resource type
* **Cloud SQL Instance (`cloudsql_database`)**: universally use this resource
type for all Cloud SQL operational and engine telemetry. Scope queries to a
specific instance via `resource.labels.database_id="<DATABASE_ID>"`.
### Log divergence by engine
Cloud SQL does not abstract underlying database logs; it surfaces the native
engine streams directly into Cloud Logging:
* **MySQL**: Targets `log_id("cloudsql.googleapis.com/mysql.err")` for
critical engine errors and `log_id("cloudsql.googleapis.com/mysql")` for
general output.
* **PostgreSQL**: Consolidates output entirely under
`log_id("cloudsql.googleapis.com/postgres.log")`.
* **SQL Server**: Emits `log_id("cloudsql.googleapis.com/sqlserver.err")` for
core engine telemetry and `log_id("cloudsql.googleapis.com/sqlagent.out")`
for SQL Server Agent execution logs.
### Administrative control plane
* **Audit Logs**: Query `log_id("cloudaudit.googleapis.com/activity")`
alongside `resource.type="cloudsql_database"` to audit control plane
operations (for example: instance creation, patching, scaling, or
restarting).
## Example queries
### Cloud SQL audit logs
**Variables to replace:** `<DATABASE_ID>`
```lql
resource.type="cloudsql_database" AND
resource.labels.database_id="<DATABASE_ID>" AND
log_id("cloudaudit.googleapis.com/activity")
```
### Cloud SQL MySQL error logs
**Variables to replace:** None
```lql
resource.type="cloudsql_database" AND
log_id("cloudsql.googleapis.com/mysql.err")
```
### Cloud SQL MySQL-based databases
**Variables to replace:** `<DATABASE_ID>`
```lql
resource.type="cloudsql_database" AND
resource.labels.database_id="<DATABASE_ID>" AND
log_id("cloudsql.googleapis.com/mysql")
```
### Cloud SQL Postgres-based databases
**Variables to replace:** `<DATABASE_ID>`
```lql
resource.type="cloudsql_database" AND
resource.labels.database_id="<DATABASE_ID>" AND
log_id("cloudsql.googleapis.com/postgres.log")
```
### Cloud SQL SQL Server error logs
**Variables to replace:** None
```lql
resource.type="cloudsql_database" AND
log_id("cloudsql.googleapis.com/sqlserver.err")
```
### Cloud SQL SQL Server-based databases
**Variables to replace:** `<DATABASE_ID>`
```lql
resource.type="cloudsql_database" AND
resource.labels.database_id="<DATABASE_ID>" AND
log_id("cloudsql.googleapis.com/sqlagent.out")
```
references/query_cloud_storage.md›
# Cloud Storage (GCS) LQL queries
## Base schema and structural patterns
Google Cloud Storage (GCS) telemetry is entirely driven by Cloud Audit Logs. GCS
utilizes Audit Logs to track everything from bucket provisioning
(administrative) to file downloads (data access).
### Core resource type
* **Buckets (`gcs_bucket`)**: All GCS logs are bound to the bucket resource
type. Filter explicitly using `resource.labels.bucket_name="<BUCKET_NAME>"`
to scope queries to a specific bucket.
### Audit log routing
GCS logs split cleanly along the standard Cloud Audit Log paradigm:
* **Admin Activity**: Use `log_id("cloudaudit.googleapis.com/activity")` to
query control-plane mutations. This captures administrative operations like
`storage.buckets.create`, `storage.buckets.delete`, and IAM policy
modifications.
* **Data Access**: Use `log_id("cloudaudit.googleapis.com/data_access")` to
query object-level file interactions, like file uploads
(`storage.objects.create`) or file reads (`storage.objects.get`).
### Operation targeting
* Combine resource isolation with `protoPayload.methodName` (for example:
`protoPayload.methodName="storage.objects.delete"`) to locate precise user
or system actions.
## Example queries
### All audit logs for GCS buckets
**Variables to replace:** None
```lql
resource.type="gcs_bucket" AND
logName:"cloudaudit.googleapis.com"
```
### GCS bucket deletion logs
**Variables to replace:** None
```lql
resource.type="gcs_bucket" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="storage.buckets.delete"
```
### GCS bucket logs
**Variables to replace:** `<BUCKET_NAME>`
```lql
resource.type="gcs_bucket" AND
resource.labels.bucket_name="<BUCKET_NAME>"
```
### GCS bucket creation logs
**Variables to replace:** None
```lql
resource.type="gcs_bucket" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="storage.buckets.create"
```
references/query_cloud_tasks.md›
# Cloud Tasks LQL queries
## Example queries
### Cloud Tasks queue logs
**Variables to replace:** `<QUEUE_ID>`
```lql
resource.type="cloud_tasks_queue" AND
resource.labels.queue_id="<QUEUE_ID>"
```
references/query_compute_engine.md›
# Compute Engine (GCE) LQL queries
## Table of contents
- [Base schema and structural patterns](#base-schema-and-structural-patterns) (L44-L101)
- [Core resource types](#core-resource-types) (L50-L60)
- [Guest OS and application logs (Ops Agent)](#guest-os-and-application-logs-ops-agent) (L62-L72)
- [Boot and kernel logs (serial console)](#boot-and-kernel-logs-serial-console) (L74-L81)
- [Google infrastructure system events](#google-infrastructure-system-events) (L83-L91)
- [User activity audit logs](#user-activity-audit-logs) (L93-L101)
- [Example queries](#example-queries) (L103-L467)
- [Activity audit logs for Compute Engine instances](#activity-audit-logs-for-compute-engine-instances) (L105-L112)
- [System logs (syslog) emitted by Compute Engine instances](#system-logs-syslog-emitted-by-compute-engine-instances) (L114-L121)
- [Compute Engine firewall rule deletion](#compute-engine-firewall-rule-deletion) (L123-L131)
- [Compute Engine VM authlogs](#compute-engine-vm-authlogs) (L133-L140)
- [Compute Engine host error](#compute-engine-host-error) (L142-L155)
- [Compute Engine host memory alert](#compute-engine-host-memory-alert) (L157-L170)
- [Compute Engine host migrated](#compute-engine-host-migrated) (L172-L186)
- [Compute Engine VM terminated/preempted](#compute-engine-vm-terminatedpreempted) (L188-L197)
- [Compute Engine VM terminated due to scratch disk creation failure](#compute-engine-vm-terminated-due-to-scratch-disk-creation-failure) (L199-L213)
- [Compute Engine zone resource pool exhaustion (stockout)](#compute-engine-zone-resource-pool-exhaustion-stockout) (L215-L226)
- [Compute Engine VM instance created](#compute-engine-vm-instance-created) (L228-L237)
- [Compute Engine VM instance deleted with name](#compute-engine-vm-instance-deleted-with-name) (L239-L248)
- [Compute Engine VM instance deleted with ID](#compute-engine-vm-instance-deleted-with-id) (L250-L259)
- [Compute Engine VM instance restarted](#compute-engine-vm-instance-restarted) (L261-L271)
- [Compute Engine Shielded VM boot integrity failure](#compute-engine-shielded-vm-boot-integrity-failure) (L273-L282)
- [Compute Engine VM instance stopped by Guest OS](#compute-engine-vm-instance-stopped-by-guest-os) (L284-L296)
- [Compute Engine Shielded VM boot file was blocked](#compute-engine-shielded-vm-boot-file-was-blocked) (L298-L307)
- [Persistent disk created](#persistent-disk-created) (L309-L318)
- [Nodes added in sole-tenant node](#nodes-added-in-sole-tenant-node) (L320-L331)
- [Autoscale events in sole-tenant node](#autoscale-events-in-sole-tenant-node) (L333-L343)
- [Manual snapshot taken](#manual-snapshot-taken) (L345-L354)
- [Scheduled snapshot taken](#scheduled-snapshot-taken) (L356-L366)
- [Snapshot schedule created](#snapshot-schedule-created) (L368-L377)
- [Snapshot schedule attached](#snapshot-schedule-attached) (L379-L389)
- [Quota exceeded](#quota-exceeded) (L391-L400)
- [Query unhealthy instances in instance group](#query-unhealthy-instances-in-instance-group) (L402-L410)
- [Query instance group members within a time frame in UTC time format](#query-instance-group-members-within-a-time-frame-in-utc-time-format) (L412-L423)
- [Instances added to instance group](#instances-added-to-instance-group) (L425-L434)
- [Instances removed from instance group](#instances-removed-from-instance-group) (L436-L445)
- [Instance template set or updated](#instance-template-set-or-updated) (L447-L457)
- [Firewall logs](#firewall-logs) (L459-L467)
## Base schema and structural patterns
Compute Engine logs are highly segmented depending on whether you are analyzing
the VM's internal operating system, Google's infrastructure events, or
user-driven API audit logs.
### Core resource types
* **VM Instances (`gce_instance`)**: The most common resource type. Use this
when analyzing a running VM (Guest OS), its boot console, or its lifecycle
events.
* **Storage (`gce_disk`, `gce_snapshot`)**: Use for operations on persistent
disks and snapshots.
* **Networking (`gce_firewall_rule`, `gce_route`, `gce_network`)**: Use for
infrastructure-level network changes, NOT for traffic flow logs.
* **Groups (`gce_instance_group`, `gce_instance_template`)**: Use for Managed
Instance Group (MIG) scaling, creation, and health checks.
### Guest OS and application logs (Ops Agent)
When a user asks to search for "errors inside my VM", "syslog", "auth requests",
or "app logs":
* Target `resource.type="gce_instance"`.
* These are usually ingested via the Ops Agent.
* Filter by `log_id("syslog")`, `log_id("winevt.raw")`, or the custom file
`log_id`.
* The raw log string is found in `textPayload` (unstructured) or `jsonPayload`
(structured).
### Boot and kernel logs (serial console)
When a VM is unbootable, crashing on startup, or experiencing kernel panics:
* Target `resource.type="gce_instance"`.
* Filter by `log_id("serialconsole.googleapis.com/serial_port_1_output")`.
* Search within `textPayload` (for example, `"kernel panic"`, `"Out of
memory"`).
### Google infrastructure system events
When a VM is preempted, terminated by Google, or migrated during a host error:
* Target `resource.type="gce_instance"`.
* Filter by `log_id("cloudaudit.googleapis.com/system_event")`.
* System events are NOT driven by users, so they are logged as system events.
Use `protoPayload.methodName` (for example, `"compute.instances.hostError"`,
`"compute.instances.preempted"`).
### User activity audit logs
When a user asks "who deleted my VM", "who stopped the instance", or "when was
this disk attached":
* Target the relevant resource type (`gce_instance`, `gce_disk`, etc.).
* Filter by `log_id("cloudaudit.googleapis.com/activity")`.
* Use `protoPayload.methodName` (for example, `"v1.compute.instances.delete"`,
`"v1.compute.disks.attach"`).
## Example queries
### Activity audit logs for Compute Engine instances
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("cloudaudit.googleapis.com/activity")
```
### System logs (syslog) emitted by Compute Engine instances
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("syslog")
```
### Compute Engine firewall rule deletion
**Variables to replace:** None
```lql
resource.type="gce_firewall_rule" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "firewalls.delete")
```
### Compute Engine VM authlogs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("authlog")
```
### Compute Engine host error
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
protoPayload.serviceName="compute.googleapis.com" AND
(SEARCH(protoPayload.methodName, "compute.instances.hostError")
OR
operation.producer:"compute.instances.hostError") AND
log_id("cloudaudit.googleapis.com/system_event") AND
resource.labels.instance_id="<INSTANCE_ID>" AND
severity=INFO
```
### Compute Engine host memory alert
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
protoPayload.serviceName="compute.googleapis.com" AND
(jsonPayload.methodName:"compute.instances.host_event_notify"
OR
operation.producer:"compute.instances.host_event_notify") AND
log_id("cloudaudit.googleapis.com/host_event_notify") AND
resource.labels.instance_id="<INSTANCE_ID>" AND
severity=CRITICAL
```
### Compute Engine host migrated
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
protoPayload.serviceName="compute.googleapis.com" AND
(SEARCH(protoPayload.methodName, "compute.instances.migrateOnHostMaintenance")
OR
operation.producer:
"compute.instances.migrateOnHostMaintenance") AND
log_id("cloudaudit.googleapis.com/system_event") AND
resource.labels.instance_id="<INSTANCE_ID>" AND
severity=INFO
```
### Compute Engine VM terminated/preempted
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
protoPayload.methodName=~"compute\.instances\.(guestTerminate|preempted)" AND
log_id("cloudaudit.googleapis.com/system_event") AND
resource.labels.instance_id="<INSTANCE_ID>"
```
### Compute Engine VM terminated due to scratch disk creation failure
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
protoPayload.serviceName="compute.googleapis.com" AND
(protoPayload.methodName="compute.instances.scratchDiskCreationFailed"
OR
operation.producer:
"compute.instances.scratchDiskCreationFailed") AND
log_id("cloudaudit.googleapis.com/system_event") AND
resource.labels.instance_id="<INSTANCE_ID>" AND
severity=INFO
```
### Compute Engine zone resource pool exhaustion (stockout)
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("cloudaudit.googleapis.com/activity") AND
(protoPayload.methodName="v1.compute.instances.start" OR
protoPayload.methodName="v1.compute.instances.insert") AND
protoPayload.status.message=~"(ZONE_RESOURCE_POOL_EXHAUSTED|does not have enough resources|resource pool exhausted)" AND
severity>=WARNING
```
### Compute Engine VM instance created
**Variables to replace:** `<INSTANCE_NAME>`
```lql
resource.type="gce_instance" AND
SEARCH(protoPayload.methodName, "compute.instances.insert") AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.request.name="<INSTANCE_NAME>"
```
### Compute Engine VM instance deleted with name
**Variables to replace:** `<INSTANCE_NAME>`
```lql
resource.type="gce_instance" AND
SEARCH(protoPayload.methodName, "compute.instances.delete") AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.resourceName:"<INSTANCE_NAME>"
```
### Compute Engine VM instance deleted with ID
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
SEARCH(protoPayload.methodName, "compute.instances.delete") AND
log_id("cloudaudit.googleapis.com/activity") AND
resource.labels.instance_id="<INSTANCE_ID>"
```
### Compute Engine VM instance restarted
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
protoPayload.methodName=~"compute\.instances\.(start|stop|reset|automaticRestart|guestTerminate|instanceManagerHaltForRestart)" AND
(log_id("cloudaudit.googleapis.com/activity")
OR log_id("cloudaudit.googleapis.com/system_event")) AND
resource.labels.instance_id="<INSTANCE_ID>"
```
### Compute Engine Shielded VM boot integrity failure
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
log_id("compute.googleapis.com/shielded_vm_integrity") AND
jsonPayload.earlyBootReportEvent.policyEvaluationPassed="false" AND
resource.labels.instance_id="<INSTANCE_ID>"
```
### Compute Engine VM instance stopped by Guest OS
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
protoPayload.serviceName="compute.googleapis.com" AND
(SEARCH(protoPayload.methodName, "compute.instances.guestTerminate") OR
operation.producer:"compute.instances.guestTerminate") AND
log_id("cloudaudit.googleapis.com/system_event") AND
resource.labels.instance_id="<INSTANCE_ID>" AND
severity=INFO
```
### Compute Engine Shielded VM boot file was blocked
**Variables to replace:** `<INSTANCE_ID>`
```lql
resource.type="gce_instance" AND
log_id("serialconsole.googleapis.com/serial_port_1_output") AND
textPayload:"Security Violation" AND
resource.labels.instance_id="<INSTANCE_ID>"
```
### Persistent disk created
**Variables to replace:** `<PERSISTENT_DISK_NAME>`
```lql
resource.type="gce_disk" AND
SEARCH(protoPayload.methodName, "compute.disks.insert") AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.resourceName: "<PERSISTENT_DISK_NAME>"
```
### Nodes added in sole-tenant node
**Variables to replace:** `<NODE_GROUP_ID>`
```lql
resource.type="gce_node_group" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName=~("compute.nodeGroups.addNodes"
OR "compute.nodeGroups.insert") AND
resource.labels.node_group_id="<NODE_GROUP_ID>" AND
severity=INFO
```
### Autoscale events in sole-tenant node
**Variables to replace:** `<NODE_GROUP_ID>`
```lql
resource.type="gce_node_group" AND
log_id("cloudaudit.googleapis.com/system_event") AND
protoPayload.methodName=~("compute.nodeGroups.deleteNodes"
OR "compute.nodeGroups.addNodes") AND
resource.labels.node_group_id="<NODE_GROUP_ID>"
```
### Manual snapshot taken
**Variables to replace:** `<SNAPSHOT_NAME>`
```lql
resource.type="gce_snapshot" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "compute.snapshots.insert") AND
protoPayload.resourceName:"<SNAPSHOT_NAME>"
```
### Scheduled snapshot taken
**Variables to replace:** `<PERSISTENT_DISK_NAME>`
```lql
resource.type="gce_disk" AND
log_id("cloudaudit.googleapis.com/system_event") AND
protoPayload.methodName="ScheduledSnapshots" AND
protoPayload.response.operationType="createSnapshot" AND
protoPayload.response.targetLink="<PERSISTENT_DISK_NAME>"
```
### Snapshot schedule created
**Variables to replace:** `<SCHEDULE_NAME>`
```lql
resource.type="gce_resource_policy" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "compute.resourcePolicies.insert") AND
protoPayload.request.name="<SCHEDULE_NAME>"
```
### Snapshot schedule attached
**Variables to replace:** `<PERSISTENT_DISK_NAME>`, `<SCHEDULE_NAME>`
```lql
resource.type="gce_disk" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "compute.disks.addResourcePolicies") AND
protoPayload.request.resourcePolicys:"<SCHEDULE_NAME>" AND
protoPayload.resourceName:"<PERSISTENT_DISK_NAME>"
```
### Quota exceeded
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
SEARCH(protoPayload.methodName, "compute.instances.insert") AND
protoPayload.status.message:"QUOTA_EXCEEDED" AND
severity=ERROR
```
### Query unhealthy instances in instance group
**Variables to replace:** `<INSTANCE_GROUP_NAME>`
```lql
resource.type="gce_instance_group" AND
resource.labels.instance_group_name="<INSTANCE_GROUP_NAME>" AND
jsonPayload.healthCheckProbeResult.healthState="UNHEALTHY"
```
### Query instance group members within a time frame in UTC time format
**Variables to replace:** `<END_TIME>`, `<INSTANCE_GROUP_NAME>`, `<START_TIME>`
```lql
resource.type="gce_instance_group_manager" AND
resource.labels.instance_group_manager_name="<INSTANCE_GROUP_NAME>" AND
jsonPayload.@type=
"type.googleapis.com/compute.InstanceGroupManagerEvent" AND
jsonPayload.instanceHealthStateChange.detailedHealthState="HEALTHY" AND
timestamp >= "<START_TIME>" AND timestamp <= "<END_TIME>"
```
### Instances added to instance group
**Variables to replace:** `<INSTANCE_GROUP_NAME>`
```lql
resource.type="gce_instance_group" AND
SEARCH(protoPayload.methodName, "compute.instanceGroups.addInstances") AND
log_id("cloudaudit.googleapis.com/activity") AND
resource.labels.instance_group_name="<INSTANCE_GROUP_NAME>"
```
### Instances removed from instance group
**Variables to replace:** `<INSTANCE_GROUP_NAME>`
```lql
resource.type="gce_instance_group" AND
SEARCH(protoPayload.methodName, "compute.instanceGroups.removeInstances") AND
log_id("cloudaudit.googleapis.com/activity") AND
resource.labels.instance_group_name="<INSTANCE_GROUP_NAME>"
```
### Instance template set or updated
**Variables to replace:** `<INSTANCE_GROUP_MANAGER>`
```lql
resource.type="gce_instance_group_manager" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName=
"v1.compute.instanceGroupManagers.setInstanceTemplate" AND
resource.labels.instance_group_manager_name="<INSTANCE_GROUP_MANAGER>"
```
### Firewall logs
**Variables to replace:** `<INSTANCE_NAME>`
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/firewall") AND
jsonPayload.instance.vm_name="<INSTANCE_NAME>"
```
references/query_dataflow.md›
# Dataflow LQL queries
## Example queries
### Warnings or errors from Dataflow workers
**Variables to replace:** None
```lql
resource.type="dataflow_step"
log_id("dataflow.googleapis.com/worker")
severity >= WARNING
```
references/query_dataproc.md›
# Managed Service for Apache Spark LQL queries
## Example queries
### Dataproc Apache Hadoop logs
**Variables to replace:** None
```lql
resource.type="cloud_dataproc_cluster" AND
jsonPayload.class:"org.apache.hadoop.mapreduce"
```
references/query_deployment_manager.md›
# Cloud Deployment Manager LQL queries
## Base schema and structural patterns
Cloud Deployment Manager uses the `deployment` resource type natively to record
log payloads and errors encountered during template execution and infrastructure
creation.
### Core resource types
* **Deployments (`deployment`)**: Captures the operational events, validation
logs, and execution errors directly related to your deployment stack.
### Targeting specific deployments
* Filter by `resource.labels.name="<DEPLOYMENT_NAME>"` to track all relevant
logs isolated to a specific deployment configuration block.
## Example queries
### Deployment Manager errors
**Variables to replace:** None
```lql
resource.type="deployment" AND
severity>=ERROR
```
references/query_gke.md›
# Kubernetes Engine (GKE) LQL queries
## Table of contents
- [Base schema and structural patterns](#base-schema-and-structural-patterns) (L72-L141)
- [Resource types](#resource-types) (L78-L91)
- [Application logs (stdout / stderr) pattern](#application-logs-stdout--stderr-pattern) (L93-L102)
- [Kubernetes events pattern](#kubernetes-events-pattern) (L104-L111)
- [System and control plane logs pattern](#system-and-control-plane-logs-pattern) (L113-L121)
- [Google Cloud vs Kubernetes Audit Logs](#google-cloud-vs-kubernetes-audit-logs) (L123-L132)
- [User-defined Kubernetes labels gotcha](#user-defined-kubernetes-labels-gotcha) (L134-L141)
- [Example queries](#example-queries) (L143-L771)
- [Cluster logs in a specific Google Cloud location](#cluster-logs-in-a-specific-google-cloud-location) (L145-L152)
- [Pod eviction events](#pod-eviction-events) (L154-L162)
- [Container errors from a specific pod](#container-errors-from-a-specific-pod) (L164-L172)
- [Google Kubernetes Engine cluster operations](#google-kubernetes-engine-cluster-operations) (L174-L181)
- [Google Kubernetes Engine cluster creation](#google-kubernetes-engine-cluster-creation) (L183-L191)
- [Kubernetes cluster deployment](#kubernetes-cluster-deployment) (L193-L201)
- [Kubernetes cluster authentication failure](#kubernetes-cluster-authentication-failure) (L203-L211)
- [Kubernetes cluster operations and events in us-central1-b](#kubernetes-cluster-operations-and-events-in-us-central1-b) (L213-L220)
- [Kubernetes pod requests from users](#kubernetes-pod-requests-from-users) (L222-L231)
- [Kubernetes events](#kubernetes-events) (L233-L240)
- [Kubernetes endpoints update](#kubernetes-endpoints-update) (L242-L250)
- [Kubernetes control plane logs](#kubernetes-control-plane-logs) (L252-L260)
- [Kubernetes Engine control plane logs](#kubernetes-engine-control-plane-logs) (L262-L270)
- [Pod deletion](#pod-deletion) (L272-L280)
- [Kubernetes pod audit logs from control plane](#kubernetes-pod-audit-logs-from-control-plane) (L282-L292)
- [Kubernetes pod evictions](#kubernetes-pod-evictions) (L294-L304)
- [Kubernetes node audit logs from the control plane](#kubernetes-node-audit-logs-from-the-control-plane) (L306-L316)
- [Kubernetes cluster control plane for Addon Manager Activity](#kubernetes-cluster-control-plane-for-addon-manager-activity) (L318-L328)
- [Kubernetes control plane errors (excluding Conflict , which is normal)](#kubernetes-control-plane-errors-excluding-conflict--which-is-normal) (L330-L341)
- [Ingress Controller events](#ingress-controller-events) (L343-L353)
- [Service Controller events (kube-controller-manager)](#service-controller-events-kube-controller-manager) (L355-L365)
- [Cluster Autoscaler events](#cluster-autoscaler-events) (L367-L377)
- [Cluster Autoscaler scale up failures (visibility logs)](#cluster-autoscaler-scale-up-failures-visibility-logs) (L379-L389)
- [Query pod during creation](#query-pod-during-creation) (L391-L399)
- [Scheduler events](#scheduler-events) (L401-L411)
- [Scheduler events (preemptions)](#scheduler-events-preemptions) (L413-L424)
- [Node events](#node-events) (L426-L433)
- [Out of memory (OOM) events](#out-of-memory-oom-events) (L435-L444)
- [Looking at Kube-proxy logs](#looking-at-kube-proxy-logs) (L446-L453)
- [Looking at dockerd logs](#looking-at-dockerd-logs) (L455-L462)
- [Looking at kubelet errors or failures](#looking-at-kubelet-errors-or-failures) (L464-L472)
- [Looking at node logs for GKE system logs](#looking-at-node-logs-for-gke-system-logs) (L474-L490)
- [Container and pod logs for GKE system logs](#container-and-pod-logs-for-gke-system-logs) (L492-L508)
- [Stdout container logs across all pods and containers in a cluster](#stdout-container-logs-across-all-pods-and-containers-in-a-cluster) (L510-L517)
- [Container error logs across all pods and containers in a cluster](#container-error-logs-across-all-pods-and-containers-in-a-cluster) (L519-L527)
- [Container error logs for a pod with a specific name](#container-error-logs-for-a-pod-with-a-specific-name) (L529-L537)
- [Container error logs for a specific container in a specific pod](#container-error-logs-for-a-specific-container-in-a-specific-pod) (L539-L548)
- [Container error logs for a specific namespace and container](#container-error-logs-for-a-specific-namespace-and-container) (L550-L559)
- [Container logs for a pod with a specific label](#container-logs-for-a-pod-with-a-specific-label) (L561-L569)
- [Container error logs for pods running on a specific node](#container-error-logs-for-pods-running-on-a-specific-node) (L571-L579)
- [Container logs for a pod with a label generated using skaffold](#container-logs-for-a-pod-with-a-label-generated-using-skaffold) (L581-L590)
- [Container error logs for a specific pod containing a POST in the textPayload](#container-error-logs-for-a-specific-pod-containing-a-post-in-the-textpayload) (L592-L601)
- [Container error logs for a specific pod containing a GET in the structured JSON](#container-error-logs-for-a-specific-pod-containing-a-get-in-the-structured-json) (L603-L612)
- [Container errors logs in the kube-system namespace](#container-errors-logs-in-the-kube-system-namespace) (L614-L622)
- [Container error in the container insights log](#container-error-in-the-container-insights-log) (L624-L631)
- [Kubernetes container logs](#kubernetes-container-logs) (L633-L640)
- [Kubernetes API server logs](#kubernetes-api-server-logs) (L642-L651)
- [Kubernetes Scheduler logs](#kubernetes-scheduler-logs) (L653-L662)
- [Kubernetes Controller Manager logs](#kubernetes-controller-manager-logs) (L664-L673)
- [Stdout container logs across all TPU nodes with the same prefix](#stdout-container-logs-across-all-tpu-nodes-with-the-same-prefix) (L675-L683)
- [Container error logs across all TPU nodes with the same prefix](#container-error-logs-across-all-tpu-nodes-with-the-same-prefix) (L685-L694)
- [Stdout container logs from the same GKE Job](#stdout-container-logs-from-the-same-gke-job) (L696-L704)
- [Container error logs from the same GKE Job](#container-error-logs-from-the-same-gke-job) (L706-L715)
- [Stdout container logs from the same GKE JobSet](#stdout-container-logs-from-the-same-gke-jobset) (L717-L725)
- [Container error logs from the same GKE JobSet](#container-error-logs-from-the-same-gke-jobset) (L727-L736)
- [Node auto-repair events](#node-auto-repair-events) (L738-L747)
- [Cluster deletion events](#cluster-deletion-events) (L749-L757)
- [Pod IP assignment and release](#pod-ip-assignment-and-release) (L759-L771)
## Base schema and structural patterns
GKE logs are split across multiple `resource.type` values depending on what
generated the log. Always constrain your query to the correct resource type
first before searching payloads.
### Resource types
* **Containers (`k8s_container`)**: Use for application logs, standard out
(`textPayload`), and structured JSON logs (`jsonPayload`) emitted by your
workloads. This is the most common resource type for debugging applications.
* **Pods (`k8s_pod`)**: Use for Kubernetes pod lifecycle events (for example,
evictions, scheduling gaps, readiness probes).
* **Nodes (`k8s_node`)**: Use for infrastructure-level node events (for
example, kubelet errors, container runtime logs, node auto-repair).
* **Cluster/Control Plane (`k8s_cluster` or `gke_cluster`)**: Use for control
plane logs (API server, scheduler, controller-manager) and cluster-level
operations. Kubernetes-native components log to `k8s_cluster`, while GCP
infrastructure operations (like deleting the GKE cluster) log to
`gke_cluster`.
### Application logs (stdout / stderr) pattern
When a user asks to search for "errors in my application", "logs from the
foo-pod", or "stdout from a container":
* Target `resource.type="k8s_container"`.
* Filter by `resource.labels.pod_name`, `resource.labels.container_name`, or
`resource.labels.namespace_name`.
* The raw log string is found in `textPayload` (unstructured) or `jsonPayload`
(structured log records).
### Kubernetes events pattern
When a user asks about Kubernetes *events* like Pod evictions, Node scaling, or
BackOffs:
* Filter by `log_id("events")`.
* Search within `jsonPayload.reason` (for example, `"Evicted"`,
`"FailedScheduling"`, `"BackOff"`) and `jsonPayload.message`.
### System and control plane logs pattern
When debugging GKE internal infrastructure (for example, ingress controllers,
kube-dns):
* Target the `kube-system` namespace
(`resource.labels.namespace_name="kube-system"`).
* Control plane components generally log under the `k8s_cluster` resource
type.
### Google Cloud vs Kubernetes Audit Logs
When auditing *infrastructure* (for example, who created the GKE cluster
itself), this falls under general Google Cloud API audit logs. However, when
auditing *inside* the cluster (for example, who deleted a Namespace or Pod):
* Target `resource.type="k8s_cluster"`.
* Filter by `log_id("cloudaudit.googleapis.com/activity")` (or `data_access`).
* Search within `protoPayload.methodName` using native Kubernetes API strings
(for example, `"io.k8s.core.v1.namespaces.create"`).
### User-defined Kubernetes labels gotcha
When filtering by custom Kubernetes pod labels (like `app: my-app` or `tier:
backend`), do NOT look in `resource.labels` or `labels.app` (or similar
unwrapped keys). Cloud Logging stores custom Kubernetes metadata in the global
`labels` object, automatically prefixed with `"k8s-pod/"`.
* **Example:** `labels."k8s-pod/app"="my-app"`
## Example queries
### Cluster logs in a specific Google Cloud location
**Variables to replace:** `<LOCATION>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<LOCATION>"
```
### Pod eviction events
**Variables to replace:** None
```lql
resource.type="k8s_pod" AND
log_id("events") AND
jsonPayload.reason="Evicted"
```
### Container errors from a specific pod
**Variables to replace:** `<POD_NAME>`
```lql
resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
severity=ERROR
```
### Google Kubernetes Engine cluster operations
**Variables to replace:** None
```lql
resource.type="gke_cluster" AND
log_id("cloudaudit.googleapis.com/activity")
```
### Google Kubernetes Engine cluster creation
**Variables to replace:** None
```lql
resource.type="gke_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.container.v1.ClusterManager.CreateCluster"
```
### Kubernetes cluster deployment
**Variables to replace:** None
```lql
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "deployments")
```
### Kubernetes cluster authentication failure
**Variables to replace:** None
```lql
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.authenticationInfo.principalEmail="system:anonymous"
```
### Kubernetes cluster operations and events in us-central1-b
**Variables to replace:** None
```lql
resource.type="k8s_cluster" AND
resource.labels.location="us-central1-b"
```
### Kubernetes pod requests from users
**Variables to replace:** `<USER_EMAIL>`
```lql
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "io.k8s.core.v1.pods") AND
protoPayload.authenticationInfo.principalEmail="<USER_EMAIL>"
```
### Kubernetes events
**Variables to replace:** None
```lql
resource.type="k8s_cluster" AND
log_id("events")
```
### Kubernetes endpoints update
**Variables to replace:** None
```lql
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.request.kind="Endpoints"
```
### Kubernetes control plane logs
**Variables to replace:** None
```lql
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="k8s.io"
```
### Kubernetes Engine control plane logs
**Variables to replace:** None
```lql
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="container.googleapis.com"
```
### Pod deletion
**Variables to replace:** None
```lql
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName=~"io\.k8s\.core\.v1\.pods\.(create|delete)"
```
### Kubernetes pod audit logs from control plane
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`, `<POD_NAME>`, `<POD_NAMESPACE>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.resourceName="core/v1/namespaces/<POD_NAMESPACE>/pods/<POD_NAME>"
```
### Kubernetes pod evictions
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="io.k8s.core.v1.pods.eviction.create"
```
### Kubernetes node audit logs from the control plane
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "io.k8s.core.v1.nodes")
```
### Kubernetes cluster control plane for Addon Manager Activity
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.authenticationInfo.principalEmail="system:addon-manager"
```
### Kubernetes control plane errors (excluding Conflict , which is normal)
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.status.message!="Conflict" AND
protoPayload.status.code!=0
```
### Ingress Controller events
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="loadbalancer-controller"
```
### Service Controller events (kube-controller-manager)
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="service-controller"
```
### Cluster Autoscaler events
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="cluster-autoscaler"
```
### Cluster Autoscaler scale up failures (visibility logs)
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("container.googleapis.com/cluster-autoscaler-visibility") AND
jsonPayload.resultInfo.results.errorMsg.messageId:"scale.up"
```
### Query pod during creation
**Variables to replace:** `<POD_NAME>`
```lql
resource.type="k8s_pod" AND
resource.labels.pod_name="<POD_NAME>" AND
log_id("events")
```
### Scheduler events
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_pod" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="default-scheduler"
```
### Scheduler events (preemptions)
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_pod" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="default-scheduler" AND
jsonPayload.reason="Preempted"
```
### Node events
**Variables to replace:** None
```lql
resource.type="k8s_node" AND
log_id("events")
```
### Out of memory (OOM) events
**Variables to replace:** None
```lql
resource.type="k8s_node"
log_id("events")
(jsonPayload.reason:("OOMKilling" OR "SystemOOM")
OR jsonPayload.message:("OOM encountered" OR "out of memory"))
```
### Looking at Kube-proxy logs
**Variables to replace:** None
```lql
resource.type="k8s_node" AND
log_id("kube-proxy")
```
### Looking at dockerd logs
**Variables to replace:** None
```lql
resource.type="k8s_node" AND
log_id("container-runtime")
```
### Looking at kubelet errors or failures
**Variables to replace:** None
```lql
resource.type="k8s_node" AND
log_id("kubelet") AND
jsonPayload.MESSAGE:("error" OR "fail")
```
### Looking at node logs for GKE system logs
**Variables to replace:** None
```lql
resource.type = "k8s_node" AND
logName:( "logs/container-runtime" OR
"logs/docker" OR
"logs/kube-container-runtime-monitor" OR
"logs/kube-logrotate" OR
"logs/kube-node-configuration" OR
"logs/kube-node-installation" OR
"logs/kubelet" OR
"logs/kubelet-monitor" OR
"logs/node-journal" OR
"logs/node-problem-detector")
```
### Container and pod logs for GKE system logs
**Variables to replace:** None
```lql
resource.type = ("k8s_container" OR "k8s_pod") AND
resource.labels.namespace_name = (
"cnrm-system" OR
"config-management-system" OR
"gatekeeper-system" OR
"gke-connect" OR
"gke-system" OR
"istio-system" OR
"knative-serving" OR
"monitoring-system" OR
"kube-system")
```
### Stdout container logs across all pods and containers in a cluster
**Variables to replace:** None
```lql
resource.type="k8s_container" AND
log_id("stdout")
```
### Container error logs across all pods and containers in a cluster
**Variables to replace:** None
```lql
resource.type="k8s_container" AND
log_id("stderr") AND
severity=ERROR
```
### Container error logs for a pod with a specific name
**Variables to replace:** `<POD_NAME>`
```lql
resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
severity=ERROR
```
### Container error logs for a specific container in a specific pod
**Variables to replace:** `<POD_NAME>`
```lql
resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
resource.labels.container_name="server" AND
severity=ERROR
```
### Container error logs for a specific namespace and container
**Variables to replace:** None
```lql
resource.type="k8s_container" AND
resource.labels.namespace_name="istio-system" AND
resource.labels.container_name="egressgateway" AND
severity=ERROR
```
### Container logs for a pod with a specific label
**Variables to replace:** None
```lql
resource.type="k8s_container" AND
labels."k8s-pod/app"="loadgenerator" AND
severity=ERROR
```
### Container error logs for pods running on a specific node
**Variables to replace:** `<NODE_NAME>`
```lql
resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"="<NODE_NAME>" AND
severity=ERROR
```
### Container logs for a pod with a label generated using skaffold
**Variables to replace:** `<SKAFFOLD_RUN_ID>`
```lql
resource.type="k8s_container" AND
labels."k8s-pod/app"="loadgenerator" AND
labels."k8s-pod/skaffold_dev/run-id"="<SKAFFOLD_RUN_ID>" AND
severity=ERROR
```
### Container error logs for a specific pod containing a POST in the textPayload
**Variables to replace:** `<POD_NAME>`
```lql
resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
textPayload:"POST" AND
severity=ERROR
```
### Container error logs for a specific pod containing a GET in the structured JSON
**Variables to replace:** `<POD_NAME>`
```lql
resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
jsonPayload."http.req.method"="GET" AND
severity=ERROR
```
### Container errors logs in the kube-system namespace
**Variables to replace:** None
```lql
resource.type="k8s_container" AND
resource.labels.namespace_name="kube-system" AND
severity=ERROR
```
### Container error in the container insights log
**Variables to replace:** None
```lql
resource.type="k8s_container" AND
log_id("clouderrorreporting.googleapis.com/insights")
```
### Kubernetes container logs
**Variables to replace:** `<CONTAINER_NAME>`
```lql
resource.type="k8s_container" AND
resource.labels.container_name="<CONTAINER_NAME>"
```
### Kubernetes API server logs
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_control_plane_component" AND
resource.labels.component_name="apiserver" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>"
```
### Kubernetes Scheduler logs
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_control_plane_component" AND
resource.labels.component_name="scheduler" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>"
```
### Kubernetes Controller Manager logs
**Variables to replace:** `<CLUSTER_LOCATION>`, `<CLUSTER_NAME>`
```lql
resource.type="k8s_control_plane_component" AND
resource.labels.component_name="controller-manager" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>"
```
### Stdout container logs across all TPU nodes with the same prefix
**Variables to replace:** `<TPU_NODE_PREFIX>`
```lql
resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"=~"<TPU_NODE_PREFIX>.*" AND
log_id("stdout")
```
### Container error logs across all TPU nodes with the same prefix
**Variables to replace:** `<TPU_NODE_PREFIX>`
```lql
resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"=~"<TPU_NODE_PREFIX>.*" AND
log_id("stderr") AND
severity=ERROR
```
### Stdout container logs from the same GKE Job
**Variables to replace:** `<JOB_NAME>`
```lql
resource.type="k8s_container" AND
labels."k8s-pod/batch.kubernetes.io/job-name" = "<JOB_NAME>" AND
log_id("stdout")
```
### Container error logs from the same GKE Job
**Variables to replace:** `<JOB_NAME>`
```lql
resource.type="k8s_container" AND
labels."k8s-pod/batch.kubernetes.io/job-name"="<JOB_NAME>" AND
log_id("stderr") AND
severity=ERROR
```
### Stdout container logs from the same GKE JobSet
**Variables to replace:** `<JOBSET_NAME>`
```lql
resource.type="k8s_container" AND
labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="<JOBSET_NAME>" AND
log_id("stdout")
```
### Container error logs from the same GKE JobSet
**Variables to replace:** `<JOBSET_NAME>`
```lql
resource.type="k8s_container" AND
labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="<JOBSET_NAME>" AND
log_id("stderr") AND
severity=ERROR
```
### Node auto-repair events
**Variables to replace:** `<CLUSTER_NAME>`
```lql
resource.type="gke_nodepool" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.container.v1.ClusterManager.RepairNodePool"
```
### Cluster deletion events
**Variables to replace:** `<CLUSTER_NAME>`
```lql
resource.type="gke_cluster" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
SEARCH(protoPayload.methodName, "DeleteCluster")
```
### Pod IP assignment and release
**Variables to replace:** `<CLUSTER_NAME>`, `<POD_NAME>`
```lql
resource.type="k8s_cluster" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
protoPayload.resourceName:"<POD_NAME>" AND
((protoPayload.methodName="io.k8s.core.v1.pods.status.patch" AND
protoPayload.request.status.podIP:*) OR
(protoPayload.methodName="io.k8s.core.v1.pods.delete" AND
protoPayload.response.status.podIP:*))
```
references/query_iam.md›
# IAM and service accounts LQL queries
## Table of contents
- [Base schema and structural patterns](#base-schema-and-structural-patterns) (L20-L66)
- [Log types](#log-types) (L25-L30)
- [Resource types](#resource-types) (L32-L41)
- [PolicyDelta (Role Bindings)](#policydelta-role-bindings) (L43-L56)
- [Service account credentials](#service-account-credentials) (L58-L66)
- [Example queries](#example-queries) (L68-L159)
- [Service account creation logs](#service-account-creation-logs) (L70-L79)
- [Service account creation key logs](#service-account-creation-key-logs) (L81-L89)
- [Set access control policy logs](#set-access-control-policy-logs) (L91-L99)
- [External principal granted access to organization](#external-principal-granted-access-to-organization) (L101-L112)
- [Resource creation, modification, or deletion](#resource-creation-modification-or-deletion) (L114-L121)
- [Role granted to principal](#role-granted-to-principal) (L123-L134)
- [Role removed from principal](#role-removed-from-principal) (L136-L147)
- [Permission updated in a custom role](#permission-updated-in-a-custom-role) (L149-L159)
## Base schema and structural patterns
IAM operations span multiple resource types. Always constrain your query to the
correct target resource before writing payload logic.
### Log types
* Use `log_id("cloudaudit.googleapis.com/activity")` for mutating operations
(for example, granting roles, creating service accounts).
* Use `log_id("cloudaudit.googleapis.com/data_access")` for read operations
(for example, `GetRole`, `GetIamPolicy`, `ListServiceAccounts`).
### Resource types
* **`project`**, **`folder`**, or **`organization`**: Use when the intent is
to audit IAM role bindings or permissions assigned at the hierarchy level
(for example, "Who granted the editor role on my project?").
* **`service_account`**: Use when the intent is the creation, deletion, or
modification of the Service Account identity itself, or the generation of
its authentication keys.
* **`iam_role`**: Use when auditing modifications made to Custom IAM Roles
directly (for example, adding a new permission to an existing custom role).
### PolicyDelta (Role Bindings)
When auditing who was granted or revoked a role, do NOT look in the raw request.
Google Cloud translates all access control changes into a unified `policyDelta`
object.
* `protoPayload.methodName`: Usually `"SetIamPolicy"`.
* `protoPayload.serviceData.policyDelta.bindingDeltas.action`: The action
taken, either `"ADD"` or `"REMOVE"`.
* `protoPayload.serviceData.policyDelta.bindingDeltas.member`: The principal
being modified (for example, `"user:[email protected]"` or
`"serviceAccount:[email protected]"`).
* `protoPayload.serviceData.policyDelta.bindingDeltas.role`: The precise IAM
role being modified (for example, `"roles/editor"`).
### Service account credentials
When a user asks about Service Account Keys (which present a high security risk
if leaked), target the admin API methods directly:
* `protoPayload.methodName`: Use
`"google.iam.admin.v1.CreateServiceAccountKey"` for key generation events,
and `"google.iam.admin.v1.CreateServiceAccount"` for the initial account
creation.
## Example queries
### Service account creation logs
**Variables to replace:** `<EMAIL_ID>`
```lql
resource.type="service_account" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.iam.admin.v1.CreateServiceAccount" AND
protoPayload.response.email="<EMAIL_ID>"
```
### Service account creation key logs
**Variables to replace:** None
```lql
resource.type="service_account" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"
```
### Set access control policy logs
**Variables to replace:** None
```lql
resource.type="project" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="SetIamPolicy"
```
### External principal granted access to organization
**Variables to replace:** `<DOMAIN_NAME>`
```lql
resource.type="project" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND
protoPayload.request.@type:"IamPolicy" AND
protoPayload.serviceData.policyDelta.bindingDeltas.member:* AND
NOT protoPayload.serviceData.policyDelta.bindingDeltas.member:"@<DOMAIN_NAME>.com"
```
### Resource creation, modification, or deletion
**Variables to replace:** None
```lql
log_id("cloudaudit.googleapis.com/activity") AND
(SEARCH(protoPayload.methodName, "create") OR SEARCH(protoPayload.methodName, "delete") OR SEARCH(protoPayload.methodName, "update"))
```
### Role granted to principal
**Variables to replace:** `<EMAIL_ID>`
```lql
log_id("cloudaudit.googleapis.com/activity") AND
resource.type="project" AND
protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND
protoPayload.methodName="SetIamPolicy" AND
protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND
protoPayload.serviceData.policyDelta.bindingDeltas.member:"<EMAIL_ID>"
```
### Role removed from principal
**Variables to replace:** `<EMAIL_ID>`
```lql
log_id("cloudaudit.googleapis.com/activity") AND
resource.type="project" AND
protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND
protoPayload.methodName="SetIamPolicy" AND
protoPayload.serviceData.policyDelta.bindingDeltas.action="Remove" AND
protoPayload.serviceData.policyDelta.bindingDeltas.member:"<EMAIL_ID>"
```
### Permission updated in a custom role
**Variables to replace:** `<ROLE_ID>`
```lql
log_id("cloudaudit.googleapis.com/activity") AND
resource.type="iam_role" AND
protoPayload.serviceName="iam.googleapis.com" AND
SEARCH(protoPayload.methodName, "UpdateRole") AND
resource.labels.role_name:"<ROLE_ID>"
```
references/query_networking.md›
# Networking LQL queries
## Table of contents
- [Base schema and structural patterns](#base-schema-and-structural-patterns) (L29-L79)
- [Core resource types](#core-resource-types) (L34-L41)
- [VPC flow logs schema](#vpc-flow-logs-schema) (L43-L57)
- [Firewall rules schema](#firewall-rules-schema) (L59-L66)
- [Load balancer top-level abstraction](#load-balancer-top-level-abstraction) (L68-L79)
- [Example queries](#example-queries) (L81-L248)
- [Firewall - all logs](#firewall---all-logs) (L83-L90)
- [Firewall logs for a given country](#firewall-logs-for-a-given-country) (L92-L100)
- [Firewall logs from a VM](#firewall-logs-from-a-vm) (L102-L110)
- [Firewall subnet logs](#firewall-subnet-logs) (L112-L120)
- [Compute Engine subnetwork traffic logs to a subnet](#compute-engine-subnetwork-traffic-logs-to-a-subnet) (L122-L129)
- [VPC flow logs](#vpc-flow-logs) (L131-L138)
- [VPC flow logs for specific port and protocol](#vpc-flow-logs-for-specific-port-and-protocol) (L140-L149)
- [VPC flow logs for specific subnet](#vpc-flow-logs-for-specific-subnet) (L151-L159)
- [VPC flow logs for specific subnet prefix](#vpc-flow-logs-for-specific-subnet-prefix) (L161-L169)
- [VPC flow logs for a specific VM](#vpc-flow-logs-for-a-specific-vm) (L171-L179)
- [VPN gateway logs](#vpn-gateway-logs) (L181-L188)
- [HTTP load balancer 5xx errors](#http-load-balancer-5xx-errors) (L190-L197)
- [HTTP load balancer requests to PHPMyAdmin](#http-load-balancer-requests-to-phpmyadmin) (L199-L206)
- [HTTP load balancer spillover events](#http-load-balancer-spillover-events) (L208-L216)
- [VPN gateway peer not responding](#vpn-gateway-peer-not-responding) (L218-L225)
- [VPC flow logs egress (excluding internal traffic)](#vpc-flow-logs-egress-excluding-internal-traffic) (L227-L237)
- [Cloud CDN signed URL 403 errors](#cloud-cdn-signed-url-403-errors) (L239-L248)
## Base schema and structural patterns
Google Cloud networking telemetry utilizes highly specialized, deeply nested log
structures that differ fundamentally from standard application logs.
### Core resource types
* **Subnetworks (`gce_subnetwork`)**: The anchor resource type for both VPC
Flow Logs and Firewall Rules Logs.
* **Load Balancers (`http_load_balancer`, `tcp_load_balancer`)**: Captures
ingress traffic and backend routing metrics.
* **Gateways and Routers (`vpn_gateway`, `cloud_router`)**: Captures edge
transit telemetry.
### VPC flow logs schema
When searching for "network traffic", "port connections", "traffic from a
subnet", or "VM-to-VM traffic", you are querying VPC Flow Logs.
* **Target:** `resource.type="gce_subnetwork"` AND
`log_id("compute.googleapis.com/vpc_flows")`.
* **Nested Architecture:** Flow logs do *not* use a flat payload. They use
three deep jsonPayload hierarchies:
* Connection Details: `jsonPayload.connection.src_port`,
`jsonPayload.connection.protocol`, `jsonPayload.connection.dest_ip`.
* Source Details: `jsonPayload.src_instance.vm_name`.
* Destination Details: `jsonPayload.dest_instance.vm_name`.
* **CIDR Matching:** Always use the `ip_in_net()` function for CIDR range
matching against IPs, rather than strictly matching substrings.
### Firewall rules schema
When checking "firewall hits", "blocked traffic", or "allowed traffic":
* **Target:** `resource.type="gce_subnetwork"` AND
`log_id("compute.googleapis.com/firewall")`.
* **Rule Attributes:** Found in `jsonPayload.rule_details`.
* **Location Attributes:** Found in `jsonPayload.remote_location.country`.
### Load balancer top-level abstraction
When debugging a Load Balancer (for example, tracking down 500 errors or
specific URL paths):
* **Target:** `resource.type="http_load_balancer"`.
* **The Gotcha:** Cloud Load Balancing natively promotes HTTP properties to
the top-level `httpRequest` object of the LogEntry.
* **Do not use `jsonPayload` for HTTP elements.** Query `httpRequest.status`,
`httpRequest.requestMethod`, and `httpRequest.requestUrl`.
* *Note:* Internal LB orchestration (like "spilled over" events) will still
reside in `jsonPayload.statusDetails`.
## Example queries
### Firewall - all logs
**Variables to replace:** None
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/firewall")
```
### Firewall logs for a given country
**Variables to replace:** `<COUNTRY_ISO_ALPHA_3>`
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/firewall") AND
jsonPayload.remote_location.country="<COUNTRY_ISO_ALPHA_3>"
```
### Firewall logs from a VM
**Variables to replace:** `<INSTANCE_NAME>`
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/firewall") AND
jsonPayload.instance.vm_name="<INSTANCE_NAME>"
```
### Firewall subnet logs
**Variables to replace:** `<SUBNET_NAME>`
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/firewall") AND
resource.labels.subnetwork_name="<SUBNET_NAME>"
```
### Compute Engine subnetwork traffic logs to a subnet
**Variables to replace:** `<SUBNET_IP>`
```lql
resource.type="gce_subnetwork" AND
ip_in_net(jsonPayload.connection.dest_ip, "<SUBNET_IP>")
```
### VPC flow logs
**Variables to replace:** None
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows")
```
### VPC flow logs for specific port and protocol
**Variables to replace:** `<PORT_ID>`, `<PROTOCOL>`
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows") AND
jsonPayload.connection.src_port="<PORT_ID>" AND
jsonPayload.connection.protocol="<PROTOCOL>"
```
### VPC flow logs for specific subnet
**Variables to replace:** `<SUBNET_NAME>`
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows") AND
resource.labels.subnetwork_name="<SUBNET_NAME>"
```
### VPC flow logs for specific subnet prefix
**Variables to replace:** `<SUBNET_IP>`
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows") AND
ip_in_net(jsonPayload.connection.dest_ip, "<SUBNET_IP>")
```
### VPC flow logs for a specific VM
**Variables to replace:** `<VM_NAME>`
```lql
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows") AND
jsonPayload.src_instance.vm_name="<VM_NAME>"
```
### VPN gateway logs
**Variables to replace:** `<GATEWAY_ID>`
```lql
resource.type="vpn_gateway" AND
resource.labels.gateway_id="<GATEWAY_ID>"
```
### HTTP load balancer 5xx errors
**Variables to replace:** None
```lql
resource.type="http_load_balancer" AND
httpRequest.status>=500
```
### HTTP load balancer requests to PHPMyAdmin
**Variables to replace:** None
```lql
resource.type="http_load_balancer" AND
httpRequest.requestUrl:"phpmyadmin"
```
### HTTP load balancer spillover events
**Variables to replace:** `<BACKEND_SERVICE_NAME>`
```lql
resource.type="http_load_balancer" AND
resource.labels.backend_service_name="<BACKEND_SERVICE_NAME>" AND
jsonPayload.statusDetails=~"(spilled_over|overflow|spillover)"
```
### VPN gateway peer not responding
**Variables to replace:** None
```lql
resource.type="vpn_gateway"
"establishing IKE_SA failed, peer not responding"
```
### VPC flow logs egress (excluding internal traffic)
**Variables to replace:** `<VPC_NAME>`
```lql
resource.type="gce_subnetwork" AND
logName=~"vpc_flows" AND
jsonPayload.reporter="SRC" AND
jsonPayload.src_vpc.vpc_name="<VPC_NAME>" AND
(jsonPayload.dest_vpc.vpc_name!="<VPC_NAME>" OR NOT jsonPayload.dest_vpc:*)
```
### Cloud CDN signed URL 403 errors
**Variables to replace:** `<FORWARDING_RULE_NAME>`, `<REQUEST_URL>`
```lql
resource.type="http_load_balancer" AND
resource.labels.forwarding_rule_name="<FORWARDING_RULE_NAME>" AND
httpRequest.requestUrl="<REQUEST_URL>" AND
jsonPayload.statusDetails="signed_request_key_not_found"
```
references/query_security.md›
# Security (audit logging) LQL queries
## Example queries
### Audit logs—all
**Variables to replace:** None
```lql
logName:"cloudaudit.googleapis.com"
```
### Audit logs—Access Transparency (AXT)
**Variables to replace:** None
```lql
log_id("cloudaudit.googleapis.com/access_transparency")
```
### Audit logs—Admin Activity
**Variables to replace:** None
```lql
log_id("cloudaudit.googleapis.com/activity")
```
### Audit logs—Data Access
**Variables to replace:** None
```lql
log_id("cloudaudit.googleapis.com/data_access")
```
### Audit logs—System Event
**Variables to replace:** None
```lql
log_id("cloudaudit.googleapis.com/system_event")
```
### VPC Service Controls access level attached
**Variables to replace:** `<ACCESS_LEVEL>`
```lql
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="accesscontextmanager.googleapis.com" AND
protoPayload.methodName="google.identity.accesscontextmanager.v1.AccessContextManager.UpdateServicePerimeter" AND
-protoPayload.metadata.previousState:"<ACCESS_LEVEL>" AND
protoPayload.request.servicePerimeter.spec.accessLevels:"<ACCESS_LEVEL>"
```
### VPC Service Controls policy updated or deleted
**Variables to replace:** None
```lql
resource.type="audited_resource" AND
(protoPayload.methodName="AccessContextManager.UpdateServicePerimeter" OR
protoPayload.methodName="AccessContextManager.DeleteServicePerimeter")
```
references/query_service_usage.md›
# API enable and disable LQL queries
## Example queries
### Google Cloud Service API enablement audit logs
**Variables to replace:** None
```lql
resource.type="audited_resource" AND
protoPayload.methodName="google.api.serviceusage.v1.ServiceUsage.EnableService"
```
### Google Cloud Service API disablement audit logs
**Variables to replace:** None
```lql
resource.type="audited_resource" AND
protoPayload.methodName="google.api.serviceusage.v1.ServiceUsage.DisableService"
```
### Logging API disabled
**Variables to replace:** None
```lql
resource.type="audited_resource"
protoPayload.methodName="google.api.serviceusage.v1.ServiceUsage.DisableService"
protoPayload.authorizationInfo.granted="true"
protoPayload.response.service.state="DISABLED"
protoPayload.authorizationInfo.resource="services/logging.googleapis.com"
```
references/query_spanner.md›
# Spanner LQL queries
## Example queries
### Cloud Spanner logs for a specific Spanner instance
**Variables to replace:** `<SPANNER_INSTANCE>`
```lql
resource.type="spanner_instance" AND
resource.labels.instance_id="<SPANNER_INSTANCE>"
```
references/query_third_party.md›
# Third-party application LQL queries
## Table of contents
- [Example queries](#example-queries) (L31-L247)
- [Apache logs](#apache-logs) (L33-L40)
- [Cassandra logs](#cassandra-logs) (L42-L49)
- [Chef logs](#chef-logs) (L51-L58)
- [Gitlab logs](#gitlab-logs) (L60-L67)
- [Jenkins logs](#jenkins-logs) (L69-L76)
- [Jetty logs](#jetty-logs) (L78-L85)
- [Joomla logs](#joomla-logs) (L87-L94)
- [Linux syslogs](#linux-syslogs) (L96-L103)
- [Magneto logs](#magneto-logs) (L105-L112)
- [Mediawiki logs](#mediawiki-logs) (L114-L121)
- [memcached logs](#memcached-logs) (L123-L130)
- [MongoDB logs](#mongodb-logs) (L132-L139)
- [MySQL logs](#mysql-logs) (L141-L148)
- [Nginx logs](#nginx-logs) (L150-L157)
- [PostgreSQL logs](#postgresql-logs) (L159-L166)
- [Puppet logs](#puppet-logs) (L168-L175)
- [RabbitMQ logs](#rabbitmq-logs) (L177-L184)
- [Redmine logs](#redmine-logs) (L186-L193)
- [Salt logs](#salt-logs) (L195-L202)
- [Slow MySQL queries](#slow-mysql-queries) (L204-L211)
- [Solr logs](#solr-logs) (L213-L220)
- [SugarCRM logs](#sugarcrm-logs) (L222-L229)
- [Tomcat logs](#tomcat-logs) (L231-L238)
- [Zookeeper logs](#zookeeper-logs) (L240-L247)
## Example queries
### Apache logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
(logName:"/apache-access" OR logName:"/apache-error")
```
### Cassandra logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("cassandra")
```
### Chef logs
**Variables to replace:** `<PROJECT_ID>`
```lql
resource.type="gce_instance" AND
logName:"projects/<PROJECT_ID>/logs/chef-"
```
### Gitlab logs
**Variables to replace:** `<PROJECT_ID>`
```lql
resource.type="gce_instance" AND
logName:"projects/<PROJECT_ID>/logs/gitlab-"
```
### Jenkins logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("jenkins")
```
### Jetty logs
**Variables to replace:** `<PROJECT_ID>`
```lql
resource.type="gce_instance" AND
logName:"projects/<PROJECT_ID>/logs/jetty-"
```
### Joomla logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("joomla")
```
### Linux syslogs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("syslog")
```
### Magneto logs
**Variables to replace:** `<PROJECT_ID>`
```lql
resource.type="gce_instance" AND
logName:"projects/<PROJECT_ID>/logs/magneto-"
```
### Mediawiki logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("mediawiki")
```
### memcached logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("memcached")
```
### MongoDB logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("mongodb")
```
### MySQL logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("mysql")
```
### Nginx logs
**Variables to replace:** `<PROJECT_ID>`
```lql
resource.type="gce_instance" AND
logName:"projects/<PROJECT_ID>/logs/nginx-"
```
### PostgreSQL logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("postgresql")
```
### Puppet logs
**Variables to replace:** `<PROJECT_ID>`
```lql
resource.type="gce_instance" AND
logName:"projects/<PROJECT_ID>/logs/puppet-"
```
### RabbitMQ logs
**Variables to replace:** `<PROJECT_ID>`
```lql
resource.type="gce_instance" AND
logName:"projects/<PROJECT_ID>/logs/rabbitmq-"
```
### Redmine logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("redmine")
```
### Salt logs
**Variables to replace:** `<PROJECT_ID>`
```lql
resource.type="gce_instance" AND
logName:"projects/<PROJECT_ID>/logs/salt-"
```
### Slow MySQL queries
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("mysql-slow")
```
### Solr logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("solr")
```
### SugarCRM logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("sugarcrm")
```
### Tomcat logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("tomcat")
```
### Zookeeper logs
**Variables to replace:** None
```lql
resource.type="gce_instance" AND
log_id("zookeeper")
```
SKILL.md›
---
name: cloud-logging-query-generation
metadata:
category: CloudObservabilityAndMonitoring
description: >-
Generates Logging Query Language (LQL) queries for Google Cloud Logging from natural language. Use this skill when you need to query log data or when you are debugging issues. You can filter log data by Google Cloud service. Don't use this skill to query other databases, such as SQL or Cloud Spanner.
---
# Generate Logging Query Language queries
Use this skill to generate correct Logging Query Language (LQL) queries for
Cloud Logging.
## Core rules
1. **Strict syntax requirements:**
* **Always use double quotes (`"`)** for string literals. Do not use
single quotes (`'`).
* Write boolean operators in all capitals: `AND`, `OR`, `NOT`.
* Always use parentheses to group terms and explicitly enforce precedence.
2. **Common pitfalls:**
* **Instance ID vs. Instance Name:** For the `gce_instance` resource type,
do NOT compare instance names to instance IDs. Instance names are
strings (for example, `my-instance`). Instance IDs are numeric. If you
only have the name, then search by instance name,
`SEARCH("my-instance")`, or use `resource.labels.instance_name` if that
label is available for the resource.
* **Resource Type Accuracy:** Do not guess resource types. You must look
up the correct `resource.type` value in the service-specific reference
files. For example, use `internal_http_lb_rule` for Internal HTTP(S)
Load Balancer rules when filtering by forwarding rule name or region
(instead of `http_load_balancer`).
3. **Output format and placeholders:**
* Output **only** the raw LQL query text. Do not include conversational
filler. Do not wrap the query in markdown code blocks unless explicitly
requested by the user. Valid LQL comments (using `--`) are allowed, and
are the ONLY acceptable way to include explanations or warnings.
* **Never block on missing variables.** If the user's request lacks
specific identifiers (like a project ID, instance name, or IP address),
do not ask them for clarification. If the variable is required for a
functional query (like a log bucket name for a regional log), insert an
uppercase placeholder string wrapped in angle brackets (for example,
`"<PROJECT_ID>"`). **CRITICALLY**: If you include a placeholder for a
variable the user omitted, it will act as an explicit filter that causes
logs to be missed. Therefore, you MUST omit the entire filter/line
containing the placeholder if the field is not strictly required. For
example, completely omit `resource.labels.instance_id="..."` if the user
didn't specify an instance, but you MUST include
`logName=".../projects/<PROJECT_ID>/..."` with a placeholder if
constructing a regional log bucket query where a project ID is strictly
required.
4. **Preferred fields:**
* Include `resource.type` and `log_id` restrictions when the query targets
specific Google Cloud services or resources. Global queries (for
example, "latest error logs") do not require these restrictions.
## Detailed reference
Refer to `references/api_reference.md` for LQL syntax rules, including
Operators, NULL handling, SEARCH, and Regex.
## Service reference files
Before generating a query, you MUST read the examples for the specific service.
LQL schemas and `resource.type` values are service-specific. **Do not stop
reading after finding the Base Schema in the file. You must verify if there are
specific requirements for state tracking (like `previousState`) or
resource-specific log IDs detailed in the paragraphs or specific query examples
below the schema block.**
**For the following services, read the exact file listed:**
* [App Engine](references/query_app_engine.md)
* [BigQuery](references/query_bigquery.md)
* [Cloud Deployment Manager](references/query_deployment_manager.md)
* [Cloud Functions](references/query_cloud_functions.md)
* [Cloud Observability (Monitoring, Logging, Trace)](references/query_cloud_observability.md)
* [Cloud Run](references/query_cloud_run.md)
* [Cloud Source Repositories](references/query_cloud_source_repositories.md)
* [Cloud Spanner](references/query_spanner.md)
* [Cloud SQL](references/query_cloud_sql.md)
* [Cloud Storage](references/query_cloud_storage.md)
* [Cloud Tasks](references/query_cloud_tasks.md)
* [Compute Engine (GCE)](references/query_compute_engine.md)
* [Dataflow](references/query_dataflow.md)
* [Dataproc](references/query_dataproc.md)
* [Kubernetes Engine (GKE)](references/query_gke.md)
* [IAM & Service Accounts](references/query_iam.md)
* [Networking (VPC, Load Balancing, and others)](references/query_networking.md)
* [Security (Audit logging)](references/query_security.md)
* [Service Usage (Enable/Disable API, Quotas)](references/query_service_usage.md)
* [Third Party (for example, Nginx, Apache)](references/query_third_party.md)
**For Google Cloud services that aren't listed:** If the service is not listed
above, write the LQL query based on your general knowledge.
## Query generation rules
1. **Resource Types:** Explicitly define the `resource.type` in your queries
when focusing on specific services. For some queries, you may need to search
across multiple types (for example, `resource.type=("bigquery_project" OR
"bigquery_dataset")`).
2. **Audit and Admin Logs:** If the user asks for audit logs, admin logs, API
logs, or logs about who created, updated, deleted, read, or accessed a
resource:
* You MUST read
[references/query_audit_logs.md](references/query_audit_logs.md) for the
correct `protoPayload` schema paths and common examples.
* If a specific example is not listed, guess the `protoPayload.methodName`
by combining the service and verb. When guessing, you MUST use the
scoped `SEARCH()` function (e.g., `SEARCH(protoPayload.methodName,
"compute.instances.insert")`) instead of the exact match operator (`=`)
to avoid version prefix mismatches. Do NOT use the colon operator (`:`)
as it may cause substring false positives.
* For generic API enable/disable events (e.g., a service was disabled),
always use `resource.type="audited_resource"`.
3. **Handling Unknown Schemas (Crucial):** If the user asks to filter by a
specific field or condition, and if you cannot find a matching example or
schema in the reference files, **then you must generate a query using global
search.**
* Only specify `jsonPayload.*` or `protoPayload.*` field structures when
you are certain of their exact name.
* Use the `SEARCH()` function to find the keyword globally within the
correct `resource.type`.
* **Mandatory LQL Comment:** When delivering a query that uses `SEARCH`,
you MUST add an LQL comment (using `--`) at the top of the query
indicating you used a global keyword search because the exact schema
wasn't in your references. Do NOT output conversational text, strictly
adhere to the Output Format rule.
## Supporting links
* [Cloud Logging query language documentation](https://docs.cloud.google.com/logging/docs/view/logging-query-language)
* [Monitored resource types catalog](https://docs.cloud.google.com/logging/docs/api/v2/resource-list)
* [Cloud Logging query library](https://docs.cloud.google.com/logging/docs/view/query-library)