Bird
Raised Fist0
GCPcloud~5 mins

Log Explorer and queries in GCP - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Introduction
When you run apps or services on Google Cloud, you get lots of messages about what is happening. Log Explorer helps you find and read these messages easily by searching and filtering them with simple queries.
When you want to find errors or warnings in your app logs quickly.
When you need to check if a recent change caused any problems by looking at logs.
When you want to see how many times a specific event happened in your cloud services.
When you want to filter logs by time, severity, or resource type to focus on important messages.
When you want to create a saved query to reuse later for monitoring your app health.
Commands
This command reads the last 5 error or worse logs from Google App Engine apps. It helps you quickly see recent serious problems.
Terminal
gcloud logging read "resource.type=gae_app AND severity>=ERROR" --limit=5 --format=json
Expected OutputExpected
[ { "insertId": "1abcde...", "jsonPayload": { "message": "Error connecting to database" }, "resource": { "type": "gae_app" }, "severity": "ERROR", "timestamp": "2024-06-01T12:00:00Z" }, { "insertId": "2fghij...", "jsonPayload": { "message": "Timeout while calling external API" }, "resource": { "type": "gae_app" }, "severity": "ERROR", "timestamp": "2024-06-01T11:59:30Z" } ]
→
--limit - Limits the number of log entries returned
→
--format - Formats the output as JSON for easy reading or scripting
This command shows the last 3 logs from Compute Engine instances starting from June 1, 2024, displaying time, severity, and message in a table format for easy reading.
Terminal
gcloud logging read "resource.type=compute_instance AND timestamp>=\"2024-06-01T00:00:00Z\"" --limit=3 --format='table(timestamp, severity, textPayload)'
Expected OutputExpected
TIMESTAMP SEVERITY TEXTPAYLOAD 2024-06-01T10:00:00Z INFO Instance started 2024-06-01T10:05:00Z WARNING Disk space low 2024-06-01T10:10:00Z ERROR Failed to mount disk
→
--format - Shows output in a readable table format
This command fetches the last 10 logs that are warnings or errors from all resources, helping you focus on important issues.
Terminal
gcloud logging read "severity=WARNING OR severity=ERROR" --limit=10
Expected OutputExpected
InsertId: 3klmno... Severity: WARNING Timestamp: 2024-06-01T09:00:00Z TextPayload: High memory usage detected InsertId: 4pqrs... Severity: ERROR Timestamp: 2024-06-01T08:45:00Z TextPayload: Application crashed unexpectedly
→
--limit - Limits the number of log entries returned
Key Concept

If you remember nothing else from this pattern, remember: use simple filters in Log Explorer queries to quickly find the exact logs you need.

Common Mistakes
Using incorrect quotes or missing quotes around the query string
The command fails because the shell cannot parse the query properly.
Always wrap the entire query in double quotes and escape inner quotes if needed.
Not specifying resource types or severity filters
You get too many logs, making it hard to find relevant information.
Add filters like resource.type or severity to narrow down results.
Forgetting to use --limit flag
The command may return too many logs, causing slow output or hitting quota limits.
Always use --limit to control how many logs you retrieve.
Summary
Use gcloud logging read with filters to find specific logs by resource type, severity, or time.
Use --limit to control how many log entries you get back for faster results.
Format output with --format to make logs easier to read or process.

Practice

(1/5)
1. What is the main purpose of the Log Explorer in Google Cloud Platform?
easy
A. To manage user permissions
B. To create virtual machines
C. To search and filter logs generated by cloud resources
D. To deploy applications automatically

Solution

  1. Step 1: Understand Log Explorer's role

    Log Explorer is designed to help users find specific log entries by searching and filtering logs.

  2. Step 2: Compare with other options

    Creating VMs, managing permissions, and deploying apps are done by other GCP services, not Log Explorer.

  3. Final Answer:

    To search and filter logs generated by cloud resources -> Option C

  4. Quick Check:

    Log Explorer = Search and filter logs [OK]
Hint: Log Explorer is for logs, not for VMs or permissions [OK]
Common Mistakes:
  • Confusing Log Explorer with Compute Engine
  • Thinking it manages user roles
  • Assuming it deploys apps automatically
2. Which of the following is the correct syntax to filter logs for entries where the severity is ERROR in Log Explorer?
easy
A. severity = "ERROR"
B. severity == "ERROR"
C. severity="ERROR"
D. severity = ERROR

Solution

  1. Step 1: Recall Log Explorer filter syntax

    Log Explorer uses single equals (=) with quotes around string values.

  2. Step 2: Check each option

    severity = "ERROR" uses correct syntax: single equals (=) with quotes around string values. Omitting quotes, using double equals, or missing spaces around the operator are incorrect.

  3. Final Answer:

    severity = "ERROR" -> Option A

  4. Quick Check:

    Use = and quotes for strings [OK]
Hint: Use = and quotes for string filters in Log Explorer [OK]
Common Mistakes:
  • Using == instead of =
  • Omitting quotes around string values
  • Missing spaces around =
3. Given the query resource.type = "gce_instance" AND severity = "WARNING", what kind of log entries will this return?
medium
A. All logs from any resource with severity WARNING
B. Logs from Google Compute Engine instances with any severity
C. Logs from any resource with severity ERROR or WARNING
D. Logs from Google Compute Engine instances with severity WARNING

Solution

  1. Step 1: Analyze the query conditions

    The query filters logs where resource.type equals "gce_instance" AND severity equals "WARNING".

  2. Step 2: Understand the AND operator effect

    Both conditions must be true, so logs must be from GCE instances and have WARNING severity.

  3. Final Answer:

    Logs from Google Compute Engine instances with severity WARNING -> Option D

  4. Quick Check:

    AND means both conditions true [OK]
Hint: AND means both filters must match logs [OK]
Common Mistakes:
  • Thinking OR is used instead of AND
  • Ignoring resource.type filter
  • Assuming severity includes ERROR
4. You wrote this query in Log Explorer: resource.type = "gce_instance" OR severity = "ERROR" AND timestamp > "2024-01-01T00:00:00Z". Why might this not return expected results?
medium
A. Because AND has higher precedence than OR, so the query groups incorrectly
B. Because timestamp filter syntax is invalid
C. Because severity cannot be combined with resource.type
D. Because OR operator is not supported in Log Explorer

Solution

  1. Step 1: Understand operator precedence in Log Explorer

    AND has higher precedence than OR, so the query is read as resource.type = "gce_instance" OR (severity = "ERROR" AND timestamp > ...).

  2. Step 2: Identify grouping issue

    This means logs with resource.type "gce_instance" are included regardless of timestamp or severity, which may not be intended.

  3. Final Answer:

    Because AND has higher precedence than OR, so the query groups incorrectly -> Option A

  4. Quick Check:

    AND binds tighter than OR [OK]
Hint: Use parentheses to group AND/OR conditions correctly [OK]
Common Mistakes:
  • Ignoring operator precedence
  • Assuming OR has higher precedence
  • Thinking OR is unsupported
5. You want to find logs from Compute Engine instances that either have severity ERROR or occurred after March 1, 2024. Which query correctly expresses this in Log Explorer?
hard
A. (resource.type = "gce_instance" AND severity = "ERROR") OR timestamp > "2024-03-01T00:00:00Z"
B. resource.type = "gce_instance" AND (severity = "ERROR" OR timestamp > "2024-03-01T00:00:00Z")
C. resource.type = "gce_instance" OR severity = "ERROR" AND timestamp > "2024-03-01T00:00:00Z"
D. resource.type = "gce_instance" AND severity = "ERROR" OR timestamp > "2024-03-01T00:00:00Z"

Solution

  1. Step 1: Understand the requirement

    We want logs from GCE instances where severity is ERROR or logs from GCE instances after March 1, 2024.

  2. Step 2: Analyze each option's logic

    resource.type = "gce_instance" AND (severity = "ERROR" OR timestamp > "2024-03-01T00:00:00Z") groups severity and timestamp with OR inside parentheses combined with resource.type using AND, matching the requirement.

  3. Step 3: Check other options

    (resource.type = "gce_instance" AND severity = "ERROR") OR timestamp > "2024-03-01T00:00:00Z" includes logs after March 1 from any resource, not just GCE instances. The remaining options lack parentheses, causing wrong precedence.

  4. Final Answer:

    resource.type = "gce_instance" AND (severity = "ERROR" OR timestamp > "2024-03-01T00:00:00Z") -> Option B

  5. Quick Check:

    Use parentheses to combine OR inside AND [OK]
Hint: Use parentheses to group OR inside AND correctly [OK]
Common Mistakes:
  • Missing parentheses causing wrong logic
  • Including timestamp filter outside resource.type scope
  • Assuming OR has same precedence as AND
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard