Introduction

When you run apps or services on Google Cloud, you get lots of messages about what is happening. Log Explorer helps you find and read these messages easily by searching and filtering them with simple queries.

When you want to find errors or warnings in your app logs quickly.

When you need to check if a recent change caused any problems by looking at logs.

When you want to see how many times a specific event happened in your cloud services.

When you want to filter logs by time, severity, or resource type to focus on important messages.

When you want to create a saved query to reuse later for monitoring your app health.

Commands

This command reads the last 5 error or worse logs from Google App Engine apps. It helps you quickly see recent serious problems.

Terminal

gcloud logging read "resource.type=gae_app AND severity>=ERROR" --limit=5 --format=json

Expected OutputExpected

[ { "insertId": "1abcde...", "jsonPayload": { "message": "Error connecting to database" }, "resource": { "type": "gae_app" }, "severity": "ERROR", "timestamp": "2024-06-01T12:00:00Z" }, { "insertId": "2fghij...", "jsonPayload": { "message": "Timeout while calling external API" }, "resource": { "type": "gae_app" }, "severity": "ERROR", "timestamp": "2024-06-01T11:59:30Z" } ]

→

--limit - Limits the number of log entries returned

→

--format - Formats the output as JSON for easy reading or scripting

This command shows the last 3 logs from Compute Engine instances starting from June 1, 2024, displaying time, severity, and message in a table format for easy reading.

Terminal

gcloud logging read "resource.type=compute_instance AND timestamp>=\"2024-06-01T00:00:00Z\"" --limit=3 --format='table(timestamp, severity, textPayload)'

Expected OutputExpected

TIMESTAMP SEVERITY TEXTPAYLOAD 2024-06-01T10:00:00Z INFO Instance started 2024-06-01T10:05:00Z WARNING Disk space low 2024-06-01T10:10:00Z ERROR Failed to mount disk

→

--format - Shows output in a readable table format

This command fetches the last 10 logs that are warnings or errors from all resources, helping you focus on important issues.

Terminal

gcloud logging read "severity=WARNING OR severity=ERROR" --limit=10

Expected OutputExpected

InsertId: 3klmno... Severity: WARNING Timestamp: 2024-06-01T09:00:00Z TextPayload: High memory usage detected InsertId: 4pqrs... Severity: ERROR Timestamp: 2024-06-01T08:45:00Z TextPayload: Application crashed unexpectedly

→

--limit - Limits the number of log entries returned

Key Concept

If you remember nothing else from this pattern, remember: use simple filters in Log Explorer queries to quickly find the exact logs you need.

Common Mistakes

Using incorrect quotes or missing quotes around the query string

The command fails because the shell cannot parse the query properly.

Always wrap the entire query in double quotes and escape inner quotes if needed.

Not specifying resource types or severity filters

You get too many logs, making it hard to find relevant information.

Add filters like resource.type or severity to narrow down results.

Forgetting to use --limit flag

The command may return too many logs, causing slow output or hitting quota limits.

Always use --limit to control how many logs you retrieve.

Summary

Use gcloud logging read with filters to find specific logs by resource type, severity, or time.

Use --limit to control how many log entries you get back for faster results.

Format output with --format to make logs easier to read or process.