Log Explorer and queries in GCP - Step-by-Step Execution

Process Flow - Log Explorer and queries

Start Log Explorer

↓

Enter Query

↓

Run Query

↓

Logs Filtered

↓

View Results

↓

Refine Query or Export

This flow shows how you open Log Explorer, write a query, run it, see filtered logs, and then refine or export results.

Execution Sample

GCP

resource.type="gce_instance"
severity>=ERROR
jsonPayload.user="alice"

This query filters logs from Compute Engine instances with severity ERROR or higher and user named alice.

Process Table

Step	Action	Query Part Evaluated	Resulting Filter	Logs Matched
1	Start Log Explorer	N/A	No filter	All logs
2	Enter query part 1	resource.type="gce_instance"	Only logs from GCE instances	Subset of all logs
3	Add query part 2	severity>=ERROR	GCE logs with severity ERROR or higher	Smaller subset
4	Add query part 3	jsonPayload.user="alice"	GCE ERROR logs where user is alice	Smallest subset
5	Run query	Full query combined	Final filter applied	Filtered logs shown
6	View results	N/A	N/A	Logs matching all conditions displayed
7	Refine or export	Modify query or export logs	Updated filter or export action	Logs updated or exported

💡 Query executed and logs filtered based on all conditions.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
Filter	None	resource.type="gce_instance"	resource.type="gce_instance" AND severity>=ERROR	resource.type="gce_instance" AND severity>=ERROR AND jsonPayload.user="alice"	Final combined filter

Key Moments - 2 Insights

Why do we combine multiple query parts with AND?

Because each query part narrows down logs further. Combining with AND means logs must meet all conditions, as shown in execution_table rows 2-4.

What happens if the query matches no logs?

The result will be empty logs in step 6. This means no logs meet all conditions, so you may need to adjust the query.

Visual Quiz - 3 Questions

Look at the execution_table, what filter is applied after step 3?

A resource.type="gce_instance"

B severity>=ERROR

C resource.type="gce_instance" AND severity>=ERROR

D jsonPayload.user="alice"

💡 Hint

Check the 'Resulting Filter' column in row for step 3.

At which step does the query include filtering by user 'alice'?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look for 'jsonPayload.user="alice"' in the 'Query Part Evaluated' column.

If you remove the severity filter, how would the logs matched change after step 3?

A Logs would be all GCE logs regardless of severity

B Logs would be only ERROR severity logs

C Logs would be only user alice logs

D Logs would be empty

💡 Hint

Refer to variable_tracker showing how filters combine to narrow logs.

Concept Snapshot

Log Explorer lets you write queries to filter logs.
Use conditions like resource.type, severity, and jsonPayload fields.
Combine conditions with AND to narrow results.
Run query to see matching logs.
Refine query to get precise logs or export results.

Full Transcript

Log Explorer is a tool to find specific logs in Google Cloud. You start by opening it, then write a query with conditions like resource type or severity. Each condition filters logs more. When you run the query, only logs matching all conditions show. You can then look at these logs, change the query to be more precise, or export the logs for analysis. This step-by-step process helps you find exactly the logs you need.