Log Explorer and queries in GCP - Step-by-Step Execution

Process Flow - Log Explorer and queries

Start Log Explorer

↓

Enter Query

↓

Run Query

↓

Logs Filtered

↓

View Results

↓

Refine Query or Export

This flow shows how you open Log Explorer, write a query, run it, see filtered logs, and then refine or export results.

Execution Sample

GCP

resource.type="gce_instance"
severity>=ERROR
jsonPayload.user="alice"

This query filters logs from Compute Engine instances with severity ERROR or higher and user named alice.

Process Table

Step	Action	Query Part Evaluated	Resulting Filter	Logs Matched
1	Start Log Explorer	N/A	No filter	All logs
2	Enter query part 1	resource.type="gce_instance"	Only logs from GCE instances	Subset of all logs
3	Add query part 2	severity>=ERROR	GCE logs with severity ERROR or higher	Smaller subset
4	Add query part 3	jsonPayload.user="alice"	GCE ERROR logs where user is alice	Smallest subset
5	Run query	Full query combined	Final filter applied	Filtered logs shown
6	View results	N/A	N/A	Logs matching all conditions displayed
7	Refine or export	Modify query or export logs	Updated filter or export action	Logs updated or exported

💡 Query executed and logs filtered based on all conditions.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
Filter	None	resource.type="gce_instance"	resource.type="gce_instance" AND severity>=ERROR	resource.type="gce_instance" AND severity>=ERROR AND jsonPayload.user="alice"	Final combined filter

Key Moments - 2 Insights

Why do we combine multiple query parts with AND?

Because each query part narrows down logs further. Combining with AND means logs must meet all conditions, as shown in execution_table rows 2-4.

What happens if the query matches no logs?

The result will be empty logs in step 6. This means no logs meet all conditions, so you may need to adjust the query.

Visual Quiz - 3 Questions

Look at the execution_table, what filter is applied after step 3?

A resource.type="gce_instance"

B severity>=ERROR

C resource.type="gce_instance" AND severity>=ERROR

D jsonPayload.user="alice"

💡 Hint

Check the 'Resulting Filter' column in row for step 3.

At which step does the query include filtering by user 'alice'?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look for 'jsonPayload.user="alice"' in the 'Query Part Evaluated' column.

If you remove the severity filter, how would the logs matched change after step 3?

A Logs would be all GCE logs regardless of severity

B Logs would be only ERROR severity logs

C Logs would be only user alice logs

D Logs would be empty

💡 Hint

Refer to variable_tracker showing how filters combine to narrow logs.

Concept Snapshot

Log Explorer lets you write queries to filter logs.
Use conditions like resource.type, severity, and jsonPayload fields.
Combine conditions with AND to narrow results.
Run query to see matching logs.
Refine query to get precise logs or export results.

Full Transcript

Log Explorer is a tool to find specific logs in Google Cloud. You start by opening it, then write a query with conditions like resource type or severity. Each condition filters logs more. When you run the query, only logs matching all conditions show. You can then look at these logs, change the query to be more precise, or export the logs for analysis. This step-by-step process helps you find exactly the logs you need.

Practice

1. What is the main purpose of the Log Explorer in Google Cloud Platform?

easy

A. To manage user permissions

B. To create virtual machines

C. To search and filter logs generated by cloud resources

D. To deploy applications automatically

Solution

1. Step 1: Understand Log Explorer's role

   Log Explorer is designed to help users find specific log entries by searching and filtering logs.

2. Step 2: Compare with other options

   Creating VMs, managing permissions, and deploying apps are done by other GCP services, not Log Explorer.

3. Final Answer:

   To search and filter logs generated by cloud resources -> Option C

4. Quick Check:

   Log Explorer = Search and filter logs [OK]

Hint: Log Explorer is for logs, not for VMs or permissions [OK]

Common Mistakes:

• Confusing Log Explorer with Compute Engine
• Thinking it manages user roles
• Assuming it deploys apps automatically

2. Which of the following is the correct syntax to filter logs for entries where the severity is ERROR in Log Explorer?

easy

A. severity = "ERROR"

B. severity == "ERROR"

C. severity="ERROR"

D. severity = ERROR

Solution

1. Step 1: Recall Log Explorer filter syntax

   Log Explorer uses single equals (=) with quotes around string values.

2. Step 2: Check each option

   severity = "ERROR" uses correct syntax: single equals (=) with quotes around string values. Omitting quotes, using double equals, or missing spaces around the operator are incorrect.

3. Final Answer:

   severity = "ERROR" -> Option A

4. Quick Check:

   Use = and quotes for strings [OK]

Hint: Use = and quotes for string filters in Log Explorer [OK]

Common Mistakes:

• Using == instead of =
• Omitting quotes around string values
• Missing spaces around =

3. Given the query resource.type = "gce_instance" AND severity = "WARNING", what kind of log entries will this return?

medium

A. All logs from any resource with severity WARNING

B. Logs from Google Compute Engine instances with any severity

C. Logs from any resource with severity ERROR or WARNING

D. Logs from Google Compute Engine instances with severity WARNING

Solution

1. Step 1: Analyze the query conditions

   The query filters logs where resource.type equals "gce_instance" AND severity equals "WARNING".

2. Step 2: Understand the AND operator effect

   Both conditions must be true, so logs must be from GCE instances and have WARNING severity.

3. Final Answer:

   Logs from Google Compute Engine instances with severity WARNING -> Option D

4. Quick Check:

   AND means both conditions true [OK]

Hint: AND means both filters must match logs [OK]

Common Mistakes:

• Thinking OR is used instead of AND
• Ignoring resource.type filter
• Assuming severity includes ERROR

4. You wrote this query in Log Explorer: resource.type = "gce_instance" OR severity = "ERROR" AND timestamp > "2024-01-01T00:00:00Z". Why might this not return expected results?

medium

A. Because AND has higher precedence than OR, so the query groups incorrectly

B. Because timestamp filter syntax is invalid

C. Because severity cannot be combined with resource.type

D. Because OR operator is not supported in Log Explorer

Solution

1. Step 1: Understand operator precedence in Log Explorer

   AND has higher precedence than OR, so the query is read as resource.type = "gce_instance" OR (severity = "ERROR" AND timestamp > ...).

2. Step 2: Identify grouping issue

   This means logs with resource.type "gce_instance" are included regardless of timestamp or severity, which may not be intended.

3. Final Answer:

   Because AND has higher precedence than OR, so the query groups incorrectly -> Option A

4. Quick Check:

   AND binds tighter than OR [OK]

Hint: Use parentheses to group AND/OR conditions correctly [OK]

Common Mistakes:

• Ignoring operator precedence
• Assuming OR has higher precedence
• Thinking OR is unsupported

5. You want to find logs from Compute Engine instances that either have severity ERROR or occurred after March 1, 2024. Which query correctly expresses this in Log Explorer?

hard

A. (resource.type = "gce_instance" AND severity = "ERROR") OR timestamp > "2024-03-01T00:00:00Z"

B. resource.type = "gce_instance" AND (severity = "ERROR" OR timestamp > "2024-03-01T00:00:00Z")

C. resource.type = "gce_instance" OR severity = "ERROR" AND timestamp > "2024-03-01T00:00:00Z"

D. resource.type = "gce_instance" AND severity = "ERROR" OR timestamp > "2024-03-01T00:00:00Z"

Solution

1. Step 1: Understand the requirement

   We want logs from GCE instances where severity is ERROR or logs from GCE instances after March 1, 2024.

2. Step 2: Analyze each option's logic

   resource.type = "gce_instance" AND (severity = "ERROR" OR timestamp > "2024-03-01T00:00:00Z") groups severity and timestamp with OR inside parentheses combined with resource.type using AND, matching the requirement.

3. Step 3: Check other options

   (resource.type = "gce_instance" AND severity = "ERROR") OR timestamp > "2024-03-01T00:00:00Z" includes logs after March 1 from any resource, not just GCE instances. The remaining options lack parentheses, causing wrong precedence.

4. Final Answer:

   resource.type = "gce_instance" AND (severity = "ERROR" OR timestamp > "2024-03-01T00:00:00Z") -> Option B

5. Quick Check:

   Use parentheses to combine OR inside AND [OK]

Hint: Use parentheses to group OR inside AND correctly [OK]

Common Mistakes:

• Missing parentheses causing wrong logic
• Including timestamp filter outside resource.type scope
• Assuming OR has same precedence as AND