Sample queries

This document provides you with suggested queries to make it easier to find important logs using the Logs Explorer in the Trusted Cloud console. The listed queries are written in the Logging query language, and they can be used in the Logs Explorer, the Logging API, or the command-line interface.

The Logs Explorer uses Boolean expressions to specify a subset of all the log entries in your project. You can use these queries to choose log entries from specific logs or log services, or that satisfy conditions on metadata or user-defined fields.

Before you begin

Ensure that you have the correct Identity and Access Management permissions or roles for building queries using the Logs Explorer. For details on the necessary IAM permissions, see Permissions for the Trusted Cloud console.

Get started

  1. In the Trusted Cloud console, go to the Logs Explorer page:

    Go to Logs Explorer

    If you use the search bar to find this page, then select the result whose subheading is Logging.

  2. Select the appropriate Trusted Cloud project or other Trusted Cloud resource for which you want to view logs.

Use the sample queries

To apply a query from the following tables, click the Content Copy icon for the expression, and then paste the copied expression into the Logs Explorer query-editor field.

If you don't see the query-editor field, enable Show query.

After you review your query expression, click Run query. Logs that match your query are listed under Query results.

Some of the queries listed later on this page include variables that you should replace with valid values. For example, when a query includes logName, then the PROJECT_ID you supply must refer to the selected Trusted Cloud project; otherwise, the query won't work.

Note the following:

  • If you have a query with a timestamp, then the time-range selector is disabled, and the query uses the timestamp expression as its time-range restriction. If a query doesn't use a timestamp expression, then the query uses the time-range selector as its time-range restriction.

  • The length of a query can't exceed 20,000 characters.

  • The Logging query language is case-insensitive, with the exception of regular expressions.

  • You can use the log_id function for queries with a log_name expression. For example, the expression log_name="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access" is the same as log_id("cloudaudit.googleapis.com/data_access"). For more information about the log_id function, see Logging query language: Functions.

For instructions about querying in the Trusted Cloud console, see Build queries in the Logs Explorer.

The following sections group queries by Trusted Cloud services.

BigQuery queries

Query/filter name Expression
BigQuery audit logs 
resource.type=("bigquery_dataset" OR "bigquery_project") AND
logName:"cloudaudit.googleapis.com"
BigQuery audit logs for a project 
resource.type="bigquery_project" AND
logName:"cloudaudit.googleapis.com"
BigQuery audit logs for a dataset 
resource.type="bigquery_dataset" AND
logName:"cloudaudit.googleapis.com"
BigQuery audit logs for BI Engine Model 
resource.type="bigquery_biengine_model" AND
logName:"cloudaudit.googleapis.com"
BigQuery audit logs for a Data Transfer Service Run. 
resource.type="bigquery_dts_run" AND
logName:"cloudaudit.googleapis.com"
BigQuery audit logs for a Data Transfer Service configuration. 
resource.type="bigquery_dts_config" AND
logName:"cloudaudit.googleapis.com"
BigQuery data transfer service jobs 
resource.type=("bigquery_project") AND
protoPayload.requestMetadata.callerSuppliedUserAgent=
"BigQuery Data Transfer Service" AND
protoPayload.methodName=("google.cloud.bigquery.v2.JobService.InsertJob" OR
"google.cloud.bigquery.v2.JobService.Query")
BigQuery transfer run logs 
resource.type="bigquery_dts_config" AND
labels.run_id="RUN_ID" AND
resource.labels.config_id="CONFIG_ID"
BigQuery dataset updates 
resource.type="bigquery_dataset" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName=
"google.cloud.bigquery.v2.DatasetService.UpdateDataset"
BigQuery jobs completed 
resource.type="bigquery_project" AND
log_id("cloudaudit.googleapis.com/data_access") AND
protoPayload.methodName=("google.cloud.bigquery.v2.JobService.InsertJob"
OR "google.cloud.bigquery.v2.JobService.Query")
BigQuery large queries 
resource.type="bigquery_project" AND
protoPayload.metadata.jobChange.job.jobStats.queryStats.totalBilledBytes
> 1073741824
BigQuery quota exceeded 
resource.type=("bigquery_dataset" OR "bigquery_project")
AND
protoPayload.status.code=8 AND
severity>=WARNING
BigQuery query started 
resource.type="bigquery_project" AND
protoPayload.metadata.jobInsertion.reason:*
BigQuery concurrent load/extract jobs 
resource.type="bigquery_resource" AND
protoPayload.methodName="jobservice.insert" AND
protoPayload.serviceData.jobInsertRequest.resource.jobConfiguration.query.query:
"extract"
BigQuery audit logs for Row Access Policy 
protoPayload.methodName="jobservice.insert" AND
protoPayload.serviceData.jobInsertRequest.resource.jobConfiguration.query.query:"ROW ACCESS POLICY"

Cloud SQL queries

Query/filter name Expression
Cloud SQL audit logs 
resource.type="cloudsql_database" AND
resource.labels.database_id="DATABASE_ID" AND
log_id("cloudaudit.googleapis.com/activity")
Cloud SQL MySQL error logs 
resource.type="cloudsql_database" AND
log_id("cloudsql.googleapis.com/mysql.err")
Cloud SQL MySQL-based databases 
resource.type="cloudsql_database" AND
resource.labels.database_id="DATABASE_ID" AND
log_id("cloudsql.googleapis.com/mysql")
Cloud SQL Postgres-based databases 
resource.type="cloudsql_database" AND
resource.labels.database_id="DATABASE_ID" AND
log_id("cloudsql.googleapis.com/postgres.log")
Cloud SQL SQL Server error logs 
resource.type="cloudsql_database" AND
log_id("cloudsql.googleapis.com/sqlserver.err")
Cloud SQL SQL Server-based databases 
resource.type="cloudsql_database" AND
resource.labels.database_id="DATABASE_ID" AND
log_id("cloudsql.googleapis.com/sqlagent.out")

Cloud Storage queries

Query/filter name Expression
GCS bucket logs 
resource.type="gcs_bucket" AND
resource.labels.bucket_name="BUCKET_NAME"
GCS bucket audit logs 
resource.type="gcs_bucket" AND
logName:"cloudaudit.googleapis.com"
GCS bucket creation logs 
resource.type="gcs_bucket" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.method_name="storage.buckets.create"
GCS bucket deletion logs 
resource.type="gcs_bucket" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.method_name="storage.buckets.delete"

Compute Engine queries

Query/filter name Expression
Compute Engine Admin Activity logs 
resource.type="gce_instance" AND
log_id("cloudaudit.googleapis.com/activity")
Compute Engine firewall rule deletion 
resource.type="gce_firewall_rule" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName:"firewalls.delete"
Compute Engine VM syslogs 
resource.type="gce_instance" AND
log_id("syslog")
Compute Engine VM authlogs 
resource.type="gce_instance" AND
log_id("authlog")
Compute Engine Host Error 
resource.type="gce_instance"
protoPayload.serviceName="compute.googleapis.com"
(protoPayload.methodName:"compute.instances.hostError"
OR
operation.producer:"compute.instances.hostError")
log_id("cloudaudit.googleapis.com/system_event")
resource.labels.instance_id="INSTANCE_ID"
 severity=INFO
Compute Engine Host Memory Alert 
resource.type="gce_instance" AND
protoPayload.serviceName="compute.googleapis.com" AND
(jsonPayload.methodName:"compute.instances.host_event_notify"
OR
operation.producer:"compute.instances.host_event_notify") AND
log_id("cloudaudit.googleapis.com/host_event_notify") AND
resource.labels.instance_id="INSTANCE_ID" AND
severity=CRITICAL
Compute Engine Host Migrated 
resource.type="gce_instance"
protoPayload.serviceName="compute.googleapis.com"
(protoPayload.methodName:
"compute.instances.migrateOnHostMaintenance"
OR
operation.producer:
"compute.instances.migrateOnHostMaintenance")
log_id("cloudaudit.googleapis.com/system_event")
resource.labels.instance_id="INSTANCE_ID"
severity=INFO
Compute Engine VM Terminated/Preempted 
resource.type="gce_instance"
protoPayload.methodName=~"compute\.instances\.(guestTerminate|preempted)"
log_id("cloudaudit.googleapis.com/system_event")
resource.labels.instance_id="INSTANCE_ID"
Compute Engine VM terminated due to Scratch Disk Creation Failure 
resource.type="gce_instance"
protoPayload.serviceName="compute.googleapis.com"
(protoPayload.methodName="compute.instances.scratchDiskCreationFailed"
OR
operation.producer:
"compute.instances.scratchDiskCreationFailed)
log_id("cloudaudit.googleapis.com/system_event")
resource.labels.instance_id="INSTANCE_ID"
severity=INFO
Compute Engine VM Instance Created 
resource.type="gce_instance"
protoPayload.methodName:"compute.instances.insert"
log_id("cloudaudit.googleapis.com/activity")
protoPayload.request.name="INSTANCE_NAME"
Compute Engine VM Instance Deleted with Name 
resource.type="gce_instance"
protoPayload.methodName:"compute.instances.delete"
log_id("cloudaudit.googleapis.com/activity")
protoPayload.resourceName:"INSTANCE_NAME"
Compute Engine VM Instance Deleted with ID 
resource.type="gce_instance"
protoPayload.methodName:"compute.instances.delete"
log_id("cloudaudit.googleapis.com/activity")
resource.labels.instance_id="INSTANCE_ID"
Compute Engine VM Instance Restarted 
resource.type="gce_instance"
protoPayload.methodName=~"compute\.instances\.(
stop|reset|automaticRestart|guestTerminate|
instanceManagerHaltForRestart)"
(log_id("cloudaudit.googleapis.com/activity")
OR log_id("cloudaudit.googleapis.com/system_event"))
resource.labels.instance_id="INSTANCE_ID"
Compute Engine Shielded VM Boot Integrity Failure 
resource.type="gce_instance"
log_id("compute.googleapis.com/shielded_vm_integrity")
jsonPayload.earlyBootReportEvent.policyEvaluationPassed="false"
resource.labels.instance_id="INSTANCE_ID"
Compute Engine VM instance stopped by Guest OS 
resource.type="gce_instance"
protoPayload.serviceName="compute.googleapis.com"
(protoPayload.methodName:"compute.instances.guestTerminate" OR
operation.producer:"compute.instances.guestTerminate")
log_id("cloudaudit.googleapis.com/system_event")
resource.labels.instance_id="INSTANCE_ID"
severity=INFO
Compute Engine Shielded VM boot file was blocked 
resource.type="gce_instance"
log_id("serialconsole.googleapis.com/serial_port_1_output")
textPayload:("Security Violation")
resource.labels.instance_id="INSTANCE_ID"
Persistent Disk Created 
resource.type="gce_disk" AND
protoPayload.methodName:"compute.disks.insert" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.resourceName: "PERSISTENT_DISK_NAME"
Nodes added in Sole Tenant Node 
resource.type="gce_node_group"
log_id("cloudaudit.googleapis.com/activity")
protoPayload.methodName=~("compute.nodeGroups.addNodes"
OR "compute.nodeGroups.insert")
resource.labels.node_group_id="NODE_GROUP_ID"
severity="INFO"
Autoscale events in Sole Tenant Node 
resource.type="gce_node_group"
log_id("cloudaudit.googleapis.com/system_event")
protoPayload.methodName=~("compute.nodeGroups.deleteNodes"
OR "compute.nodeGroups.addNodes")
resource.labels.node_group_id="NODE_GROUP_ID"
Manual Snapshot Taken 
resource.type="gce_snapshot"
log_id("cloudaudit.googleapis.com/activity")
protoPayload.methodName:"compute.snapshots.insert"
protoPayload.resourceName:"SNAPSHOT_NAME"
Scheduled Snapshot Taken 
resource.type="gce_disk"
log_id("cloudaudit.googleapis.com/system_event")
protoPayload.methodName="ScheduledSnapshots"
protoPayload.response.operationType="createSnapshot"
protoPayload.response.targetLink="PERSISTENT_DISK_NAME"
Snapshot Schedule Created 
resource.type="gce_resource_policy"
log_id("cloudaudit.googleapis.com/activity")
protoPayload.methodName:"compute.resourcePolicies.insert"
protoPayload.request.name="SCHEDULE_NAME"
Snapshot Schedule Attached 
resource.type="gce_disk"
log_id("cloudaudit.googleapis.com/activity")
protoPayload.methodName:"compute.disks.addResourcePolicies"
protoPayload.request.resourcePolicys:"SCHEDULE_NAME"
protoPayload.resourceName:"PERSISTENT_DISK_NAME"
Quota Exceeded 
resource.type="gce_instance"
protoPayload.methodName:"compute.instances.insert"
protoPayload.status.message:"QUOTA_EXCEEDED"
severity=ERROR
Query unhealthy instances in instance group 
resource.type="gce_instance_group"
resource.labels.instance_group_name="INSTANCE_GROUP_NAME"
jsonPayload.healthCheckProbeResult.healthState="UNHEALTHY"
Query instance group members within a time frame in UTC time format 
resource.type="gce_instance_group_manager"
resource.labels.instance_group_manager_name="INSTANCE_GROUP_NAME"
jsonPayload.@type=
"type.googleapis.com/compute.InstanceGroupManagerEvent"
jsonPayload.instanceHealthStateChange.detailedHealthState="HEALTHY"
timestamp >= START_TIME timestamp <= END_TIME
Instances added to Instance Group 
resource.type="gce_instance_group"
protoPayload.methodName:"compute.instanceGroups.addInstances"
log_id("cloudaudit.googleapis.com/activity")
resource.labels.instance_group_name="INSTANCE_GROUP_NAME"
Instances removed from Instance Group 
resource.type="gce_instance_group"
protoPayload.methodName:"compute.instanceGroups.removeInstances"
log_id("cloudaudit.googleapis.com/activity")
resource.labels.instance_group_name="INSTANCE_GROUP_NAME"
Instance template set or updated 
resource.type="gce_instance_group_manager"
log_id("cloudaudit.googleapis.com/activity")
protoPayload.methodName=
"v1.compute.instanceGroupManagers.setInstanceTemplate"
resource.labels.instance_group_manager_name="INSTANCE_GROUP_MANAGER"
Firewall rule deleted 
resource.type="gce_firewall_rule"
log_id("cloudaudit.googleapis.com/activity")
protoPayload.methodName:"firewalls.delete"
Firewall logs 
resource.type="gce_subnetwork"
log_id("compute.googleapis.com/firewall")
jsonPayload.instance.vm_name="INSTANCE_NAME"

Google Cloud Observability queries

Query/filter name Expression
Log sink activities 
resource.type="logging_sink" AND
log_id("cloudaudit.googleapis.com/activity")

Identity and Access Management queries

Query/filter name Expression
Service account creation logs 
resource.type="service_account" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.iam.admin.v1.CreateServiceAccount"
Service account creation key logs 
resource.type="service_account" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"
Set access control policy logs 
resource.type="project" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="SetIamPolicy"
External principal granted access to organization 
resource.type="project" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND
protoPayload.request.@type:"IamPolicy" AND
protoPayload.serviceData.policyDelta.bindingDeltas.member:* AND
NOT protoPayload.serviceData.policyDelta.bindingDeltas.member:"@DOMAIN_NAME.com"
Resource creation, modification, or deletion 
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName:("create" OR "delete" OR "update")
Role granted to principal 
log_id("cloudaudit.googleapis.com/activity") AND
resource.type="project" AND
protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND
protoPayload.methodName="SetIamPolicy" AND
protoPayload.serviceData.policyDelta.bindingDeltas.action="Add" AND
protoPayload.serviceData.policyDelta.bindingDeltas.member:"EMAIL_ID"
Role removed from principal 
log_id("cloudaudit.googleapis.com/activity") AND
resource.type="project" AND
protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND
protoPayload.methodName="SetIamPolicy" AND
protoPayload.serviceData.policyDelta.bindingDeltas.action="Remove" AND
protoPayload.serviceData.policyDelta.bindingDeltas.member:"EMAIL_ID"
Permission updated in a custom role 
log_id("cloudaudit.googleapis.com/activity") AND
resource.type="iam_role" AND
protoPayload.serviceName="iam.googleapis.com" AND
protoPayload.methodName:"UpdateRole" AND
resource.labels.role_name:"ROLE_ID"

Kubernetes-related queries

For an overview and examples of Admin Activity audit log queries, see those provided on the GKE Audit logging page.

Cluster-level queries

Query/filter name Expression
Google Kubernetes Engine cluster operations 
resource.type="gke_cluster" AND
log_id("cloudaudit.googleapis.com/activity")
Google Kubernetes Engine cluster creation 
resource.type="gke_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.container.v1.ClusterManager.CreateCluster"
Kubernetes cluster deployment 
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName:"deployments"
Kubernetes cluster authentication failure 
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.authenticationInfo.principalEmail="system:anonymous"
Kubernetes cluster operations and events in us-central1-b 
resource.type="k8s_cluster" AND
resource.labels.location="us-central1-b"
Kubernetes pod requests from users 
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName:"io.k8s.core.v1.pods" AND
protoPayload.authenticationInfo.principalEmail="USER_EMAIL"
Kubernetes events 
resource.type="k8s_cluster" AND
log_id("events")
Kubernetes Endpoints update 
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.request.kind="Endpoints"
Kubernetes control plane logs 
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="k8s.io"
Kubernetes Engine control plane logs 
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="container.googleapis.com"
Pod deletion 
resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName=~"io\.k8s\.core\.v1\.pods\.(create|delete)"
Kubernetes pod audit logs from control plane 
resource.type="k8s_cluster" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.resourceName="core/v1/namespaces/POD_NAMESPACE/pods/POD_NAME
Kubernetes pod evictions 
resource.type="k8s_cluster" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="io.k8s.core.v1.pods.eviction.create"
Kubernetes node audit logs from the control plane 
resource.type="k8s_cluster" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName:"io.k8s.core.v1.nodes"
Kubernetes cluster control plane for Addon Manager Activity 
resource.type="k8s_cluster" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.authenticationInfo.principalEmail="system:addon-manager"
Kubernetes control plane errors (excluding Conflict, which is normal) 
resource.type="k8s_cluster" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.status.message!="Conflict" AND
protoPayload.status.code!=0
Ingress Controller events 
resource.type="k8s_cluster" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("events") AND
jsonPayload.source.component="loadbalancer-controller"
Service Controller events (kube-controller-manager) 
resource.type="k8s_cluster" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("events") AND
jsonPayload.source.component="service-controller"
Cluster Autoscaler events 
resource.type="k8s_cluster" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("events") AND
jsonPayload.source.component="cluster-autoscaler"

Pod-level queries

Filter name Expression
Query pod during creation 
resource.type="k8s_pod" AND
resource.labels.pod_name="POD_NAME" AND
log_id("events")
Query pod terminated due to resource pressure 
resource.type="k8s_pod" AND
        log_id("events") AND
        jsonPayload.reason="Evicted"
Scheduler events 
resource.type="k8s_pod" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("events") AND
jsonPayload.source.component="default-scheduler"
Scheduler events (preemptions) 
resource.type="k8s_pod" AND
resource.labels.location="CLUSTER_LOCATION" AND
resource.labels.cluster_name="CLUSTER_NAME" AND
log_id("events") AND
jsonPayload.source.component="default-scheduler" AND
jsonPayload.reason="Preempted"

Node-level queries

Filter name Expression
Node events 
resource.type="k8s_node" AND
log_id("events")
Looking at Kube-proxy logs 
resource.type="k8s_node" AND
log_id("kube-proxy")
Looking at dockerd logs 
resource.type="k8s_node" AND
log_id("container-runtime")
Looking at kubelet errors or failures 
resource.type="k8s_node" AND
log_id("kubelet") AND
jsonPayload.MESSAGE:("error" OR "fail")
Looking at node logs for GKE system logs 
resource.type = "k8s_node"
logName:( "logs/container-runtime" OR
"logs/docker" OR
"logs/kube-container-runtime-monitor" OR
"logs/kube-logrotate" OR
"logs/kube-node-configuration" OR
"logs/kube-node-installation" OR
"logs/kubelet" OR
"logs/kubelet-monitor" OR
"logs/node-journal" OR
"logs/node-problem-detector")

Namespace queries

Filter name Expression
Container and pod logs for GKE system logs 
resource.type = ("k8s_container" OR "k8s_pod")
resource.labels.namespace_name = (
"cnrm-system" OR
"config-management-system" OR
"gatekeeper-system" OR
"gke-connect" OR
"gke-system" OR
"istio-system" OR
"knative-serving" OR
"monitoring-system" OR
"kube-system")

Container queries

Filter name Expression
Stdout container logs across all pods and containers in a cluster 
resource.type="k8s_container" AND
log_id("stdout")
Container error logs across all pods and containers in a cluster 
resource.type="k8s_container" AND
log_id("stderr") AND
severity=ERROR
Container error logs for a pod with a specific name 
resource.type="k8s_container" AND
resource.labels.pod_name="POD_NAME" AND
severity=ERROR
Container error logs for a specific container in a specific pod 
resource.type="k8s_container" AND
resource.labels.pod_name="POD_NAME" AND
resource.labels.container_name="server" AND
severity=ERROR
Container error logs for a specific namespace and container 
resource.type="k8s_container" AND
resource.labels.namespace_name="istio-system" AND
resource.labels.container_name="egressgateway" AND
severity=ERROR
Container logs for a pod with a specific label 
resource.type="k8s_container" AND
labels."k8s-pod/app"="loadgenerator" AND
severity=ERROR
Container error logs for pods running on a specific node 
resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"=NODE_NAME AND
severity=ERROR
Container logs for a pod with a label generated using skaffold 
resource.type="k8s_container" AND
labels."k8s-pod/app"="loadgenerator" AND
labels."k8s-pod/skaffold_dev/run-id"=SKAFFOLD_RUN_ID
severity=ERROR
Container error logs for a specific pod containing a POST in the textPayload 
resource.type="k8s_container" AND
resource.labels.pod_name="POD_NAME" AND
textPayload:"POST" AND
severity=ERROR
Container error logs for a specific pod containing a GET in the structured JSON 
resource.type="k8s_container" AND
resource.labels.pod_name="POD_NAME" AND
jsonPayload."http.req.method"="GET" AND
severity=ERROR
Container errors logs in the kube-system namespace 
resource.type="k8s_container" AND
resource.labels.namespace_name="kube-system" AND
severity=ERROR
Container error in the container insights log 
resource.type="k8s_container" AND
log_id("clouderrorreporting.googleapis.com/insights")
Kubernetes container logs 
resource.type="k8s_container" AND
resource.labels.container_name="CONTAINER_NAME"

Control plane queries

Note: GKE control plane logs must be enabled.
Filter name Expression
Kubernetes API server logs 
resource.type="k8s_control_plane_component"
resource.labels.component_name="apiserver"
resource.labels.location="CLUSTER_LOCATION"
resource.labels.cluster_name="CLUSTER_NAME"
Kubernetes Scheduler logs 
resource.type="k8s_control_plane_component"
resource.labels.component_name="scheduler"
resource.labels.location="CLUSTER_LOCATION"
resource.labels.cluster_name="CLUSTER_NAME"
Kubernetes Controller Manager logs 
resource.type="k8s_control_plane_component"
resource.labels.component_name="controller-manager"
resource.labels.location="CLUSTER_LOCATION"
resource.labels.cluster_name="CLUSTER_NAME"

TPU workload queries

Note: GKE system and workload logging must be enabled.
Filter name Expression
Stdout container logs across all TPU nodes with the same prefix 
resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"=~"TPU_NODE_PREFIX.*" AND
log_id("stdout")
Container error logs across all TPU nodes with the same prefix 
resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"=~"TPU_NODE_PREFIX.*" AND
log_id("stderr") AND
severity=ERROR
Stdout container logs from the same GKE Job 
resource.type="k8s_container" AND
labels."k8s-pod/batch.kubernetes.io/job-name" = "JOB_NAME" AND
log_id("stdout")
Container error logs from the same GKE Job 
resource.type="k8s_container" AND
labels."k8s-pod/batch.kubernetes.io/job-name"="JOB_NAME" AND
log_id("stderr") AND
severity=ERROR
Stdout container logs from the same GKE JobSet 
resource.type="k8s_container" AND
labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="JOBSET_NAME" AND
log_id("stdout")
Container error logs from the same GKE JobSet 
resource.type="k8s_container" AND
labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="JOBSET_NAME" AND
log_id("stderr") AND
severity=ERROR

Networking queries

Query/filter name Expression
Firewall- all logs 
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/firewall")
Firewall logs for a given country 
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/firewall") AND
jsonPayload.remote_location.country=COUNTRY_ISO_ALPHA_3
Firewall logs from a VM 
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/firewall") AND
jsonPayload.instance.vm_name="INSTANCE_NAME"
Firewall subnet logs 
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/firewall") AND
resource.labels.subnetwork_name="SUBNET_NAME"
Compute Engine subnetwork traffic logs to a subnet 
resource.type="gce_subnetwork" AND
ip_in_net(jsonPayload.connection.dest_ip, "SUBNET_IP")
VPC Flow logs 
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows")
VPC Flow logs for specific port and protocol 
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows") AND
jsonPayload.connection.src_port="PORT_ID" AND
jsonPayload.connection.protocol="PROTOCOL"
VPC Flow logs for specific subnet 
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows") AND
resource.labels.subnetwork_name"=SUBNET_NAME"
VPC Flow logs for specific subnet prefix 
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows") AND
ip_in_net(jsonPayload.connection.dest_ip,SUBNET_IP)
VPC Flow logs for a specific VM 
resource.type="gce_subnetwork" AND
log_id("compute.googleapis.com/vpc_flows") AND
jsonPayload.src_instance.vm_name="VM_NAME"
VPN gateway logs 
resource.type="vpn_gateway" AND
resource.labels.gateway_id="GATEWAY_ID"
HTTP Load Balancer 5xx errors 
resource.type="http_load_balancer" AND
httpRequest.status>=500
HTTP Load Balancer requests to PHPMyAdmin 
resource.type="http_load_balancer" AND
httpRequest.request_url:"phpmyadmin"

Security queries

Query/filter name Expression
Audit logs—all 
logName:"cloudaudit.googleapis.com"
Audit logs- Access Transparency (AXT) 
log_id("cloudaudit.googleapis.com/access_transparency")
Audit logs- Admin Activity 
log_id("cloudaudit.googleapis.com/activity")
Audit logs- Data Access 
log_id("cloudaudit.googleapis.com/data_access")
Audit logs- System Event 
log_id("cloudaudit.googleapis.com/system_event")

Troubleshooting

For instructions about troubleshooting common issues when using the Logs Explorer, see Using the Logs Explorer: Troubleshooting.

What's next

For more information about the query syntax, which you can use to customize these queries, see Logging query language.

For more information about querying in the Trusted Cloud console, see Build queries by using the Logging query language.