gcloud logging read

gcloud logging read - read log entries

gcloud logging read [LOG_FILTER] [--freshness=FRESHNESS; default="1d"] [--order=ORDER; default="desc"] [--billing-account=BILLING_ACCOUNT_ID     | --folder=FOLDER_ID     | --organization=ORGANIZATION_ID     | --project=PROJECT_ID] [--resource-names=[RESOURCE,…]     | --bucket=BUCKET --location=LOCATION --view=VIEW] [--limit=LIMIT] [GCLOUD_WIDE_FLAG …]

gcloud logging read "resource.type=gce_instance"

To read log entries with severity ERROR or higher, run:

gcloud logging read "severity>=ERROR"

To read log entries written in a specific time window, run:

gcloud logging read 'timestamp<="2015-05-31T23:59:59Z" AND
 timestamp>="2015-05-31T00:00:00Z"'

To read up to 10 log entries in your project's syslog log from Compute Engine instances containing payloads that include the word SyncAddress and format the output in JSON format, run:

gcloud logging read "resource.type=gce_instance AND logName=projects/[PROJECT_ID]/logs/syslog AND textPayload:SyncAddress" --limit=10 --format=json

To read a log entry from a folder, run:

gcloud logging read "resource.type=global" --folder=[FOLDER_ID] --limit=1

To read a log entry from a global log bucket, run:

gcloud logging read --bucket=<bucket-id> --location=[LOCATION] --limit=1

To read a log entry from the global _Required log bucket using the bucket's _Default log view:

gcloud logging read "" --bucket=_Required --location=global --view=_Default --limit=1

To read a log entry from a log bucket using the bucket's _AllLogs log view:

gcloud logging read "" --bucket=[BUCKET_ID] --location=[LOCATION] --view=_AllLogs --limit=1

To read a log entry from a log bucket using a custom log view that you have created for the bucket:

gcloud logging read "" --bucket=[BUCKET_ID] --location=[LOCATION] --view=[VIEW_ID] --limit=1

To read log entries from multiple resources, specify them as a comma-delimeted sequence with --resource-names. Each resource name can be specified either as a top-level resource (e.g., projects/[PROJECT_ID], folders/[FOLDER_ID], etc.) or as a Log View resource (e.g., projects/[PROJECT_ID]/locations/[LOCATION]/buckets/[BUCKET_NAME]/views/[VIEW_ID]).

gcloud logging read "" --resource-names=[RESOURCE-1],[RESOURCE-2]

[LOG_FILTER]

Filter expression that specifies the log entries to return. Detailed information about filters can be found at: https://cloud.google.com/logging/docs/view/logging-query-language

--freshness=FRESHNESS; default="1d"

Return entries that are not older than this value. Works only with DESC ordering and filters without a timestamp. See $ gcloud topic datetimes for information on duration formats.

--order=ORDER; default="desc"

Ordering of returned log entries based on timestamp field. ORDER must be one of: desc, asc.

At most one of these can be specified:

--billing-account=BILLING_ACCOUNT_ID

Billing account of the log entries to read.

--folder=FOLDER_ID

Folder of the log entries to read.

--organization=ORGANIZATION_ID

Organization of the log entries to read.

--project=PROJECT_ID

Project of the log entries to read.

The Google Cloud project ID to use for this invocation. If omitted, then the current project is assumed; the current project can be listed using gcloud config list --format='text(core.project)' and can be set using gcloud config set project PROJECTID.

--project and its fallback core/project property play two roles in the invocation. It specifies the project of the resource to operate on. It also specifies the project for API enablement check, quota, and billing. To specify a different project for quota and billing, use --billing-project or billing/quota_project property.

At most one of these can be specified:

--resource-names=[RESOURCE,…]

Resource name(s) to read logs from. A resource can either be an top-level resource (e.g., "projects/my-project") or a full log view resource path (e.g., "projects/my-project/locations/my-location/buckets/my-bucket/views/my-view"). Multiple resources can be specified, separated by a comma.

These arguments are used in conjunction with the parent to construct a view resource.

--bucket=BUCKET

Id of the log bucket. If this argument is provided then --location and --view must also be specified.

This flag argument must be specified if any of the other arguments in this group are specified.

--location=LOCATION

Location of the log bucket. If this argument is provided then --bucket and --view must also be specified.

This flag argument must be specified if any of the other arguments in this group are specified.

--view=VIEW

Id of the view. If this argument is provided then --location and --bucket must also be specified.

This flag argument must be specified if any of the other arguments in this group are specified.

--limit=LIMIT

Maximum number of resources to list. The default is unlimited. This flag interacts with other flags that are applied in this order: --flatten, --sort-by, --filter, --limit.

Run $ gcloud help for details.