Troubleshoot Logging query language

This document explains common issues that you might encounter when using the Logging query language.

Syntax issues

If you have problems with your queries' expressions, check the following:

  • Your query obeys the syntax rules, with matched parentheses and quotation marks.

  • Your log entry field names are correctly spelled.

  • Boolean operations are in uppercase letters (AND, OR, NOT).

  • Ensure that you're using [NULL_VALUE][json-null] to represent JSON null values.

  • Boolean expressions as global restrictions or as the right-hand side of comparisons should be parenthesized for clarity. For example, the following two queries look the same, but are not:

    insertId = "ABC-1" OR "ABC-2"  -- ERROR!?
    insertId = ("ABC-1" OR "ABC-2")
    
  • Unquoted text must not contain any special characters. When in doubt, add double quotation marks. For example, in the following, the first comparison is illegal because of the embedded substring operator (:). The comparison must be written with quotation marks:

    insertId = abc:def  -- ILLEGAL!
    insertId = "abc:def"
    
  • The Google Cloud CLI requires the query to be in double quotes. To use double quotes for escaping special characters using the gcloud logging command, wrap the entire query with single quotes instead:

    gcloud logging read 'resource.type=gce_instance AND jsonPayload.message="Stopped Unattended Upgrades Shutdown."'
    gcloud logging read 'timestamp>="2020-06-17T21:00:00Z"'
    

  • When you are filtering on a field that is associated with the Any message type, the value field is automatically traversed. Therefore, don't include value in the query.

    For example, the Status field in an AuditLog message has a details field that is of type google.protobuf.Any. To query the details field, omit the value field when specifying the filter:

    • Do

      protoPayload.status.details.conditionNotMet.userVisibleMessage =~ "Specified reservation.*"
      
    • Don't

      protoPayload.status.details.value.conditionNotMet.userVisibleMessage =~ "Specified reservation.*"