This document provides you with suggested queries to make it easier to find
important logs using the Logs Explorer in the Google Cloud console.
The listed queries are written in the
[Logging query language](https://docs.cloud.google.com/logging/docs/view/logging-query-language.md.txt),
and they can be used in the
[Logs Explorer](https://docs.cloud.google.com/logging/docs/view/building-queries.md.txt), the
[Logging API](https://docs.cloud.google.com/logging/docs/reference/v2/rest/v2/entries/list.md.txt),
or the
[command-line interface](https://docs.cloud.google.com/logging/docs/api/gcloud-logging#v2_api_commands).

The Logs Explorer uses Boolean expressions to specify a subset of all
the log entries in your project. You can use these queries to choose log entries
from specific logs or log services, or that satisfy conditions on metadata or
user-defined fields.

## Before you begin

Ensure that you have the correct Identity and Access Management permissions or roles for
building queries using the Logs Explorer. For details on the
necessary IAM permissions, see
[Permissions for the Google Cloud console](https://docs.cloud.google.com/logging/docs/access-control.md.txt#console_permissions).

## Get started

1. In the Google Cloud console, go to the

   **Logs Explorer** page:

   [Go to **Logs Explorer**](https://console.cloud.google.com/logs/query)

   <br />

   If you use the search bar to find this page, then select the result whose subheading is
   **Logging**.
2. Select the appropriate Google Cloud project or other Google Cloud
   resource for which you want to view logs.

## Use the sample queries

To apply a query from the following tables, click the
**Content Copy** icon for the expression,
and then paste the copied expression into
the Logs Explorer query-editor field.

The following screenshot illustrates the query pane:

![The query editor is showing where to enter a query](https://docs.cloud.google.com/static/logging/docs/images/query-pane-2.png)

If you don't see the query-editor field, enable **Show query**.

After you review your query expression, click **Run query** . Logs that match your
query are listed under **Query results**.

Some of the queries listed later on this page include variables that you should
replace with valid values. For example, when a query includes `logName`, then
the <var translate="no">PROJECT_ID</var> you supply must refer to the selected
Google Cloud project; otherwise, the query won't work.

Note the following:

- If you have a query with a timestamp, then the
  [time-range selector](https://docs.cloud.google.com/logging/docs/view/building-queries.md.txt#time-range)
  is disabled, and the query uses the timestamp expression as its time-range
  restriction. If a query doesn't use a timestamp expression, then the query
  uses the time-range selector as its time-range restriction.

- The length of a query can't exceed 20,000 characters.

- The [Logging query language](https://docs.cloud.google.com/logging/docs/view/logging-query-language.md.txt)
  is case-insensitive, with the exception of regular expressions.

- You can use the `log_id` function for queries with a `log_name`
  expression. For example, the expression
  `log_name="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access"`
  is the same as `log_id("cloudaudit.googleapis.com/data_access")`.
  For more information about the `log_id` function, see
  [Logging query language: Functions](https://docs.cloud.google.com/logging/docs/view/logging-query-language.md.txt#functions).

For instructions about querying in the Google Cloud console, see
[Build queries in the Logs Explorer](https://docs.cloud.google.com/logging/docs/view/building-queries.md.txt).

The following sections group queries by Google Cloud services.

## App Engine queries

| Query/filter name | Expression |
|---|---|
| App Engine logs from New Year's Eve (in UTC time) | ```sql resource.type="gae_app" AND severity>=ERROR AND timestamp>="2018-12-31T00:00:00Z" AND timestamp<="2019-01-01T00:00:00Z" ``` |
| App Engine request logs with server errors | ```sql resource.type="gae_app" AND log_id("appengine.googleapis.com/request_log") AND httpRequest.status>=500 ``` |
| Sampled HTTP error logs | ```sql resource.type="gae_app" AND protoPayload.status >= 400 AND sample(insertId, 0.1) ``` |
| Search for App Engine trace ID | ```sql resource.type="gae_app" AND trace="projects/PROJECT_ID/traces/TRACE_ID" ``` |
| App Engine logs | ```sql resource.type="gae_app" AND resource.labels.module_id="MODULE_ID" AND resource.labels.version_id="VERSION_ID" ``` |
| Recent App Engine deployments | ```sql resource.type="gae_app" AND protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND protoPayload.serviceName="appengine.googleapis.com" ``` |

## API enable and disable queries

| Query/filter name | Expression |
|---|---|
| Audit API enable logs | ```sql protoPayload.methodName="google.api.serviceusage.v1.ServiceUsage.EnableService" ``` |
| Audit API disable logs | ```sql protoPayload.methodName="google.api.serviceusage.v1.ServiceUsage.DisableService" ``` |

## BigQuery queries

| Query/filter name | Expression |
|---|---|
| BigQuery audit logs | ```sql resource.type= ("bigquery_dataset" OR "bigquery_project") AND logName:"cloudaudit.googleapis.com" ``` |
| BigQuery audit logs for a project | ```sql resource.type="bigquery_project" AND logName:"cloudaudit.googleapis.com" ``` |
| BigQuery audit logs for a dataset | ```sql resource.type="bigquery_dataset" AND logName:"cloudaudit.googleapis.com" ``` |
| BigQuery audit logs for BI Engine Model | ```sql resource.type="bigquery_biengine_model" AND logName:"cloudaudit.googleapis.com" ``` |
| BigQuery audit logs for a Data Transfer Service Run. | ```sql resource.type="bigquery_dts_run" AND logName:"cloudaudit.googleapis.com" ``` |
| BigQuery audit logs for a Data Transfer Service configuration. | ```sql resource.type="bigquery_dts_config" AND logName:"cloudaudit.googleapis.com" ``` |
| BigQuery data transfer service jobs | ```sql resource.type="bigquery_project" AND protoPayload.requestMetadata.callerSuppliedUserAgent= "BigQuery Data Transfer Service" AND protoPayload.methodName= ("google.cloud.bigquery.v2.JobService.InsertJob" OR "google.cloud.bigquery.v2.JobService.Query") ``` |
| BigQuery transfer run logs | ```sql resource.type="bigquery_dts_config" AND labels.run_id="RUN_ID" AND resource.labels.config_id="CONFIG_ID" ``` |
| BigQuery dataset updates | ```sql resource.type="bigquery_dataset" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName= "google.cloud.bigquery.v2.DatasetService.UpdateDataset" ``` |
| BigQuery jobs completed | ```sql resource.type="bigquery_project" AND log_id("cloudaudit.googleapis.com/data_access") AND protoPayload.methodName= ("google.cloud.bigquery.v2.JobService.InsertJob" OR "google.cloud.bigquery.v2.JobService.Query") ``` |
| BigQuery large queries | ```sql resource.type="bigquery_project" AND protoPayload.metadata.jobChange.job.jobStats.queryStats.totalBilledBytes > 1073741824 ``` |
| BigQuery quota exceeded | ```sql resource.type= ("bigquery_dataset" OR "bigquery_project") AND protoPayload.status.code=8 AND severity>=WARNING ``` |
| BigQuery query started | ```sql resource.type="bigquery_project" AND protoPayload.metadata.jobInsertion.reason:* ``` |
| BigQuery concurrent load/extract jobs | ```sql resource.type="bigquery_resource" AND protoPayload.methodName="jobservice.insert" AND protoPayload.serviceData.jobInsertRequest.resource.jobConfiguration.query.query: "extract" ``` |
| BigQuery audit logs for Row Access Policy | ```sql protoPayload.methodName="jobservice.insert" AND protoPayload.serviceData.jobInsertRequest.resource.jobConfiguration.query.query: "ROW ACCESS POLICY" ``` |

## Dataflow queries

| Query/filter name | Expression |
|---|---|
| Errors and warnings in Dataflow workers | ```sql resource.type="dataflow_step" AND log_id("dataflow.googleapis.com/worker") AND severity>=WARNING ``` |

## Managed Service for Apache Spark queries

| Query/filter name | Expression |
|---|---|
| Dataproc Apache Hadoop logs | ```sql resource.type="cloud_dataproc_cluster" AND jsonPayload.class:"org.apache.hadoop.mapreduce" ``` |

## Cloud Deployment Manager

| Query/filter name | Expression |
|---|---|
| Deployment Manager errors | ```sql resource.type="deployment" AND severity>=ERROR ``` |

## Cloud Run functions queries

| Query/filter name | Expression |
|---|---|
| Cloud function errors | ```sql resource.type="cloud_function" AND log_id("cloudfunctions.googleapis.com/cloud-functions") AND severity>=ERROR ``` |

## Cloud Monitoring queries

| Query/filter name | Expression |
|---|---|
| Show all notification channel errors | ```sql resource.type="stackdriver_notification_channel" AND severity>=ERROR ``` |
| Show notification channel errors due to throttling | ```sql resource.type="stackdriver_notification_channel" AND severity>=ERROR AND jsonPayload.summary="Notification delivery throttled." ``` |
| Show logs written by the uptime resource | ```sql resource.type="uptime_url" ``` |
| Show requests received from the uptime-check service | ```sql "GoogleStackdriverMonitoring-UptimeChecks" ``` |

## Cloud Run queries

| Query/filter name | Expression |
|---|---|
| Cloud Run logs for a specific job | ```sql resource.type="cloud_run_job" AND resource.labels.job_name="JOB_NAME" ``` |
| Cloud Run logs for a specific revision and service | ```sql resource.type="cloud_run_revision" AND resource.labels.service_name="SERVICE_NAME" ``` |

## Cloud Source Repositories queries

| Query/filter name | Expression |
|---|---|
| Cloud Source Repository logs | ```sql resource.type="csr_repository" AND resource.labels.name="REPOSITORY_NAME" ``` |

## Spanner queries

| Query/filter name | Expression |
|---|---|
| Cloud Spanner logs for a specific spanner instance | ```sql resource.type="spanner_instance" AND resource.labels.instance_id="SPANNER_INSTANCE" ``` |

## Cloud SQL queries

| Query/filter name | Expression |
|---|---|
| Cloud SQL audit logs | ```sql resource.type="cloudsql_database" AND resource.labels.database_id="DATABASE_ID" AND log_id("cloudaudit.googleapis.com/activity") ``` |
| Cloud SQL MySQL error logs | ```sql resource.type="cloudsql_database" AND log_id("cloudsql.googleapis.com/mysql.err") ``` |
| Cloud SQL MySQL-based databases | ```sql resource.type="cloudsql_database" AND resource.labels.database_id="DATABASE_ID" AND log_id("cloudsql.googleapis.com/mysql") ``` |
| Cloud SQL Postgres-based databases | ```sql resource.type="cloudsql_database" AND resource.labels.database_id="DATABASE_ID" AND log_id("cloudsql.googleapis.com/postgres.log") ``` |
| Cloud SQL SQL Server error logs | ```sql resource.type="cloudsql_database" AND log_id("cloudsql.googleapis.com/sqlserver.err") ``` |
| Cloud SQL SQL Server-based databases | ```sql resource.type="cloudsql_database" AND resource.labels.database_id="DATABASE_ID" AND log_id("cloudsql.googleapis.com/sqlagent.out") ``` |

## Cloud Storage queries

| Query/filter name | Expression |
|---|---|
| GCS bucket logs | ```sql resource.type="gcs_bucket" AND resource.labels.bucket_name="BUCKET_NAME" ``` |
| GCS bucket audit logs | ```sql resource.type="gcs_bucket" AND logName:"cloudaudit.googleapis.com" ``` |
| GCS bucket creation logs | ```sql resource.type="gcs_bucket" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName="storage.buckets.create" ``` |
| GCS bucket deletion logs | ```sql resource.type="gcs_bucket" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName="storage.buckets.delete" ``` |

## Cloud Tasks queries

| Query/filter name | Expression |
|---|---|
| Cloud Tasks queue logs | ```sql resource.type="cloud_tasks_queue" AND resource.labels.queue_id="QUEUE_ID" ``` |

## Compute Engine queries

| Query/filter name | Expression |
|---|---|
| Compute Engine Admin Activity logs | ```sql resource.type="gce_instance" AND log_id("cloudaudit.googleapis.com/activity") ``` |
| Compute Engine firewall rule deletion | ```sql resource.type="gce_firewall_rule" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName:"firewalls.delete" ``` |
| Compute Engine VM syslogs | ```sql resource.type="gce_instance" AND log_id("syslog") ``` |
| Compute Engine VM authlogs | ```sql resource.type="gce_instance" AND log_id("authlog") ``` |
| Compute Engine Host Error | ```sql resource.type="gce_instance" protoPayload.serviceName="compute.googleapis.com" (protoPayload.methodName:"compute.instances.hostError" OR operation.producer:"compute.instances.hostError") log_id("cloudaudit.googleapis.com/system_event") resource.labels.instance_id="INSTANCE_ID" severity=INFO ``` |
| Compute Engine Host Memory Alert | ```sql resource.type="gce_instance" AND protoPayload.serviceName="compute.googleapis.com" AND (jsonPayload.methodName:"compute.instances.host_event_notify" OR operation.producer:"compute.instances.host_event_notify") AND log_id("cloudaudit.googleapis.com/host_event_notify") AND resource.labels.instance_id="INSTANCE_ID" AND severity=CRITICAL ``` |
| Compute Engine Host Migrated | ```sql resource.type="gce_instance" protoPayload.serviceName="compute.googleapis.com" (protoPayload.methodName: "compute.instances.migrateOnHostMaintenance" OR operation.producer: "compute.instances.migrateOnHostMaintenance") log_id("cloudaudit.googleapis.com/system_event") resource.labels.instance_id="INSTANCE_ID" severity=INFO ``` |
| Compute Engine VM Terminated/Preempted | ```sql resource.type="gce_instance" protoPayload.methodName=~"compute\.instances\.(guestTerminate|preempted)" log_id("cloudaudit.googleapis.com/system_event") resource.labels.instance_id="INSTANCE_ID" ``` |
| Compute Engine VM terminated due to Scratch Disk Creation Failure | ```sql resource.type="gce_instance" protoPayload.serviceName="compute.googleapis.com" (protoPayload.methodName="compute.instances.scratchDiskCreationFailed" OR operation.producer: "compute.instances.scratchDiskCreationFailed") log_id("cloudaudit.googleapis.com/system_event") resource.labels.instance_id="INSTANCE_ID" severity=INFO ``` |
| Compute Engine VM Instance Created | ```sql resource.type="gce_instance" protoPayload.methodName:"compute.instances.insert" log_id("cloudaudit.googleapis.com/activity") protoPayload.request.name="INSTANCE_NAME" ``` |
| Compute Engine VM Instance Deleted with Name | ```sql resource.type="gce_instance" protoPayload.methodName:"compute.instances.delete" log_id("cloudaudit.googleapis.com/activity") protoPayload.resourceName:"INSTANCE_NAME" ``` |
| Compute Engine VM Instance Deleted with ID | ```sql resource.type="gce_instance" protoPayload.methodName:"compute.instances.delete" log_id("cloudaudit.googleapis.com/activity") resource.labels.instance_id="INSTANCE_ID" ``` |
| Compute Engine VM Instance Restarted | ```sql resource.type="gce_instance" protoPayload.methodName=~"compute\.instances\.( stop|reset|automaticRestart|guestTerminate| instanceManagerHaltForRestart)" (log_id("cloudaudit.googleapis.com/activity") OR log_id("cloudaudit.googleapis.com/system_event")) resource.labels.instance_id="INSTANCE_ID" ``` |
| Compute Engine Shielded VM Boot Integrity Failure | ```sql resource.type="gce_instance" log_id("compute.googleapis.com/shielded_vm_integrity") jsonPayload.earlyBootReportEvent.policyEvaluationPassed="false" resource.labels.instance_id="INSTANCE_ID" ``` |
| Compute Engine VM instance stopped by Guest OS | ```sql resource.type="gce_instance" protoPayload.serviceName="compute.googleapis.com" (protoPayload.methodName:"compute.instances.guestTerminate" OR operation.producer:"compute.instances.guestTerminate") log_id("cloudaudit.googleapis.com/system_event") resource.labels.instance_id="INSTANCE_ID" severity=INFO ``` |
| Compute Engine Shielded VM boot file was blocked | ```sql resource.type="gce_instance" log_id("serialconsole.googleapis.com/serial_port_1_output") textPayload:"Security Violation" resource.labels.instance_id="INSTANCE_ID" ``` |
| Persistent Disk Created | ```sql resource.type="gce_disk" AND protoPayload.methodName:"compute.disks.insert" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.resourceName: "PERSISTENT_DISK_NAME" ``` |
| Nodes added in Sole Tenant Node | ```sql resource.type="gce_node_group" log_id("cloudaudit.googleapis.com/activity") protoPayload.methodName=~("compute.nodeGroups.addNodes" OR "compute.nodeGroups.insert") resource.labels.node_group_id="NODE_GROUP_ID" severity=INFO ``` |
| Autoscale events in Sole Tenant Node | ```sql resource.type="gce_node_group" log_id("cloudaudit.googleapis.com/system_event") protoPayload.methodName=~("compute.nodeGroups.deleteNodes" OR "compute.nodeGroups.addNodes") resource.labels.node_group_id="NODE_GROUP_ID" ``` |
| Manual Snapshot Taken | ```sql resource.type="gce_snapshot" log_id("cloudaudit.googleapis.com/activity") protoPayload.methodName:"compute.snapshots.insert" protoPayload.resourceName:"SNAPSHOT_NAME" ``` |
| Scheduled Snapshot Taken | ```sql resource.type="gce_disk" log_id("cloudaudit.googleapis.com/system_event") protoPayload.methodName="ScheduledSnapshots" protoPayload.response.operationType="createSnapshot" protoPayload.response.targetLink="PERSISTENT_DISK_NAME" ``` |
| Snapshot Schedule Created | ```sql resource.type="gce_resource_policy" log_id("cloudaudit.googleapis.com/activity") protoPayload.methodName:"compute.resourcePolicies.insert" protoPayload.request.name="SCHEDULE_NAME" ``` |
| Snapshot Schedule Attached | ```sql resource.type="gce_disk" log_id("cloudaudit.googleapis.com/activity") protoPayload.methodName:"compute.disks.addResourcePolicies" protoPayload.request.resourcePolicys:"SCHEDULE_NAME" protoPayload.resourceName:"PERSISTENT_DISK_NAME" ``` |
| Quota Exceeded | ```sql resource.type="gce_instance" protoPayload.methodName:"compute.instances.insert" protoPayload.status.message:"QUOTA_EXCEEDED" severity=ERROR ``` |
| Query unhealthy instances in instance group | ```sql resource.type="gce_instance_group" resource.labels.instance_group_name="INSTANCE_GROUP_NAME" jsonPayload.healthCheckProbeResult.healthState="UNHEALTHY" ``` |
| Query instance group members within a time frame in UTC time format | ```sql resource.type="gce_instance_group_manager" resource.labels.instance_group_manager_name="INSTANCE_GROUP_NAME" jsonPayload.@type= "type.googleapis.com/compute.InstanceGroupManagerEvent" jsonPayload.instanceHealthStateChange.detailedHealthState="HEALTHY" timestamp >= START_TIME timestamp <= END_TIME ``` |
| Instances added to Instance Group | ```sql resource.type="gce_instance_group" protoPayload.methodName:"compute.instanceGroups.addInstances" log_id("cloudaudit.googleapis.com/activity") resource.labels.instance_group_name="INSTANCE_GROUP_NAME" ``` |
| Instances removed from Instance Group | ```sql resource.type="gce_instance_group" protoPayload.methodName:"compute.instanceGroups.removeInstances" log_id("cloudaudit.googleapis.com/activity") resource.labels.instance_group_name="INSTANCE_GROUP_NAME" ``` |
| Instance template set or updated | ```sql resource.type="gce_instance_group_manager" log_id("cloudaudit.googleapis.com/activity") protoPayload.methodName= "v1.compute.instanceGroupManagers.setInstanceTemplate" resource.labels.instance_group_manager_name="INSTANCE_GROUP_MANAGER" ``` |
| Firewall rule deleted | ```sql resource.type="gce_firewall_rule" log_id("cloudaudit.googleapis.com/activity") protoPayload.methodName:"firewalls.delete" ``` |
| Firewall logs | ```sql resource.type="gce_subnetwork" log_id("compute.googleapis.com/firewall") jsonPayload.instance.vm_name="INSTANCE_NAME" ``` |

## Google Cloud Observability queries

| Query/filter name | Expression |
|---|---|
| Log sink activities | ```sql resource.type="logging_sink" AND log_id("cloudaudit.googleapis.com/activity") ``` |
| Log-based metric create or update activities | ```sql resource.type="metric" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName:(UpdateLogMetric OR CreateLogMetric) ``` |
| Uptime URL checks for a host | ```sql resource.type="uptime_url" AND resource.labels.host="URL" ``` |

## Identity and Access Management queries

| Query/filter name | Expression |
|---|---|
| Service account creation logs | ```sql resource.type="service_account" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName="google.iam.admin.v1.CreateServiceAccount" ``` |
| Service account creation key logs | ```sql resource.type="service_account" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey" ``` |
| Set access control policy logs | ```sql resource.type="project" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName="SetIamPolicy" ``` |
| External principal granted access to organization | ```sql resource.type="project" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND protoPayload.request.@type:"IamPolicy" AND protoPayload.serviceData.policyDelta.bindingDeltas.member:* AND NOT protoPayload.serviceData.policyDelta.bindingDeltas.member:"@DOMAIN_NAME.com" ``` |
| Resource creation, modification, or deletion | ```sql log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName:("create" OR "delete" OR "update") ``` |
| Role granted to principal | ```sql log_id("cloudaudit.googleapis.com/activity") AND resource.type="project" AND protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.bindingDeltas.action="Add" AND protoPayload.serviceData.policyDelta.bindingDeltas.member:"EMAIL_ID" ``` |
| Role removed from principal | ```sql log_id("cloudaudit.googleapis.com/activity") AND resource.type="project" AND protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.bindingDeltas.action="Remove" AND protoPayload.serviceData.policyDelta.bindingDeltas.member:"EMAIL_ID" ``` |
| Permission updated in a custom role | ```sql log_id("cloudaudit.googleapis.com/activity") AND resource.type="iam_role" AND protoPayload.serviceName="iam.googleapis.com" AND protoPayload.methodName:"UpdateRole" AND resource.labels.role_name:"ROLE_ID" ``` |

## Kubernetes-related queries

For an overview and examples of Admin Activity audit log queries, see those provided on the [GKE Audit logging page](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/audit-logging.md.txt).

#### Cluster-level queries

| Query/filter name | Expression |
|---|---|
| Google Kubernetes Engine cluster operations | ```sql resource.type="gke_cluster" AND log_id("cloudaudit.googleapis.com/activity") ``` |
| Google Kubernetes Engine cluster creation | ```sql resource.type="gke_cluster" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName="google.container.v1.ClusterManager.CreateCluster" ``` |
| Kubernetes cluster deployment | ```sql resource.type="k8s_cluster" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName:"deployments" ``` |
| Kubernetes cluster authentication failure | ```sql resource.type="k8s_cluster" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.authenticationInfo.principalEmail="system:anonymous" ``` |
| Kubernetes cluster operations and events in `us-central1-b` | ```sql resource.type="k8s_cluster" AND resource.labels.location="us-central1-b" ``` |
| Kubernetes pod requests from users | ```sql resource.type="k8s_cluster" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName:"io.k8s.core.v1.pods" AND protoPayload.authenticationInfo.principalEmail="USER_EMAIL" ``` |
| Kubernetes events | ```sql resource.type="k8s_cluster" AND log_id("events") ``` |
| Kubernetes Endpoints update | ```sql resource.type="k8s_cluster" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.request.kind="Endpoints" ``` |
| Kubernetes control plane logs | ```sql resource.type="k8s_cluster" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.serviceName="k8s.io" ``` |
| Kubernetes Engine control plane logs | ```sql resource.type="k8s_cluster" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.serviceName="container.googleapis.com" ``` |
| Pod deletion | ```sql resource.type="k8s_cluster" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName=~"io\.k8s\.core\.v1\.pods\.(create|delete)" ``` |
| Kubernetes pod audit logs from control plane | ```sql resource.type="k8s_cluster" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.resourceName="core/v1/namespaces/POD_NAMESPACE/pods/POD_NAME ``` |
| Kubernetes pod evictions | ```sql resource.type="k8s_cluster" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName="io.k8s.core.v1.pods.eviction.create" ``` |
| Kubernetes node audit logs from the control plane | ```sql resource.type="k8s_cluster" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.methodName:"io.k8s.core.v1.nodes" ``` |
| Kubernetes cluster control plane for Addon Manager Activity | ```sql resource.type="k8s_cluster" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.authenticationInfo.principalEmail="system:addon-manager" ``` |
| Kubernetes control plane errors (excluding `Conflict`, which is normal) | ```sql resource.type="k8s_cluster" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("cloudaudit.googleapis.com/activity") AND protoPayload.status.message!="Conflict" AND protoPayload.status.code!=0 ``` |
| Ingress Controller events | ```sql resource.type="k8s_cluster" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("events") AND jsonPayload.source.component="loadbalancer-controller" ``` |
| Service Controller events (kube-controller-manager) | ```sql resource.type="k8s_cluster" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("events") AND jsonPayload.source.component="service-controller" ``` |
| Cluster Autoscaler events | ```sql resource.type="k8s_cluster" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("events") AND jsonPayload.source.component="cluster-autoscaler" ``` |

#### Pod-level queries

| Filter name | Expression |
|---|---|
| Query pod during creation | ```sql resource.type="k8s_pod" AND resource.labels.pod_name="POD_NAME" AND log_id("events") ``` |
| Query pod terminated due to resource pressure | ```sql resource.type="k8s_pod" AND log_id("events") AND jsonPayload.reason="Evicted" ``` |
| Scheduler events | ```sql resource.type="k8s_pod" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("events") AND jsonPayload.source.component="default-scheduler" ``` |
| Scheduler events (preemptions) | ```sql resource.type="k8s_pod" AND resource.labels.location="CLUSTER_LOCATION" AND resource.labels.cluster_name="CLUSTER_NAME" AND log_id("events") AND jsonPayload.source.component="default-scheduler" AND jsonPayload.reason="Preempted" ``` |

#### Node-level queries

| Filter name | Expression |
|---|---|
| Node events | ```sql resource.type="k8s_node" AND log_id("events") ``` |
| Looking at Kube-proxy logs | ```sql resource.type="k8s_node" AND log_id("kube-proxy") ``` |
| Looking at dockerd logs | ```sql resource.type="k8s_node" AND log_id("container-runtime") ``` |
| Looking at kubelet errors or failures | ```sql resource.type="k8s_node" AND log_id("kubelet") AND jsonPayload.MESSAGE:("error" OR "fail") ``` |
| Looking at node logs for GKE system logs | ```sql resource.type = "k8s_node" logName:( "logs/container-runtime" OR "logs/docker" OR "logs/kube-container-runtime-monitor" OR "logs/kube-logrotate" OR "logs/kube-node-configuration" OR "logs/kube-node-installation" OR "logs/kubelet" OR "logs/kubelet-monitor" OR "logs/node-journal" OR "logs/node-problem-detector") ``` |

#### Namespace queries

| Filter name | Expression |
|---|---|
| Container and pod logs for GKE system logs | ```sql resource.type = ("k8s_container" OR "k8s_pod") resource.labels.namespace_name = ( "cnrm-system" OR "config-management-system" OR "gatekeeper-system" OR "gke-connect" OR "gke-system" OR "istio-system" OR "knative-serving" OR "monitoring-system" OR "kube-system") ``` |

#### Container queries

| Filter name | Expression |
|---|---|
| Stdout container logs across all pods and containers in a cluster | ```sql resource.type="k8s_container" AND log_id("stdout") ``` |
| Container error logs across all pods and containers in a cluster | ```sql resource.type="k8s_container" AND log_id("stderr") AND severity=ERROR ``` |
| Container error logs for a pod with a specific name | ```sql resource.type="k8s_container" AND resource.labels.pod_name="POD_NAME" AND severity=ERROR ``` |
| Container error logs for a specific container in a specific pod | ```sql resource.type="k8s_container" AND resource.labels.pod_name="POD_NAME" AND resource.labels.container_name="server" AND severity=ERROR ``` |
| Container error logs for a specific namespace and container | ```sql resource.type="k8s_container" AND resource.labels.namespace_name="istio-system" AND resource.labels.container_name="egressgateway" AND severity=ERROR ``` |
| Container logs for a pod with a specific label | ```sql resource.type="k8s_container" AND labels."k8s-pod/app"="loadgenerator" AND severity=ERROR ``` |
| Container error logs for pods running on a specific node | ```sql resource.type="k8s_container" AND labels."compute.googleapis.com/resource_name"="NODE_NAME" AND severity=ERROR ``` |
| Container logs for a pod with a label generated using skaffold | ```sql resource.type="k8s_container" AND labels."k8s-pod/app"="loadgenerator" AND labels."k8s-pod/skaffold_dev/run-id"="SKAFFOLD_RUN_ID" severity=ERROR ``` |
| Container error logs for a specific pod containing a `POST` in the textPayload | ```sql resource.type="k8s_container" AND resource.labels.pod_name="POD_NAME" AND textPayload:"POST" AND severity=ERROR ``` |
| Container error logs for a specific pod containing a `GET` in the structured JSON | ```sql resource.type="k8s_container" AND resource.labels.pod_name="POD_NAME" AND jsonPayload."http.req.method"="GET" AND severity=ERROR ``` |
| Container errors logs in the kube-system namespace | ```sql resource.type="k8s_container" AND resource.labels.namespace_name="kube-system" AND severity=ERROR ``` |
| Container error in the container insights log | ```sql resource.type="k8s_container" AND log_id("clouderrorreporting.googleapis.com/insights") ``` |
| Kubernetes container logs | ```sql resource.type="k8s_container" AND resource.labels.container_name="CONTAINER_NAME" ``` |

#### Control plane queries

Note: GKE control plane logs must be enabled.

| Filter name | Expression |
|---|---|
| Kubernetes API server logs | ```sql resource.type="k8s_control_plane_component" resource.labels.component_name="apiserver" resource.labels.location="CLUSTER_LOCATION" resource.labels.cluster_name="CLUSTER_NAME" ``` |
| Kubernetes Scheduler logs | ```sql resource.type="k8s_control_plane_component" resource.labels.component_name="scheduler" resource.labels.location="CLUSTER_LOCATION" resource.labels.cluster_name="CLUSTER_NAME" ``` |
| Kubernetes Controller Manager logs | ```sql resource.type="k8s_control_plane_component" resource.labels.component_name="controller-manager" resource.labels.location="CLUSTER_LOCATION" resource.labels.cluster_name="CLUSTER_NAME" ``` |

#### TPU workload queries

Note: GKE system and workload logging must be enabled.

| Filter name | Expression |
|---|---|
| Stdout container logs across all TPU nodes with the same prefix | ```sql resource.type="k8s_container" AND labels."compute.googleapis.com/resource_name"=~"TPU_NODE_PREFIX.*" AND log_id("stdout") ``` |
| Container error logs across all TPU nodes with the same prefix | ```sql resource.type="k8s_container" AND labels."compute.googleapis.com/resource_name"=~"TPU_NODE_PREFIX.*" AND log_id("stderr") AND severity=ERROR ``` |
| Stdout container logs from the same GKE Job | ```sql resource.type="k8s_container" AND labels."k8s-pod/batch.kubernetes.io/job-name" = "JOB_NAME" AND log_id("stdout") ``` |
| Container error logs from the same GKE Job | ```sql resource.type="k8s_container" AND labels."k8s-pod/batch.kubernetes.io/job-name"="JOB_NAME" AND log_id("stderr") AND severity=ERROR ``` |
| Stdout container logs from the same GKE JobSet | ```sql resource.type="k8s_container" AND labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="JOBSET_NAME" AND log_id("stdout") ``` |
| Container error logs from the same GKE JobSet | ```sql resource.type="k8s_container" AND labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="JOBSET_NAME" AND log_id("stderr") AND severity=ERROR ``` |

## Third-party application queries

> [!CAUTION]
> **Caution:** As of September 28, 2026, the legacy Logging agent has reached its end of support. Standard maintenance and bug fixes are no longer provided. We strongly recommend migrating to one of the [supported alternatives](https://docs.cloud.google.com/logging/docs/agent.md.txt). For more information about this deprecation, see [Legacy
> Monitoring and Logging agents end of support](https://docs.cloud.google.com/stackdriver/docs/deprecations/legacy-agents).

The following queries use the [default log IDs](https://docs.cloud.google.com/logging/docs/agent/default-logs.md.txt)
for logs collected by the [legacy Logging agent](https://docs.cloud.google.com/logging/docs/agent/logging.md.txt). If you are
collecting logs by using the [Ops Agent](https://docs.cloud.google.com/logging/docs/agent/ops-agent.md.txt),
then the log names might be configured differently. For more information
about the Ops Agent and application logs, see
[Collect logs from
third-party applications](https://docs.cloud.google.com/logging/docs/agent/ops-agent/third-party).

| Query/filter name | Expression |
|---|---|
| Apache logs | ```sql resource.type="gce_instance" AND (logName:"/apache-access" OR logName:"/apache-error") ``` |
| Cassandra logs | ```sql resource.type="gce_instance" AND log_id("cassandra") ``` |
| Chef logs | ```sql resource.type="gce_instance" AND logName:"projects/PROJECT_ID/logs/chef-" ``` |
| Gitlab logs | ```sql resource.type="gce_instance" logName:"projects/PROJECT_ID/logs/gitlab-" ``` |
| Jenkins logs | ```sql resource.type="gce_instance" AND log_id("jenkins") ``` |
| Jetty logs | ```sql resource.type="gce_instance" AND logName:"projects/PROJECT_ID/logs/jetty-" ``` |
| Joomla logs | ```sql resource.type="gce_instance" AND log_id("joomla") ``` |
| Linux syslogs | ```sql resource.type="gce_instance" AND log_id("syslog") ``` |
| Magneto logs | ```sql resource.type="gce_instance" AND logName:"projects/PROJECT_ID/logs/magneto-" ``` |
| Mediawiki logs | ```sql resource.type="gce_instance" AND log_id("mediawiki") ``` |
| memcached logs | ```sql resource.type="gce_instance" AND log_id("memcached") ``` |
| MongoDB logs | ```sql resource.type="gce_instance" AND log_id("mongodb") ``` |
| MySQL logs | ```sql resource.type="gce_instance" AND log_id("mysql") ``` |
| Nginx logs | ```sql resource.type="gce_instance" AND logName:"projects/PROJECT_ID/logs/nginx-" ``` |
| PostgreSQL logs | ```sql resource.type="gce_instance" AND log_id("postgresql") ``` |
| Puppet logs | ```sql resource.type="gce_instance" AND logName:"projects/PROJECT_ID/logs/puppet-" ``` |
| RabbitMQ logs | ```sql resource.type="gce_instance" AND logName:"projects/PROJECT_ID/logs/rabbitmq-" ``` |
| Redmine logs | ```sql resource.type="gce_instance" AND log_id("redmine") ``` |
| Salt logs | ```sql resource.type="gce_instance" AND logName:"projects/PROJECT_ID/logs/salt-" ``` |
| Slow MySQL queries | ```sql resource.type="gce_instance" AND log_id("mysql-slow") ``` |
| Solr logs | ```sql resource.type="gce_instance" AND log_id("solr") ``` |
| SugarCRM logs | ```sql resource.type="gce_instance" AND log_id("sugarcrm") ``` |
| Tomcat logs | ```sql resource.type="gce_instance" AND log_id("tomcat") ``` |
| Zookeeper logs | ```sql resource.type="gce_instance" AND log_id("zookeeper") ``` |

## Networking queries

| Query/filter name | Expression |
|---|---|
| Firewall- all logs | ```sql resource.type="gce_subnetwork" AND log_id("compute.googleapis.com/firewall") ``` |
| Firewall logs for a given country | ```sql resource.type="gce_subnetwork" AND log_id("compute.googleapis.com/firewall") AND jsonPayload.remote_location.country=COUNTRY_ISO_ALPHA_3 ``` |
| Firewall logs from a VM | ```sql resource.type="gce_subnetwork" AND log_id("compute.googleapis.com/firewall") AND jsonPayload.instance.vm_name="INSTANCE_NAME" ``` |
| Firewall subnet logs | ```sql resource.type="gce_subnetwork" AND log_id("compute.googleapis.com/firewall") AND resource.labels.subnetwork_name="SUBNET_NAME" ``` |
| Compute Engine subnetwork traffic logs to a subnet | ```sql resource.type="gce_subnetwork" AND ip_in_net(jsonPayload.connection.dest_ip, "SUBNET_IP") ``` |
| VPC Flow logs | ```sql resource.type="gce_subnetwork" AND log_id("compute.googleapis.com/vpc_flows") ``` |
| VPC Flow logs for specific port and protocol | ```sql resource.type="gce_subnetwork" AND log_id("compute.googleapis.com/vpc_flows") AND jsonPayload.connection.src_port="PORT_ID" AND jsonPayload.connection.protocol="PROTOCOL" ``` |
| VPC Flow logs for specific subnet | ```sql resource.type="gce_subnetwork" AND log_id("compute.googleapis.com/vpc_flows") AND resource.labels.subnetwork_name="SUBNET_NAME" ``` |
| VPC Flow logs for specific subnet prefix | ```sql resource.type="gce_subnetwork" AND log_id("compute.googleapis.com/vpc_flows") AND ip_in_net(jsonPayload.connection.dest_ip, "SUBNET_IP") ``` |
| VPC Flow logs for a specific VM | ```sql resource.type="gce_subnetwork" AND log_id("compute.googleapis.com/vpc_flows") AND jsonPayload.src_instance.vm_name="VM_NAME" ``` |
| VPN gateway logs | ```sql resource.type="vpn_gateway" AND resource.labels.gateway_id="GATEWAY_ID" ``` |
| HTTP Load Balancer 5xx errors | ```sql resource.type="http_load_balancer" AND httpRequest.status>=500 ``` |
| HTTP Load Balancer requests to PHPMyAdmin | ```sql resource.type="http_load_balancer" AND httpRequest.request_url:"phpmyadmin" ``` |

## Security queries

| Query/filter name | Expression |
|---|---|
| Audit logs---all | ```sql logName:"cloudaudit.googleapis.com" ``` |
| Audit logs- Access Transparency (AXT) | ```sql log_id("cloudaudit.googleapis.com/access_transparency") ``` |
| Audit logs- Admin Activity | ```sql log_id("cloudaudit.googleapis.com/activity") ``` |
| Audit logs- Data Access | ```sql log_id("cloudaudit.googleapis.com/data_access") ``` |
| Audit logs- System Event | ```sql log_id("cloudaudit.googleapis.com/system_event") ``` |

## Security Command Center queries

Use the following queries to find Security Command Center audit logs and inspect or
filter requests that are generated by Security Command Center services, including the vulnerability
scanner for External Exposure, such as from the `TsunamiSecurityScanner` user agent.
For more information, see
[Identify scanner traffic in your logs](https://docs.cloud.google.com/security-command-center/docs/detect-external-exposure.md.txt#identify-scanner-traffic)
and
[Troubleshooting Security Command Center](https://docs.cloud.google.com/security-command-center/docs/troubleshooting.md.txt#tsunami-scanner-403).

| Query/filter name | Expression |
|---|---|
| Security Command Center vulnerability scanner requests | ```sql httpRequest.userAgent="TsunamiSecurityScanner" ``` |
| Security Command Center scanner requests blocked by access controls (`HTTP 403`) | ```sql httpRequest.userAgent="TsunamiSecurityScanner" AND httpRequest.status=403 ``` |
| Exclude Security Command Center vulnerability scanner requests | ```sql NOT httpRequest.userAgent="TsunamiSecurityScanner" ``` |
| Security Command Center Admin Activity audit logs | ```sql protoPayload.serviceName="securitycenter.googleapis.com" AND log_id("cloudaudit.googleapis.com/activity") ``` |
| All Security Command Center audit logs | ```sql protoPayload.serviceName="securitycenter.googleapis.com" ``` |

## Troubleshooting

For instructions about troubleshooting common issues when using the
Logs Explorer, see
[Using the Logs Explorer: Troubleshooting](https://docs.cloud.google.com/logging/docs/view/logs-explorer-interface.md.txt#troubleshooting).

## What's next

For more information about the query syntax, which you can use to customize
these queries, see
[Logging query language](https://docs.cloud.google.com/logging/docs/view/logging-query-language.md.txt).

For more information about querying in the Google Cloud console, see
[Build queries by using the Logging query language](https://docs.cloud.google.com/logging/docs/view/building-queries.md.txt).