What is the Cloud Logging filter syntax?

Cloud Logging uses a filter expression language where you combine field-based comparisons with AND/OR logic. Fields include resource.type, logName, severity, and jsonPayload subfields. The syntax is different from SQL or KQL and is specific to Google Cloud Logging.

Can I use the generated queries in the gcloud CLI?

Yes. The generated filter expressions work in the Logs Explorer console, the gcloud logging read command, and the Cloud Logging API. Just wrap the filter in quotes when using the CLI.

Does this tool support log-based metrics filters?

The query syntax generated by this tool is compatible with Cloud Logging log-based metrics. You can use the filter expressions when creating metrics in the console or via the API.

GCP Cloud Logging Query Builder

MonitoringGCP

Build Cloud Logging filter expressions with templates and syntax reference.

Query Mode

Template Selection

Generated Cloud Logging Filter

Output will appear here...

About This Tool

The GCP Cloud Logging Query Builder helps you construct Cloud Logging filter queries using guided templates and field selection. Cloud Logging's filter syntax can be tricky with its combination of resource types, log names, severity levels, and nested JSON payloads. This tool provides pre-built templates for common GCP services like Cloud Run, GKE, Cloud Functions, and Compute Engine, letting you customize filters and get a ready-to-use query for the Logs Explorer or gcloud CLI.

When to Use This Tool

•Build Cloud Logging filters to find error logs from specific Cloud Run services during incident triage.
•Generate queries to filter GKE container logs by namespace, pod, or severity for debugging deployments.
•Create log filters for Cloud Functions to track cold starts, execution timeouts, and memory usage.
•Build audit log queries to track IAM permission changes and resource modifications across your GCP organization.

Frequently Asked Questions

What is the Cloud Logging filter syntax?: Cloud Logging uses a filter expression language where you combine field-based comparisons with AND/OR logic. Fields include resource.type, logName, severity, and jsonPayload subfields. The syntax is different from SQL or KQL and is specific to Google Cloud Logging.
Can I use the generated queries in the gcloud CLI?: Yes. The generated filter expressions work in the Logs Explorer console, the gcloud logging read command, and the Cloud Logging API. Just wrap the filter in quotes when using the CLI.
Does this tool support log-based metrics filters?: The query syntax generated by this tool is compatible with Cloud Logging log-based metrics. You can use the filter expressions when creating metrics in the console or via the API.

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.