Build Cloud Logging filter expressions with templates and syntax reference.
Last verified: April 2026
Output will appear here...The GCP Cloud Logging Query Builder helps you construct Cloud Logging filter queries using guided templates and field selection. Cloud Logging's filter syntax can be tricky with its combination of resource types, log names, severity levels, and nested JSON payloads. This tool provides pre-built templates for common GCP services like Cloud Run, GKE, Cloud Functions, and Compute Engine, letting you customize filters and get a ready-to-use query for the Logs Explorer or gcloud CLI.
Cloud Logging uses a filter expression language where you combine field-based comparisons with AND/OR logic. Fields include resource.type, logName, severity, and jsonPayload subfields. The syntax is different from SQL or KQL and is specific to Google Cloud Logging.
Yes. The generated filter expressions work in the Logs Explorer console, the gcloud logging read command, and the Cloud Logging API. Just wrap the filter in quotes when using the CLI.
The query syntax generated by this tool is compatible with Cloud Logging log-based metrics. You can use the filter expressions when creating metrics in the console or via the API.
Your GKE cluster's Cloud Logging bill jumped 40% after deploying a new microservice. You use the builder to create a filter for resource.type='k8s_container' with the new service's namespace. The query reveals the service logs 500 MB/day of debug-level trace output. You create an exclusion filter for severity=DEBUG on that namespace, immediately cutting ingestion volume. You also set up a log-based metric to alert if any service exceeds 100 MB/day of log output.
The builder maintains templates for each GCP service with the correct resource.type values, log name patterns, and common payload field paths. When you select a service and scenario, it assembles a filter expression combining resource type matching, severity filters, and user-specified field conditions using Cloud Logging's comparison operators and boolean logic.
Cloud Logging exclusion filters can reduce your ingestion costs by up to 90%. Create exclusion filters for verbose debug logs and health check entries that you never query. Excluded logs are not stored or charged, but they can still be routed to BigQuery or Cloud Storage sinks before exclusion.
Log routing sinks with inclusion filters let you send specific logs to different destinations. Route security-critical audit logs to a locked BigQuery dataset with a long retention period, while sending verbose application logs to a Cloud Storage bucket with lifecycle deletion after 30 days.
Cloud Logging filter syntax uses AND by default between expressions. If you need OR logic, you must explicitly use the OR keyword. The expression 'severity=ERROR severity=CRITICAL' matches logs that are both ERROR and CRITICAL (none), not either. Use 'severity=ERROR OR severity=CRITICAL' instead.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.