Create, query, and manage analytics views

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This document describes how to create, manage, and query analytics views. For a conceptual overview, see About analytics views.

Before you begin

Note: There are no predefined Cloud Logging Identity and Access Management (IAM) roles that contain the permissions required to create or query an analytics view.

Because analytics views query log views, to create and query analytics views, your IAM roles must also let you query log views and use Log Analytics. This section lists the IAM roles required to create analytics views, and those required to query log views and to use Log Analytics:

• To get the permissions that you need to create, manage, and use analytics views, ask your administrator to grant you the Observability Analytics User (roles/observability.analyticsUser) IAM role on your project.

  This predefined role contains the permissions required to create, manage, and use analytics views. To see the exact permissions that are required, expand the Required permissions section:

  Required permissions

  The following permissions are required to create, manage, and use analytics views:

  • observability.analyticsViews.get
  • observability.analyticsViews.list
  • observability.analyticsViews.create
  • observability.analyticsViews.update
  • observability.analyticsViews.delete

• To get the permissions that you need to query a log view and to use Log Analytics, ask your administrator to grant you the following IAM roles on your project:

  • To query the _Required and _Default log buckets: Logs Viewer (roles/logging.viewer)
  • To query all log views in a project: Logs View Accessor (roles/logging.viewAccessor)

  You can restrict a principal to a specific log view either by adding an IAM condition to the Logs View Accessor role grant made at the project level, or by adding an IAM binding to the policy file of the log view. For more information, see Control access to a log view.

  For information about additional roles that you need to query views on user-defined buckets or to query the _AllLogs view of the _Default log bucket, see Cloud Logging roles.

Create an analytics view

Note: An analytics view can only query log views. When multiple log views are queried, the log buckets that host these log views must be in one location. For example, if you have two log buckets in the us-east1 location, then you create a analytics view that queries log views on those log buckets.

To create an analytics view, do the following:

1. In the Google Cloud console, go to the Log Analytics page:

   Go to Log Analytics

   If you use the search bar to find this page, then select the result whose subheading is Logging.

2. In the Views menu, go to the segment Logs section, and then select the log view to query.

   To find a log view, you can use the Filter bar or scroll through the list of log views. Each entry in the list is in the following format BUCKET_ID.LOG_VIEW_ID, where these fields refer to the IDs of the log bucket and log view.

3. In the Schema toolbar, click Query.

   The Query pane is updated with a SQL query.

4. Ensure that the toolbar displays Run query.

   If the toolbar displays Run in BigQuery, then click Settings and select Log Analytics (default).

5. Update the SQL query in the Query pane until you're satisfied with the results of the query.

6. In the toolbar, click save Save, and then select Save as analytics view.

7. Enter a name and description for the analytics view, and then click Save.

   Note: You can't change the name of an analytics view after it is created. You can modify the description and query.

   Your analytics view is created and is listed in the Views pane, in the section titled data_table Analytics Views. Each entry in the list is in the following format LOCATION.ANALYTICS_VIEW_ID, where these fields refer to the location and ID of an analytics view. For example, if you created an analytics view with the name my-analytic-view that queries a log view whose log bucket is in the global region, then this section displays global.my-analytic-view.

Query an analytics view

After an analytics view exists, you can query it similarly to querying a log view. For a list of documents that describe how to use the Log Analytics page, see the What's next section of this document.

To run the default query for an analytics view, do the following:

1. In the Google Cloud console, go to the Log Analytics page:

   Go to Log Analytics

   If you use the search bar to find this page, then select the result whose subheading is Logging.

2. Enter a query or load the default query for the analytics view. The FROM clause for your query should have the following format:

   FROM `analytics_view.PROJECT_ID.LOCATION.ANALYTICS_VIEW_ID`
   

   In the previous expression, the fields have the following meaning:

   • PROJECT_ID: The identifier of the project.
   • LOCATION: The location of the analytics view. The location of an analytics view is inherited from the resource it queries. For example, if an analytics view queries a log view that is in the global location, then the location of the analytics view is also global.
   • ANALYTICS_VIEW_ID: The ID of the analytics view.

   To run the default query, do the following:

   1. In the Views menu, go to the data_table Analytics Views section, and select the analytics view that you want to query.

      To find an analytics view, you can use the Filter bar or scroll through the list of analytics views. Each entry in the list is in the following format LOCATION.ANALYTICS_VIEW_ID, where these fields refer to the location and ID of an analytics view.

   2. In the Schema toolbar, click Query.

      The Query pane is updated with a SQL query that is querying the analytics view you selected.

3. Click Run query.

   If the toolbar displays Run in BigQuery, then click Settings and select Log Analytics (default).

List analytics views

To list the analytics views in your Google Cloud project, do the following:

1. In the Google Cloud console, go to the Log Analytics page:

   Go to Log Analytics

   If you use the search bar to find this page, then select the result whose subheading is Logging.

2. In the Views menu, go to the data_table Analytics Views section.

   A list of analytics views is shown. Each entry in the list is in the following format LOCATION.ANALYTICS_VIEW_ID, where these fields refer to the location and ID of an analytics view. For example, if you created an analytics view with the name my-analytic-view that queries a log view whose log bucket is in the global region, then this section displays global.my-analytic-view.

3. To view the details of a specific analytics view, do the following:

   1. Select the analytics view.

      The schema of the analytics view is shown in the Schema section.

   2. In to the Schema toolbar click View analytics view options, and select View details.

      The dialog displays information about the analytics view, including when the analytics view was created, the schema, and the query.

Modify an analytics view

To modify an analytics view, do the following:

1. In the Google Cloud console, go to the Log Analytics page:

   Go to Log Analytics

   If you use the search bar to find this page, then select the result whose subheading is Logging.

2. In the Views menu, go to the data_table Analytics Views section, and select the analytics view that you want to query.

3. In the Schema toolbar, click View analytics view options, and select Edit view.

   A dialog opens that displays information about the analytics view. You can modify the description and query.

4. After you made your modifications, click Overwrite saved view.

Delete an analytics view

Note: If you've written queries against an analytics view and delete the analytics view, then those queries will fail.

To delete an analytics view, do the following:

1. In the Google Cloud console, go to the Log Analytics page:

   Go to Log Analytics

   If you use the search bar to find this page, then select the result whose subheading is Logging.

2. In the Views menu, go to the data_table Analytics Views section, and select the analytics view that you want to query.
3. In the Schema toolbar, click View analytics view options, select Delete view, and complete the dialog.

Limitations

The following limitations apply to analytics views:

• An analytics view can't query another analytics view.
• An analytics view can query multiple log views. However, the log buckets that host the queried log views must be in one location. For example, suppose you have two log buckets, one in us-east1 and the other in asia-east1. You can't create a analytics view that queries log views on those log buckets.
• The parent resource of an analytics view must be a Google Cloud project. You can't create an analytics view in folders or organizations.
• Linked datasets aren't supported for analytics views. Therefore, you can query analytics views only by using the Log Analytics page. Also, you must run those queries on the default Cloud Logging service.
• There is no API support for creating or managing analytics views.

• The following limits apply to analytics views:

  • Maximum number of analytics views per Google Cloud project: 100
  • Per Google Cloud project, the maximum number of analytics views per region: 50
  • Per Google Cloud project, the maximum number of regions that can store analytics views: 10

What's next

• Query and analyze logs overview
• Save and share a SQL query
• Chart SQL query results
• Sample SQL queries