Troubleshoot Log Analytics configuration

Stay organized with collections Save and categorize content based on your preferences.

This document shows you how to resolve errors that might occur when configuring or viewing log buckets upgraded to use Log Analytics.

Error FROM clause must contain exactly one view

You enter a SQL query in the query pane of the Log Analytics page in the Google Cloud console, but the SQL parser displays the following error:

FROM clause must contain exactly one log view

The previous error is reported when the table specified in the FROM statement can't be resolved to a specific log view.

To resolve this error, ensure that your table name has the proper syntax:

  • Ensure that the table name follows the syntax required by the Log Analytics naming scheme. BigQuery and Log Analytics have different requirements for the table name. You can find the required syntax for the table name by viewing the default query.

  • If the Cloud project ID, region, bucket ID, or view ID of a log bucket contains period characters, (.), then ensure that each of these fields is wrapped by single backquotes, (`).

    For example, if a Cloud project ID is example.com:bluebird, then to query the _AllLogs view of the _Default log bucket, use the following syntax to specify the table:

    
    SELECT *
    FROM `example.com:bluebird`.`global`.`_Default`.`_AllLogs`
    

    The previous query assumes that the _Default bucket is in the global region.

Access denied to the Log Analytics page

You open the Log Analytics page in the Google Cloud console and a permission-denied error message is displayed.

To resolve this error, ask the system administrator for the Google Cloud project to grant you an Identity and Access Management (IAM) role that includes the following permissions:

  • logging.buckets.list
  • logging.views.list

The previous permissions are included in the following roles:

  • Logs Viewer (roles/logging.viewer)
  • Private Logs Viewer (roles/logging.privateLogViewer)
  • Logging Admin (roles/logging.admin)
  • Logs Configuration Writer (roles/logging.configWriter)

For information about roles and permissions, see Access control with IAM.

Upgrade of log bucket to use Log Analytics fails

You create a log bucket and select the option to use Log Analytics, or you upgrade an existing log bucket to use Log Analytics. The upgrade fails with an error condition similar to:

Failed precondition (HTTP 400): Constraint "my-constraint" violated for PROJECT_ID  with location global.

The previous error message indicates that your organization has configured an organizational policy that restricts the regions that can be used. Log buckets that are eligible to be upgraded to use Log Analytics must use the global region. If you can remove the organizational policy restricting usage of the global region, then you can upgrade your log bucket. Otherwise, you can't upgrade your log buckets.

Creating a linked BigQuery dataset fails

You edit a log bucket to create a linked BigQuery dataset or you create a new log bucket and select the option to create a linked dataset; however, the linked dataset isn't created.

To resolve this error, ask the system administrator for the Google Cloud project to grant you an IAM role that includes the following permission:

  • logging.links.create

The previous permission is included in the Logging Admin (roles/logging.admin) and Logs Configuration Writer (roles/logging.configWriter) roles.

For information about roles and permissions, see Access control with IAM.

Deleting a linked BigQuery dataset fails

You no longer want the linked dataset but the option to delete that dataset is disabled.

To resolve this error, ask the system administrator for the Google Cloud project to grant you an IAM role that includes the following permission:

  • logging.links.delete

The previous permission is included in the Logging Admin (roles/logging.admin) and Logs Configuration Writer (roles/logging.configWriter) roles.

This permission lets you delete the linked dataset from the Logs Storage page of the Google Cloud console. For more information about roles and permissions, see Access control with IAM.