Troubleshoot Log Analytics configuration

This document shows you how to resolve errors that might occur when using the Log Analytics page.

Error messages

This section describes error messages you might see, and how to resolve the corresponding error conditions.

`No completion signal within allotted timeframe` error message

You enter a SQL query and select Run query. The query doesn't complete and you see the following error message:

The query failed to execute and return results due to error: No completion signal within allotted timeframe.

To resolve this error, do one of the following:

Shorten the interval over which logs are queried and then retry the query. For example, if a query interval is 14 days, shorten the interval to 7 days, and then run the query.
Create a linked BigQuery dataset and then run the query from the BigQuery interface. The BigQuery interface supports queries that require a longer execution time than the Cloud Logging interface. For more information, see Query logs by using BigQuery.

`FROM clause must contain exactly one view` error message

You enter a SQL query in the query pane of the Log Analytics page in the Google Cloud console, but the SQL parser displays the following error:

FROM clause must contain exactly one log view

The previous error is reported when the table specified in the FROM statement can't be resolved to a specific log view.

To resolve this error, ensure that your table name has the proper syntax:

Ensure that the table name follows the syntax required by the Log Analytics naming scheme. BigQuery and Log Analytics have different requirements for the table name. You can find the required syntax for the table name by viewing the default query.
If the Cloud project ID, region, bucket ID, or view ID of a log bucket contains period characters, (.), then ensure that each of these fields is wrapped by single backquotes, (`).

For example, if a Cloud project ID is example.com:bluebird, then to query the _AllLogs view of the _Default log bucket, use the following syntax to specify the table:
```
SELECT *
FROM `example.com:bluebird`.`global`.`_Default`.`_AllLogs`
```
The previous query assumes that the _Default bucket is in the global region.

Unable to save a query

You enter and run a SQL query, and then select Save. The Save dialog is displayed; however, you can't complete the dialog and you can't save the query.

To resolve this error, do the following:

Ensure that the query doesn't contain syntax errors. You can only save valid queries.
Optional: Copy the query into your clipboard.
Reload the page.
If you copied the query into your clipboard, then paste the query into the Query pane, run the query, and then perform the save operation.

Access denied to the Log Analytics page

You open the Log Analytics page in the Google Cloud console and a permission-denied error message is displayed.

To get the permissions that you need to load the Log Analytics page and run queries, ask your administrator to grant you the Logs Viewer (roles/logging.viewer) IAM role on Cloud Logging. For more information about granting roles, see Manage access.

You might also be able to get the required permissions through custom roles or other predefined roles.

The permissions that you need to view log entries and run queries on the Log Analytics page are the same as those that you need to view logs on the Logs Explorer page. For information about additional roles that you need to query views on user-defined buckets or to query the _AllLogs view of the _Default log bucket, see Cloud Logging roles.

Upgrade of log bucket to use Log Analytics fails

You create a log bucket and select the option to use Log Analytics, or you upgrade an existing log bucket to use Log Analytics. The upgrade fails with an error condition similar to:

Failed precondition (HTTP 400): Constraint "my-constraint" violated for PROJECT_ID  with location global.

The previous error message indicates that your organization has configured an organizational policy that restricts the regions that can be used. Log buckets that are eligible to be upgraded to use Log Analytics must use the global region. If you can remove the organizational policy restricting usage of the global region, then you can upgrade your log bucket. Otherwise, you can't upgrade your log buckets.

Creating a linked BigQuery dataset fails

You edit a log bucket to create a linked BigQuery dataset or you create a new log bucket and select the option to create a linked dataset; however, the linked dataset isn't created.

To resolve this error, ask the system administrator for the Google Cloud project to grant you an IAM role that includes the following permission:

logging.links.create

The previous permission is included in the Logging Admin (roles/logging.admin) and Logs Configuration Writer (roles/logging.configWriter) roles.

For information about roles and permissions, see Access control with IAM.

Deleting a linked BigQuery dataset fails

You no longer want the linked dataset but the option to delete that dataset is disabled.