Overview of Logs-based Metrics

Logs-based metrics are Stackdriver Monitoring metrics that are based on the content of log entries. For example, the metrics can record the number of log entries containing particular messages, or they can extract latency information reported in log entries. You can use logs-based metrics in Stackdriver Monitoring charts and alerting policies.

This documentation focuses on user-defined metrics. To create a logs-based metric, see Creating Counter Metrics or Creating Distribution Metrics. For information on the predefined logs-based metrics, see System Logging metrics on this page.

To see the list of user-defined and predefined logs-based metrics in your GCP project, click the following button:

Go to Logs-based Metrics

Before you start

  1. Sign in to your Google account.

    If you don't already have one, sign up for a new account.

  2. Select or create a Cloud Platform project.

    Go to the Manage resources page

  3. Enable billing for your project.

    Enable billing

  4. Create or use a Stackdriver account for your project.

Stackdriver service tiers

User-defined logs-based metrics are presently available to all users.

Overview

Stackdriver Logging provides two kinds of logs-based metrics: counter metrics and distribution metrics. The following sections describe their characteristics.

Counter metrics

Counter metrics count the number of log entries matching an advanced logs filter. For example, you can create a metric that counts log entries representing certain types of errors from specific resources.

For more information, see Creating Counter Metrics.

Distribution metrics

Distribution metrics accumulate numeric data from log entries matching a filter. The metrics contain a time series of Distribution objects, each of which contains the following:

  • A count of the number of values in the distribution.
  • The mean of the values.
  • The sum of squared deviations: Sumi=1..n(xi–mean)2

  • A set of histogram buckets with the count of values in each bucket. You can use the default bucket layout or choose your own.

A common use for distribution metrics is tracking latencies. As each log entry is received, a latency value is extracted from somewhere in the log entry and is added to the distribution. At regular intervals, the accumulated distribution is written to Stackdriver Monitoring.

For more information, see Creating Distribution Metrics.

Common properties of metrics

A logs-based metric is a delta metric. Each data point in the metric's time series represents only the additional information received since the previous data point.

Stackdriver Logging accumulates information for logs-based metrics every time a matching log entry is received. On a regular schedule (say, every minute), Stackdriver Logging writes a new data point to the metric's time series, making the data available to Stackdriver Monitoring.

Labels

Logs-based metrics can optionally have labels, which allow a single metric to hold multiple time series. Values for the labels are extracted from fields in the matching log entries. Stackdriver Logging records separate time series for each different value of your label.

The system logging metrics have predefined labels. You can define your own labels for your user-defined metrics. For more information, see Logs-based Metric Labels.

System logging metrics

Stackdriver Logging provides some predefined counter metrics that track the number and volume of log entries received. The metrics have labels that record the counts by log name and severity level. The following table lists the metrics:

Metric name and description Type Value Labels
logging.googleapis.com/log_entry_count

The total number of log entries received.

delta int64 log: The name of the log. Example: "appengine.googleapis.com/request_log".

severity: The severity of the log entries. Example: "ERROR".

logging.googleapis.com/byte_count

The total number of bytes received in log entries.

delta int64 log: The name of the log. Example: "appengine.googleapis.com/request_log".
logging.googleapis.com/dropped_log_entry_count

The number of late-arriving log entries.1

delta int64 log: The name of the log. Example: "appengine.googleapis.com/request_log".

1 The late-arriving log entries are not included in the log_entry_count or byte_count metrics.

Stackdriver Monitoring

You can use both predefined and user-defined logs-based metrics in Stackdriver Monitoring to create charts and alerting policies. You find these metrics in the Log Metrics resource type when creating charts or alerting conditions. Your user-defined metric names are prefixed by user/; the predefined metrics are not.

If you are using the Stackdriver Monitoring API, the logs-based metrics names are shown below:

logging.googleapis.com/user/[USER_METRIC_NAME]
logging.googleapis.com/[SYSTEM_METRIC_NAME]

For more information, see Creating Charts and Alerts.

Troubleshooting

Metric is missing logs data

There are a few possible reasons for missing data in logs-based metrics:

  • Check that there are new log entries that match your metric's logs filter. A logs-based metric gets data from matching log entries that are received after the metric is created. Stackdriver Logging does not backfill the metric from previous log entries.

  • For distribution metrics, check that the field containing your distribution value exists in the log entries, and that your extraction regexp (if any) is correct.

  • It takes up to a minute to update the logs-based metrics in Stackdriver Monitoring, so you may see log entries in Stackdriver Logging that are not yet counted in Stackdriver Monitoring.

  • Late-arriving log entries are not counted in logs-based metrics, although the entries can be seen in the Logs Viewer and are available from the Stackdriver Logging API.

    A log entry is considered late if its receivedTimestamp is more than 10 minutes after its timestamp. This can also be caused by a timestamp that is more than 10 minutes in the future. For more information, see LogEntry. The number of late-arriving entries is recorded for each log in the system metric, logging.googleapis.com/dropped_log_entry_count.

    Example. A log entry matching a logs-based metric arrives five minutes late. It has a timestamp of 2:30 PM and a receivedTimestamp of 2:35 PM. The log entry is included in the metric's 2:36 PM data point. If you look for the entry in the Logs Viewer after 2:35 PM, you will see it, labeled with the time 2:30 PM.

Metric has too many time series

You might have a metric label that has a large number of values. The number of time series in a metric depends on the number of different combinations of label values. Check that your label fields and extractor regexps (if any) are correct.

Monitor your resources on the go

Get the Google Cloud Console app to help you manage your projects.

Send feedback about...

Stackdriver Logging