Basic Logs Filters

This guide shows you how to filter log entries by label or text search in the Logs Viewer basic filter interface.

For more advanced filtering options, see Advanced Logs Filters.

To export your log entries, see Exporting Logs. To read log entries through the API, see entries.list. To read log entries using the SDK, see Reading log entries.

Getting started with basic filters

  1. Go to the Stackdriver > Logging page in the GCP Console:

    Go to the Logs Viewer page

  2. Select an existing GCP project at the top of the page, or create a new project.

  3. Using the drop-down menus, select the resource whose logs you want to view.

The following screenshot shows the Logs Viewer's basic filter interface. Four log entries from Compute Engine VM instances are shown. The second entry has been expanded by clicking its expander arrow (▸):

Logs Viewer

The basic filter interface has the following major components—indicated by red numbers in the screenshot above—some of which are shared with the advanced filter interface:

  1. The window tabs let you choose Logs, Metrics (see Logs-based metrics), Exports (see Exporting logs), and Logs ingestion.
  2. The search-filter box in the basic filter interface lets you filter log entries by label or text search. The basic filter is shown, and the menu at the end (▾) switches to the advanced logs filter interface.
  3. The basic selector menus lets you choose resources, logs, and severity levels to display.
  4. The time-range selector drop-down menus let you filter for specific dates and times in the logs.
  5. The streaming selector, at the top of the page, controls whether new log entries are displayed as they arrive.
  6. The log-entry table contains the log entries available according to your current filters and custom fields.
  7. The expander arrow (▸) in front of each log entry lets you look at the full contents of the entry. For more information, see Expand log entries.
  8. The View Options menu, at the far right, has additional display options.

Basic searches

In the basic filter interface, enter your text in the search-filter box above the menus and press ENTER. The search returns all log entries that include your search term(s) anywhere, in any field (except timestamp), and in any letter case. The word text: that the Logs Viewer adds before your search term(s) indicates that this is an "all fields" search.

Following are some common searches, and some that don't do what you expect.

Common basic search examples

Unicorn (text:Unicorn)

Finds all log entries containing unicorn, in any field and in any letter case.

unicorn phoenix (text:unicorn text:phoenix)

Finds all log entries containing unicorn or phoenix, in the same or different field(s). If you want log entries that contain both terms, use the advanced filter interface.

"unicorn phoenix" (text:"unicorn phoenix")

Finds all log entries containing unicorn and phoenix in the same field, in any letter case, separated by exactly one space. The basic filter interface does not support searching for "unicorn and phoenix anywhere in the same field," but the advanced filter interface does.

2345 (text:2345)

Finds all log entries containing the string 2345. Numbers within log entries are generally represented as strings, so this will match, for example, 123456.

Searches that don't do what you expect

uni* (text:uni*)
This is not a wildcard search. This search finds all log entries containing the 4-character string "uni*". The Logs Viewer does not support regular expression searches and there are no special wildcard characters such as * or ?, in either the basic or advanced filter interfaces.
2017-02-05 (text:2017-02-05)
This does not match log entry time stamps. This search finds all log entries containing the string 2017-02-05 in any field except timestamp. If your log entries contain date strings in their payload or in other fields, then you can search for them. You can also use the Jump to date menu below the search box. The advanced filter interface lets you use searches that specify a range of time stamps.
200..299 (text:200..299)
This does not match 250. This basic filter interface search finds log entries containing the 8-character string "200..299". This range notation is only allowed in searches restricted to integer fields. See Searching specific fields.
unicorn NOT phoenix (text:unicorn text:NOT text:phoenix)
unicorn OR phoenix (text:unicorn text:OR text:phoenix)
These are not Boolean text searches, as including Boolean operators (AND, OR, NOT or AND NOT) is not supported for text searches in the basic filter. If you include multiple text search terms, the terms are implicitly connected by or.

Searching specific fields

You can restrict your search to a specific field by adding the field name and a colon in front of your search terms. The field name replaces text: in all-field searches. As you type in the search box, you will see a list of matching fields:

Basic field search

In the following examples, status: is the integer HTTP status code and path: is the HTTP path in the request:

Finds log entries whose HTTP path contains query in any letter case; for example, /query or /App/Query/17.
Finds log entries that have a path field. This is a special use of the asterisk (*) character; it is not generally treated as a special character.
View log entries with a status of (exactly) 200. The search will not match, for example, a status of 2000. Since status is known to be an integer field, the comparison is numeric.
Illegal, because status is known to contain an integer.
Finds log entries with an HTTP status of 400 through 499. Ranges are only available for fields known to contain integers. If you use a range for other fields, the range is interpreted as a single string containing . characters.
path:query unicorn
Finds log entries whose path fields contain query and that contain unicorn in any field. Because unicorn is not preceded by a field name, it is as if you wrote text:unicorn. When you include search terms for different fields, or for fields and text:, the terms are implicitly connected with and.
path:query path:status
Finds log entries whose path field contains query or status. When you include multiple search terms for the same field, the terms are implicitly connected with or.
path:query status:200 path:status status:500..502
Finds log entries that have paths containing query or status, and that have status values of 200, 500, 501, or 502. In other words, or binds more tightly than and, and the order of search terms does not matter.


If you are not sure why your search is not working in the basic filter interface, briefly switch to the advanced filter interface:

  1. Select Convert to advanced filter in the ▾ menu at the end of the search-filter box.

  2. Look at the advanced filter box to see if it is what you intended.

  3. Return to the basic filter interface by using the browser's Back button. Selecting this option returns you to your previous selections in the basic filter interface.

  4. If you identified unintended filters in step 2, you can change or clear them in the search-filter box, the basic selector menu, or time-range selector menu.

Here are some other reasons you might not see all the log entries you expect:

  • You cannot see log entries that are older than the Stackdriver Logging retention period. See Quota Policy for the logs retention period in effect.

  • During periods of heavy load there could be delays in sending logs to Stackdriver Logging or in receiving and displaying the logs.

  • The Logs Viewer does not show log entries that have time stamps in the future until the current time has "caught up" with them. This is an unusual situation, probably caused by a time skew in the application sending the logs.

Was this page helpful? Let us know how we did:

Send feedback about...

Stackdriver Logging