Basic Logs Filters

This guide shows you how to filter log entries by label or text search in the Logs Viewer basic viewing interface.

For more advanced viewing and filtering options, see Advanced Logs Filters.

To export your log entries, see Exporting Logs. To read log entries through the API, see entries.list. To read log entries using the SDK, see Reading log entries.

Getting started with basic filters

  1. Go to the Stackdriver > Logging page in the GCP Console:

    Go to the Logs Viewer page

  2. Select an existing GCP project at the top of the page, or create a new project.

  3. Using the drop-down menus, select the resource whose logs you want to view.

The following screenshot shows the Logs Viewer's basic viewing interface. Four log entries from Compute Engine VM instances are shown. The third entry has been expanded by clicking its expander arrow (▸):

Logs Viewer

The basic viewing interface has the following major components, some of which are shared with the advanced filter interface:

  1. The window tabs let you choose Logs, Metrics (see Logs-based metrics), Exports (see Exporting logs), and Resource Usage.
  2. The search-filter box in the basic interface lets you filter log entries by label or text search. The basic filter is shown, and the menu at the end (▾) switches to the advanced logs filter interface.
  3. The basic selector menus lets you choose resources, logs, and severity levels to display.
  4. The time-range selector drop-down menus let you filter for specific dates and times in the logs.
  5. The streaming selector, at the top of the page, controls whether new log entries are displayed as they arrive.
  6. The View Options menu, at the far right, has additional display options.
  7. The expander arrow (▸) in front of each log entry lets you look at the full contents of the entry. For more information, see Expand log entries.

Basic searches

In the basic viewing interface, enter your text in the search-filter box above the menus and press ENTER. The search returns all log entries that include your search term(s) anywhere, in any field (except timestamp), and in any letter case. The word text: that the Logs Viewer adds before your search term(s) indicates that this is an "all fields" search.

Following are some common searches, and some that don't do what you expect.

Common basic search examples

Unicorn (text:Unicorn)

Finds all log entries containing unicorn, in any field and in any letter case.

unicorn phoenix (text:unicorn text:phoenix)

Finds all log entries containing unicorn or phoenix, in the same or different field(s). If you want log entries that contain both terms, use the advanced filter interface.

"unicorn phoenix" (text:"unicorn phoenix")

Finds all log entries containing unicorn and phoenix in the same field, in any letter case, separated by exactly one space. The basic viewing interface does not support searching for "unicorn and phoenix anywhere in the same field," but the advanced filter interface does.

2345 (text:2345)

Finds all log entries containing the string 2345. Numbers within log entries are generally represented as strings, so this will match, for example, 123456.

Searches that don't do what you expect

uni* (text:uni*)
This is not a wildcard search. This search finds all log entries containing the 4-character string "uni*". The Logs Viewer does not support regular expression searches and there are no special wildcard characters such as * or ?, in either the basic or advanced interface.
2017-02-05 (text:2017-02-05)
This does not match log entry time stamps. This search finds all log entries containing the string 2017-02-05 in any field except timestamp. If your log entries contain date strings in their payload or in other fields, then you can search for them. You can also use the Jump to date menu below the search box. The advanced filter interface lets you use searches that specify a range of time stamps.
200..299 (text:200..299)
This does not match 250. This basic interface search finds log entries containing the 8-character string "200..299". This range notation is only allowed in searches restricted to integer fields. See Searching specific fields.

Searching specific fields

You can restrict your search to a specific field by adding the field name and a colon in front of your search terms. The field name replaces text: in all-field searches. As you type in the search box, you will see a list of matching fields:

Basic field search

In the following examples, status: is the integer HTTP status code and path: is the HTTP path in the request:

Finds log entries whose HTTP path contains query in any letter case; for example, /query or /App/Query/17.
Finds log entries that have a path field. This is a special use of the asterisk (*) character; it is not generally treated as a special character.
View log entries with a status of (exactly) 200. The search will not match, for example, a status of 2000. Since status is known to be an integer field, the comparison is numeric.
Illegal, because status is known to contain an integer.
Finds log entries with an HTTP status of 400 through 499. Ranges are only available for fields known to contain integers. If you use a range for other fields, the range is interpreted as a single string containing . characters.
path:query unicorn
Finds log entries whose path fields contain query and that contain unicorn in any field. Because unicorn is not preceded by a field name, it is as if you wrote text:unicorn. When you include search terms for different fields, or for fields and text:, the terms are implicitly connected with and.
path:query path:status
Finds log entries whose path field contains query or status. When you include multiple search terms for the same field, the terms are implicitly connected with or.
path:query status:200 path:status status:500..502
Finds log entries that have paths containing query or status, and that have status values of 200, 500, 501, or 502. In other words, or binds more tightly than and, and the order of search terms does not matter.


If you are not sure why your search is not working in the basic viewing interface, briefly switch to the advanced filter interface:

  1. Select Convert to advanced filter in the ▾ menu at the end of the search box.
  2. Look at the advanced filter to see if it is what you intended.
  3. Return to the basic interface by using the browser's Back button.

Here are some other reasons you might not see all the log entries you expect:

  • You cannot see log entries that are older than the Stackdriver Logging retention period. See Quota Policy for the logs retention period in effect.

  • During periods of heavy load there could be delays in sending logs to Stackdriver Logging or in receiving and displaying the logs.

  • The Logs Viewer does not show log entries that have time stamps in the future until the current time has "caught up" with them. This is an unusual situation, probably caused by a time skew in the application sending the logs.

Send feedback about...

Stackdriver Logging