Logs Viewer (Preview) interface

Before you begin

You don't need a Workspace to use Logging, unless you're sending logs from Amazon Web Services (AWS) to Logging.

If you're using a Workspace, Logging doesn't combine the logs from the monitored Google Cloud projects. You must select a specific Cloud project to view its logs.

If you're using a Workspace and AWS, select the AWS connector project to see the AWS logs.

Getting started

To navigate to the Logs Viewer (Preview), do the following:

  1. Go to the Google Cloud navigation menu and select Logging > Logs Viewer:
    Go to the Logs Viewer
  2. Select a Google Cloud project.
  3. From the version-picker menu, switch the Logs Viewer version from Classic to Preview the new Logs Viewer.

You're now in Logs Viewer (Preview).

Logs Viewer interface

The Logs Viewer interface lets you retrieve logs, parse and analyze log data, and refine your query parameters.

User interface for the Logs Viewer

  1. Logs Viewer page: Lets you build, analyze, and refine queries.
  2. Organization and project selector: Lets you view logs at an organization or project level.
  3. Query builder: Lets you build queries using either the drop-down menus or the query builder language. It also features a tab for viewing your Saved queries.
  4. Logs field explorer (beta): Lets you see aggregation-based results for the resource.type, resource.labels, logName, and severity fields, and provides a more efficient way to refine a query.
  5. Histogram: Lets you visualize the frequency of your logs data.
  6. Query results: Lets you view the retrieved logs from your query.
  7. Log entries: Lets you view log entries in the structured JSON format.
  8. Time zone: Lets you change the time zone that logs are displayed in.
  9. Page layout: Lets you enable and disable the Histogram and Logs field explorer panels.
  10. Time-range selector: Lets you restrict results by time range. The default time range is one hour.
  11. Run query: Lets you run your queries after you have built them in the query-builder pane.
  12. Jump to now: Lets you perform a forced refresh to include the current time. If the time-range selector uses a custom range and an end time is set, it runs the query with a default time range of one hour. Otherwise, it refreshes with the current start date or duration, and runs the query.
  13. Actions: Lets you perform certain actions on your logs, such as creating a logs-based metric or a sink destination.
  14. Configure: Lets you add the value of a log field to the summary line at the beginning or end of the log entry. It also lets you choose to show newest logs either first or last.
  15. Hide log summary: Lets you hide the log summary line from the query results.
  16. Expand or collapse nested log fields: Lets you expand or collapse nested fields.
  17. Copy to clipboard: Lets you copy the log entry in its JSON format.
  18. Save: Lets you save queries that can be viewed and run from the Saved tab.
  19. App Engine trace data: Lets you view trace details and refine your query based on the trace.
  20. Expand and collapse query results: Lets you expand the query-results pane to view more log entries.
  21. Adjust time range: Lets you change the time range used for queries by adjusting the handles. After adjusting the handles, click Run to update the time range used in the query.
  22. Refine scope: Lets you scope your search by logs in your current project only or by one or more storage views.

Within the query-results pane, you can click the values of a field to choose to do the following:

  1. Show matching entries: Lets you query for matching log entries.
  2. Hide matching entries: Lets you query for log entries that do not match the selected expression.
  3. Add field to summary line: Lets you add the field as a summary line to log entries.

Options after selecting field's value

Refine scope

You can refine the scope of the logs displayed in the Logs Viewer through the Refine scope panel. You have the option to only search logs within the current project or to search logs based on one or more storage views.

To refine the scope of the Logs Viewer, complete the following steps.

  1. From the Logging menu, select Logs Viewer.

    Go to Logs Viewer

  2. Select Refine Scope.

  3. On the Refine scope panel, select a Scope by option.

    The Refine scope panel

    • Scope by project allows you to search logs that the current project generates.

    • Scope by storage allows you to search logs based on one or more storage views.

  4. If you select Scope by storage, select one or more buckets you want to view.

    The panel lists storage views that meet the following conditions:

    • The user has access to the storage view.
    • The buckets belong to the selected project, or the selected project has routed logs to the storage buckets.
  5. Click Apply.

Add summary fields

Summary fields help you notice patterns in your logs faster. For example, the following image shows the value for the summary field resource.labels.pod_name added before the logs that contain that value.

The Logs Viewer is showing logs that are preceded with green text displaying
pod names.

Add a summary field from a log entry

To add a summary field to a log entry, complete the following steps:

  1. Expand a log entry by clicking the expand button .

  2. Click a field's value and then select Add field to summary line.

    The summary field now appears before the log entries containing that field.

Add a summary field using the Configure button

To add a summary field using the Configure button, complete the following steps:

  1. Click Configure and select Manage Summary Fields.

    Manage summary fields is selected from the configure drop-down menu

  2. Add fields.

    The summary field selection has the following features:

    • Autocomplete using the logs currently displayed.
    • Field correction for legal characters within quotes.

      For example, if you type jsonPayload.id-field, it gets changed to jsonPayload."id-field".

  3. Click Truncate summary fields to shorten the display of the summary field values. Then choose how many characters to display before the field is truncated and whether the beginning or the end of the field is displayed.

  4. Click Apply.

    The summary field now appears before the log entries containing that field.

Logs field explorer panel

The Logs field explorer panel offers a high-level summary of logs data and provides a more efficient way to refine a query. It shows the count of log entries, sorted by decreasing count, for the given log field. The log field counts correspond to the time range used by the Histogram panel.

The Logs field explorer is populated and updated based on an executed query. When there is an empty query, the Logs field explorer panel displays counts of log entries by resource type and log severity fields.

Using the Logs field explorer panel

You can add fields from the Logs field explorer panel to the Query builder to narrow down and refine a query. To do so, click on a field value in the Logs field explorer panel. This adds the log field to the Query builder and automatically runs the query by adding it as an expression to the original query using the AND operator.

When a query is run, the log field counts are incrementally loaded as the log entries are progressively scanned. Once the query is complete, which is indicated by the termination of the blue progress bar, you see the total counts for all log fields.

Histogram panel

The histogram panel lets you visualize the distribution of logs over time. This makes it easier to see trends in your logs data and troubleshoot problems.

Enabling the histogram panel

To enable the histogram panel, select Page Layout, and then select the Histogram checkbox. The Histogram panel appears.

Page layout is open and histograms is selected

To disable the histogram panel, clear the Histogram checkbox.

Using the histogram panel

A histogram is generated when you run a query. It displays the frequency of matching log entries for the selected time range.

Analyzing logs

To analyze your log data, hover over a bar in the Histogram panel and select Jump to time to drill into a narrower time range. This runs a new query with that time-range restriction.

Logs histograms showing popup dialog to jump to time

App Engine trace data

When an App Engine log entry contains a trace, the latency chip displays with a Trace icon.

Log entry display that contains trace data.

If you click on the trace latency chip, you have the following options for further refining your query and viewing the details of the trace:

  • View trace details: Shows the parent span and child traces along with details about the trace in a flyout panel. To view more details about the trace, navigate to Cloud Trace by clicking View in Trace. For more information about the content in the flyout panel, see Viewing trace details.

  • Show all logs for this trace: Refines and runs the query by adding the trace field set to the identifier of the trace associated with the log entry.

  • Show only traced requests: Refines and runs the query by adding the traceSampled field set to True. For more information on sampling, go to Sampling rate.

Troubleshooting

This section provides instructions for troubleshooting common issues when using the Logs Viewer (Preview).

Selecting a Cloud project or organization

To select a Cloud project from anywhere in the Google Cloud Console, including from the Logs Viewer (Preview), use the project and organization selector:

A project is selected from the drop-down menu

Getting Cloud project or organization ID

To get a Cloud project or organization ID from anywhere in the Google Cloud Console, expand the list of projects from the project and organization selector and find the project ID in the ID column:

The ID for the project is shown

Cannot see log entries

If you don't see any log entries, check the following:

  • Is the correct project selected? If not, select the correct project from the project and organization selector.

  • Is your project using resources that generate logs and is there activity on those resources? Even if the project is new, it should have audit logs recording the fact that it was created. Verify you are using a resource that generates logs, by going to the "Mapping services to resource types" section in the Monitored resource list page.

  • Is the time range too narrow? Verify the time range in your query is correct.

  • View your current exclusion queries to ensure that the logs you are looking for are not accidentally excluded.

My query is correct but I still don't see log entries

  • You cannot see log entries that are older than the Logging retention period. See Logs retention periods for the logs retention period in effect.

  • During periods of heavy load there could be delays in sending logs to Logging or in receiving and displaying the logs.

  • The Logs Viewer doesn't show log entries that have timestamps in the future until the current time has "caught up" with them. This is an unusual situation, probably caused by a time skew in the application sending the logs.

Getting support

For information on getting support, see Google Cloud's operations suite support page.