This document provides you with an overview of the Logs Explorer in the Google Cloud console, which you can use to retrieve, view, and analyze log entries that are stored in log buckets. Viewing and analyzing individual log entries and a sequence of log entries can help you troubleshoot problems. You can also read log data by using the Logging API and the Google Cloud CLI.
To perform aggregate operations on your log entries, like counting the number of log entries that contain a specific pattern, upgrade the log bucket to use Log Analytics, and then run queries from the Log Analytics page of the Google Cloud console. You can continue to use the Logs Explorer to view logs in log buckets that have been upgraded to use Log Analytics. For more information, see Log Analytics overview.
The remainder of this document describes how to use the Logs Explorer.
Before you begin
To get the permissions that you need to use the Logs Explorer to view log entries, ask your administrator to grant you the following IAM roles:
-
To view log entries in the
_Required
bucket and those in the_Default
view on the_Default
bucket, or to select a log scope: Logs Viewer (roles/logging.viewer
) on your project, folder, or organization. -
To view all log entries in the
_Required
and_Default
buckets: Private Logs Viewer (roles/logging.privateLogViewer
) on your project, folder, or organization. -
To view restricted
LogEntry
fields in a log bucket: Logs Field Accessor (roles/logging.fieldAccessor
) on the project, folder, or organization that stores the log bucket. For information about how to restrict access toLogEntry
fields, see Configure field-level access. -
To view log entries stored in a log view on a log bucket:
Logs View Accessor (
roles/logging.viewAccessor
) on the project, folder, or organization that contains the log bucket. For information about how to get access only to a specific log view, see Control access to a log view.
For more information about granting roles, see Manage access.
You might also be able to get the required permissions through custom roles or other predefined roles.
Get started
To begin using the Logs Explorer, do the following:
-
In the Google Cloud console, go to the Logs Explorer page:
If you use the search bar to find this page, then select the result whose subheading is Logging.
Select a Google Cloud project, folder, or organization.
If you use Amazon Web Services Elastic Compute Cloud, then select the AWS connector project that links your AWS account to Google Cloud services.
The log entries displayed by the Logs Explorer page depend on the following:
- The resources searched for log entries.
- The time-range setting.
- Your Identity and Access Management (IAM) roles on the searched resources.
- Your query filters the search results.
For example, adding the query
severity>=ERROR
results in the display listing only those log entries with a severity level of at leastERROR
.
By default, the Logs Explorer page searches the resources listed in the default log scope for log entries. If that scope isn't accessible, then the page searches for the log entries that originate in your selected project, folder, or organization. When a project is selected, the search results include the log entries that are routed to the project by a sink in another project, and then stored in a log bucket.
After the Logs Explorer page opens you can use the Refine Scope button to select which resources are searched. Changes you make by using the Refine Scope button apply only to your current session.
Logs Explorer interface
The Logs Explorer interface lets you display log entries, parse and analyze them, and specify query parameters.
The Logs Explorer contains the following sections, which are detailed on this page:
Action toolbar
Using the Action toolbar features, you can do the following:
- Refine scope: Configure which resources are searched for log entries. Your query filters the search results. For more information, see Refine scope.
- Learn: View links to relevant documentation and topics.
- Share link: Create a shortened URL of the query and
copy it to your clipboard, making it easier to share a query.
The copied URL has the corresponding absolute time range represented by the
time range of your query; for example,
7:49:37 PM - 8:49:37 PM
.
Refine scope
When you open the Logs Explorer page, it fetches the log entries
that originate in the resource you've selected, and
that you have permission to view.
For Google Cloud projects, the fetched
log entries also include those that are routed to the project by a sink
in another project.
If you enter a query, then the Logs Explorer displays only the
fetched log entries which also match the query.
For example, adding the query severity>=ERROR
results in
the display listing only those log entries with a severity level of at
least ERROR
.
For your current session, you can configure which resources the Logs Explorer searches for log entries by using the Refine scope menu. For example, when troubleshooting, you might want to examine only those log entries that are included in a log view or that originate in a specific Google Cloud project.
The Refine scope menu lets you search by the current project, by log view, or by log scope:
To search by the project, folder, or organization that is selected with the project picker, expand the Refine scope menu and select Current project.
For all resources, the search results include the log entries that originate in the resource. For Google Cloud projects, the search results also include the log entries that are routed to the project by a sink in another project.
To search log views, expand the Refine scope menu, select Log view, and then select one or more log views from the menu.
When a project is selected with the project picker, the menu lists the log views on log buckets stored by the selected project. However, when a folder or organization is selected, the menu lists all log views that store log entries that originated in those resources.
To modify the log-view menu to include log views on log buckets stored in a project, click add_circle Import project, and then select the project.
To search the resources included in a log scope, which can include projects and log views, expand the Refine scope menu, select Log scope, and then select a log scope.
If you want to configure your log scopes, then click Manage scopes. For more information, see Create and manage log scopes.
Log scopes are in Public Preview.
Query pane
Use the Query pane features to do any of the following:
Query tab: Build and refine queries using the following features:
Time-range selector: Specify a time range for the log entries that you want to view. For more information, see Use the time-range selector.
Search-text box: Find log entries that match your search terms or phrases. For details, see Search for text across log fields.
Filter menus: Build queries based on Resource, Log name, and Severity. For more information, see Use filter menus.
Query-editor field: Build advanced queries using the Logging query language. For details, see Write advanced queries.
Recent tab: View queries that you have recently run. For more information, see Use recent queries.
Saved tab: View your saved queries and queries that other users of the Google Cloud project have shared with you. For more information, see Save queries and Share queries.
Suggested tab: View suggested queries based on the resources in your Google Cloud project. For more information, see Use suggested queries.
Library tab: View and run Google-provided queries based on your use cases. For more information, see Select queries from the library.
Save: Save queries that can be viewed and run from the Saved tab.
Clear query: Clear and reset the selections you made when building a query in the Query pane.
Stream logs: View log entries as Logging stores them in log buckets. For more information, see Stream logs.
Run query: Run your queries after you have built them in the Query pane.
If you don't see the query-editor field, enable Show query. If you add any search terms in the search-text box, those terms also appear in the query-editor field and are evaluated as part of your query expression.
After you review your query, click Run query. Logs that match your query are listed under the Query results pane. The Histogram and Log fields panes also adjust according to the query expression.
Stream logs
You can stream logs as Logging stores them in log buckets, or you can add a query to stream only those logs that match the query.
To stream logs based on a query, add a query in the Query pane, and then select Stream logs. As Logging stores the logs data in log buckets, only those logs that match the query are shown in the Query results pane. When a query isn't provided, Logging shows each log entry as it's stored.
To stop streaming, click Stop streaming, or scroll within the Query results pane.
Results toolbar
From the Results toolbar, you have the following options:
- toggle_off Logs field: Show or hide the Logs field pane from your Logs Explorer page layout. For more information, see the Logs field pane section of this document.
- toggle_off Histogram: Show or hide the Histogram pane from your Logs Explorer page layout. For more information, see the Histogram section of this document.
- manage_search Analyze results: Aggregate and chart your query results by using Log Analytics. This button is only visible if the scope you selected contains a log bucket that has been upgraded to use Log Analytics. For more information, see the Analyze results section of this document.
- add_chart Create metric: Set up a log-based metric.
- add_alert Create alert: Set up a log-based alerting policy.
- Jump to now: Perform a forced refresh of your query results to include the current time. If the time-range selector uses a custom range and an end time is set, it runs the query with a default time range of one hour. Otherwise, it refreshes with the current start date or duration, and runs the query. Note that the query expression isn't altered when you use this feature.
More actions: Use these further options to manage log-based alerting policies or create a sink.
Analyze results
You can aggregate, analyze, and chart your log data by using SQL queries in the Log Analytics page when your project contains log buckets that are upgraded to use Log Analytics. To go to the Log Analytics page from the Logs Explorer, in the Results toolbar, click manage_search Analyze results.
The manage_search Analyze results button is visible only when the scope you selected contains a log bucket that has been upgraded to use Log Analytics. For example, if you selected Log view by using the Refine scope button, then the manage_search Analyze results button is shown when at least one bucket within the storage scope is upgraded to use Log Analytics. For more information, see Upgrade a log bucket to use Log Analytics.
The following occurs when you click manage_search Analyze results:
The time range in the Logs Explorer might be automatically adjusted so that there is meaningful log data in the Log Analytics page.
The Log Analytics page opens in a new tab and automatically translates the current Logging query language query into a SQL query.
The resource selected by the Google Cloud project picker and the value of the Refine scope setting determine how the
FROM
clause in the SQL query is constructed. The selected resource can be a project, folder, or organization:When the Refine scope menu lists Project, then the resource's
_Required
and_Default
buckets are queried.When the Refine scope menu lists View, then the log views on log buckets in the current project are queried. Log views on log buckets stored by different resources are ignored.
- When the Refine scope setting lists the name of a log scope, then the previous rules are applied to the resources listed in the selected log scope. For example, if the log scope contains log views, then only those log views on log buckets stored by the resource are queried. Log scopes are in Public Preview.
In the Log Analytics page, you can view your results in tabular form, or as a chart. In the Chart tab, you can select the data that is charted, customize the chart configuration, or save a chart to a custom dashboard. For information about creating charts from your query results and saving charts to a custom dashboard, see Chart query results with Log Analytics.
For information about using SQL to write queries, see Query and view logs in Log Analytics.
Log fields pane
The Log fields pane offers a high-level summary of logs data and provides an efficient way to refine a query. The pane shows log entries broken down by different dimensions, corresponding to fields in these entries.
After you execute the query in the query-editor field, the Log fields pane is populated based on the results of the query. This pane displays the counts of log entries for each supported dimension. For each dimension, you can make one selection. The following dimensions are always available:
Resource type
If you use BindPlane to write on-premise and hybrid cloud logs, then select the resource type Generic Node.
Severity
If you want your query to filter by multiple severity levels, then use the Severity menu.
You might see a Service dimension:
If you have logs whose resource type is Kubernetes Container, and if you haven't filtered your logs by resource type, then the Service menu is populated. The entries in this menu are dynamically determined by the values of the resource's
k8s-pod/app
label.For example, if a log entry similar to the following is displayed as a result of your query, then the service menu includes the service named
myservice
:{ ... labels: { compute.googleapis.com/resource_name: "mycluster1" k8s-pod/app: "myservice" k8s-pod/pod-template-hash: "5ffcd94fdd" } logName: "projects/my-project/logs/stdout" resource: { labels: {6} type: "k8s_container" } ... }
If you filter by the resource type of Audited Resource, then the Service menu is populated. The entries in this menu are dynamically determined by the values of the resource's
service
label.
Other dimensions, like Project ID, are listed based on your selections. For example, the Project ID dimension is listed when your query restricts the log entries to those whose resource type is Kubernetes Container, or when you've selected a log view.
Refine your query
To refine your query, select a value from the Log fields pane. For example,
if you select Error in the Severity heading, then the
query pane is updated to include severity=ERROR
.
The following screenshot illustrates the query-editor field after a severity and resource type have been selected by using the Log fields pane:
To remove a selection, click Clear X.
Add fields to Log fields pane
You can add certain LogEntry
key-value pairs to the Logs field
pane from the log entries populated in the Query results pane. For example,
if you frequently filter by the value of the jsonPayload.message
field, then
add it to the Logs field pane.
To add a field to the Logs field pane, do the following:
In the Query results pane, expand a log entry by clicking chevron_right Expand.
Select a field's value. From the menu, select Add field to Log fields pane.
The custom field appears in the Log fields pane as a list of key-value pairs.
To remove a custom field from the Log fields pane, click Remove next to the field.
Note that the following types of fields can't be added to the Log fields pane:
- Fields related to time; for example,
receiveTimestamp
andprotoPayload.startTime
. - Fields with high cardinality; for example,
insertId
andprotoPayload.latency
. - Fields with array indexes in their path; for example,
protoPayload.authorizationInfo[0].resource
.
Histogram
With the Histogram pane, you can visualize the distribution of logs over time. The histogram regenerates when you run a query, making it easier to see trends in your logs data and troubleshoot problems.
To show or hide the Histogram pane, click Histogram in the Results toolbar.
Histogram features
Histogram bars: Each histogram bar represents a time range. Each bar contains a three-color breakdown for the log-severity levels captured in each bar's time range. The colors represent the following log severities:
- Blue: Low severities such as Default, Debug, Info, and Notice.
- Yellow: Medium severities such as Warning.
- Red: High severities such as Error, Critical, Alert, and Emergency.
Each histogram bar features a menu with options to analyze your logs.
Time controls: Let you adjust the time range of the logs you see in the Query results pane. For details on these options, see Analyze logs using time controls.
Timeline: Shows you the time range of the logs, represented by histogram bars, that are displayed within the Query results pane. The timeline helps to orient you to the logs you're viewing within the larger time range of your query.
Analyze logs using time controls
You can use the histogram's time controls to help you investigate and analyze your logs data.
Adjust time quickly
The histogram provides time controls that let you quickly adjust the data that you see in the Logs Explorer.
Time handles: Drag the timeline's handles inward to narrow the data or outward to widen the data in the histogram timeline. Click Run.
Slide the timeline forward and backward: Click chevron_right Forward arrow to slide the timeline to a later time. Click chevron_left Backward arrow to slide the timeline to an earlier time.
Zoom in and out: Click zoom_out Zoom-out to broaden the data shown in the timeline. Click zoom_in Zoom-in to narrow the data shown in the timeline.
Timeline modifications are constrained to be between the current time ("now") and 30 days ago.
Scroll or zoom to time
In addition to the time controls previously listed, the histogram provides the Scroll to time and Zoom to time features to give you more in-depth control of the histogram and the data that you see in other panes in the Logs Explorer.
Perhaps a particular histogram bar interests you based on its relative size or severity levels. You can select that histogram bar to adjust the logs data you see in the Logs Explorer.
You can use the Scroll to time feature to browse your logs data without changing the values in the Histogram and Log fields panes. When you select the Scroll to time feature, the following happens:
The logs data that you see in the Query results pane adjusts according to the time range captured by the selected histogram bar.
The query isn't run, but a partial reload of the data might occur to ensure you're seeing logs in the Query results pane that correspond with the selected histogram bar's time range.
The console URL updates to contain the
timestamp
of the most recent log captured by the time range of the selected histogram bar.
To select the Scroll to time feature, do the following:
Hold the pointer over a bar in the histogram timeline. A pane containing summary information about the logs data for the specified time range appears.
In the pane, select Scroll to time.
Alternatively, clicking on a histogram bar is equivalent to selecting Scroll to time.
The Zoom to time feature is similar to Scroll to time, but it runs a query on your logs data based on the time range captured by a selected histogram bar. When you select the Zoom to time feature, the following happens:
- The logs data that you see in the Query results pane reloads and narrows according to the time-range restriction of the selected histogram bar.
- The console URL updates to contain the
timestamp
of the most recent log captured by the time range of the selected histogram bar. - The histogram changes to show only logs that have a
timestamp
value that falls within the time range of the selected histogram bar. by the selected histogram bar. - The data in the Log fields pane adjusts according to the time range captured by the selected histogram bar.
To select the Zoom to time feature, do the following:
Hold the pointer over a bar in the Histogram timeline. A pane containing summary information about the logs data for the specified time range appears.
In the pane, select Zoom to time.
Query results
To view the results of your queries, use the Query results pane. To help you troubleshoot your applications, you can view the details of individual log entries, and group and analyze log entries to find patterns in your logs.
Configure the Time column
The Time column in the Query results pane displays the timestamps of your log entries. You can customize the Time column so that only certain parts of the timestamp are visible. This creates more horizontal space so that you can view more information in the log entry.
To select which parts of the timestamp to display, click the arrow_drop_down Additional time options menu in the Time column, and then select one of the following options:
Date, time, and timezone
Date and time (default)
Time only
Find patterns in your logs by using summary fields
Suppose you're looking through the log entries in your query results and want to
quickly skim the results by a certain LogEntry
field. Or perhaps
you want to group your log entries by a certain field-value pair. You can add
summary fields to your results, which appear as chips at the beginning of each
log entry line. For example, the following image shows query results with the
summary field resource.type
added to each log entry line:
![The Logs Explorer is showing logs that are preceded with green text displaying
resource types.](https://cloud.google.com/static/logging/docs/images/custom-fields-ui.png?authuser=9)
The Logs Explorer offers default summary fields and custom summary fields.
Default summary fields depend on your current query results, and custom summary
fields let you select any field in the LogEntry
.
To hide summary fields in your query results, use the toggle_off Summary fields toggle. When this toggle is enabled, the results are displayed in raw-text format. By default, the content of each log entry is truncated to fit into one line. To show up to 10 lines for each log entry, use the toggle_off Wrap lines toggle. White spaces are preserved in each log entry.
To hide specific summary fields, enable Summary fields, and then click Hide summary field.
To modify summary fields, do the following:
Click the edit Edit button in the Summary column to open the editing menu.
In the Manage summary fields dialog, you can do the following:
Add any custom field names to Custom summary fields.
The summary field selection has the following features:
- Autocomplete using the logs displayed in your query results.
- Field correction for legal characters within quotes.
For example, if you type
jsonPayload.id-field
, it gets changed tojsonPayload."id-field"
.You can also select any
LogEntry
field, regardless of whether it is suggested to you with the autocomplete function.To remove an existing custom summary field, click the
X
in its chip.Turn truncation on and off for your custom summary fields.
To shorten the display of the summary field values, use the toggle_off toggle next to Truncate custom summary fields. You can choose how many characters to display before the field is truncated, and whether the beginning or the end of the field is displayed.
Hide or show default summary fields:
To customize which default summary fields are shown in your query results, expand the Hide or show default summary fields menu.
Click Apply.
Your summary fields are now updated in your query results.
Search your query results
To search the contents of the Query results, click Find in results in the Query results pane, and then enter your search term. This filter lets you find information in your log entries without building a new query.
Terms that match the search criteria are highlighted in log entries within the Query results pane:
View similar log entries
You can view log entries that are similar to a selected log entry, which lets you focus on logs of interest.
To show similar log entries, do the following:
In the Query results pane, on a log entry, click chevron_right Expand.
Click Similar entries, and select Show similar entries.
The query updates with a query similar to the following and reloads the query results:
--Show similar entries protoPayload.methodName="io.k8s.core.v1.configmaps.update" --End of show similar entries
To see a preview of the similar log entries, do the following:
In the Query results pane, on a log entry, click chevron_right Expand.
Expand the Similar entries menu, and then select Preview similar entries.
A separate dialog opens with the following information:
- The pattern that was found
- The percentage of log entries that contain the pattern
- Example log entries that contain the pattern
In this dialog, you can hide or show log entries:
Hide similar log entries
You can hide similar log entries, which lets you remove logs from your query results.
There are two ways to hide similar log entries:
Hide large amounts of automatically grouped log entries. When you run a query, the query results are analyzed for patterns and log entries are then automatically grouped based on similar log field content.
If a significant pattern is detected, a banner appears in the Query results pane showing the percentage of results that can be hidden:
Hide similar entries: This button adds a clause to the query and reloads the query results.
Preview: A separate window opens which describes the pattern found, and shows examples of the entries.
When you hide similar logs, no information is saved outside of the Logs Explorer session. Each query produces a new analysis, based only on the logs shown. Different queries analyze different portions of the log entries depending on the types of logs returned.
Hide log entries similar to a specific log entry. To hide log entries similar to a log entry, do the following:
On the log entry, click chevron_right Expand, click the Similar entries menu, and then select Hide similar entries.
The query updates and the Query results pane reloads. Log entries similar to the selected log entry aren't displayed.
View or hide log entries that match a field
You can view or hide log entries that match a field in a log entry, which lets you focus on entries that contain the same field content.
To view or hide log entries that match a specific field in a log entry, do the following:
In the Query results pane, on the log entry, click chevron_right Expand.
Click a field's value within the log entry, such as
compute.googleapis.com
, which is aserviceName
.You see the following menu:
Select Show matching entries or Hide matching entries.
The query updates with a query that shows or hides similar entries, and the Query results reload with new results.
Pin log entries
After you run a query, you can highlight a log entry by pinning it. The pinned log entry stays centered in the Query results pane. If you run a new query and the pinned log entry isn't included, then you are prompted to unpin the log entry.
To pin a log entry, do the following:
- Hold the pointer over the log entry that you want to pin.
- Click push_pin Pin.
After you pin a log entry, its background is darkened, and a
push_pin Pin icon is shown. A pin icon
also appears on the Histogram pane based on the pinned log entry's
timestamp
:
To unpin a log entry, click the pin icon again.
Show logs that match the resource of a pinned log entry
After you pin a log entry, you can run a new query that displays log entries that match the resource type or resource labels of the pinned log.
To pin a log entry and display log entries that match the same resource type or resource labels, do the following:
Click arrow_drop_down Down arrow next to the pinned log to expand the pin menu.
Make a selection from the pin menu:
To rerun the query with the same
resource.type
as the pinned log, select Same resource.type.For example, suppose you pin a log entry with a
resource.type
ofk8s_node
. If you select Same resource.type, then the query is rerun to display all log entries withresource.type="k8s_node"
.To rerun the query with the same
resource.labels
as the pinned log, select Same resource.labels.
- To rerun the query with the same
trace
as the pinned log, select Same trace.
- To clear the query and show all log entries, select Show all.
View a pinned log entry in the Histogram pane
You can use the Histogram pane to highlight, scroll to, and further examine a pinned log entry.
Using the Histogram pane, click push_pin Pin, and then choose from the following menu options:
- Scroll to log entry: Bring the log entry into the current Query results pane and view the pinned log entry in the context of nearby logs.
- Zoom to log entry: Narrow the time range that the Histogram pane displays and refine your query to isolate the logs near the pinned log.
View trace data
When a log entry contains both the trace
and the latency-related field, both
the latency and trace icon appear.
When a log entry contains only the trace
field, then only the trace icon appears.
To view the trace data related to the log entry, click the trace icon. You have the following options:
- View trace details: Shows the parent span and child traces along with details about the trace. To view more details about the trace, navigate to Cloud Trace by clicking View in Trace. For more information about the content in the details panel, see Find and explore traces.
Show all logs for this trace: Refines and runs the query by adding the
trace
field set to the identifier of the trace associated with the log entry.Show only traced requests: Refines and runs the query by adding the
traceSampled
field set toTrue
. For more information on sampling, see Sampling rate.
Copy a link to a log entry
To share a link to a log, expand a log entry, and then select Copy link. The link is copied to your clipboard. You can send the link to users who have access to the Google Cloud project. When a user pastes the link into a browser or selects it, Logging pins the log entry in their Query results pane.
![Copy link to share log entry with others.](https://cloud.google.com/static/logging/docs/images/copy-link.png?authuser=9)
Download logs
You can download your logs in CSV or JSON format. You need one of the following Identity and Access Management roles to download logs:
- Logging Admin (
roles/logging.admin
) - Logs View Accessor (
roles/logging.viewAccessor
)
To download your logs, do the following:
Click save_alt Download in the toolbar for the Query results pane.
In the Download logs dialog, select CSV or JSON format, and then click Download.
Select what to do with the log data. You have the following options:
- Download the data to your computer.
- Download the data to Google Drive.
- View the data in a new tab.
When you save a CSV and select Google Drive, you can open the file in Google Sheets.
For troubleshooting information, see Download of logs fails.
Example queries
For suggested queries, arranged by Google Cloud product and use case, see Sample queries using the Logs Explorer. For example, you can run Kubernetes-related queries to find Google Kubernetes Engine logs.
View Compute Engine logs
For certain Compute Engine resource types, such as gce_instance
and
gce_network
, you see the resource name with the resource ID as subtext in
several places in the Logs Explorer. For example, for the gce_instance
resource type, you see the VM name alongside the VM ID. The resource names help
you identify the correct resource ID, on which you can build queries.
You might see Compute Engine resource names in the following places:
- Query pane filter menus: Compute Engine resource types show resource names, with their corresponding resource IDs as subtext.
- Log fields: Compute Engine resource types show the resource name, rather than the resource ID, in the field dimensions.
- Query results: For Compute Engine VM instance logs, the
resource.labels
field shows metadata with the corresponding resource name. - Summary fields: For Compute Engine VM instance logs, the chip shows the resource name instead of the resource ID.
Troubleshoot
This section provides instructions for troubleshooting common issues when using the Logs Explorer.
If you're experiencing issues when trying to view logs in sink destinations, see Troubleshoot routing and sinks.
Download of logs fails
You are using the Logs Explorer and click save_alt Download. The command starts but then fails to complete or reports an error.
To resolve this issue, reduce the time it takes for the command to execute by trying the following:
- In the Download logs dialog, reduce the value of Maximum log entries.
- Reduce the time period over which logs are queried.
- In the query results toolbar, click Hide similar entries before you begin the download.
- Modify your query to use indexed fields.
Can't find console logs for a VM instance
Logs written to the console of a Compute Engine instance might not be available in the Logs Explorer. To view these logs, do the following:
-
In the Google Cloud console, go to the VM instances page:
If you use the search bar to find this page, then select the result whose subheading is Compute Engine.
Select the instance, and then select Serial port 1 (console) in the Logs section of the page.
You can configure your instances such that their serial port output is sent to Cloud Logging. For more information, see Enabling and disabling serial port output logging.
Get Google Cloud project or organization ID
To get a Google Cloud project or organization ID from anywhere in the Google Cloud console, expand the list of Google Cloud projects from the Google Cloud project and organization selector and find the Google Cloud project ID in the ID column.
Can't see log entries
If you don't see any log entries, check the following:
Verify that the correct Google Cloud project is selected.
Verify that your Google Cloud project is using resources that generate logs and that there is activity on those resources. Even if the Google Cloud project is new, it should have audit logs recording the fact that it was created. Verify you're using a resource that generates logs, by going to the "Mapping services to resource types" section in the Monitored resource list page.
Ensure that the time range isn't too narrow.
View your current exclusion queries to ensure that the logs you're looking for aren't accidentally excluded.
Ensure that you have permission to view the log entries in the projects and log views referenced by setting of the Refine scope menu. For information about how to adjust the scope of your search, see Refine scope.
My query is correct but I still don't see log entries
You can't see log entries that are older than the Logging retention period. See Log retention periods for the logs retention period in effect.
During periods of heavy load, there could be delays in sending logs to Logging or in receiving and displaying the logs.
The Logs Explorer doesn't show log entries that have timestamps in the future until the current time has "caught up" with them. This is an unusual situation, probably caused by a time skew in the application sending the logs.
The query scope was set too large and couldn't complete within a reasonable amount of time. You might see this as "deadline expired before operation could complete". Try making your query more specific or reducing the time range.
Query returns an error
If you issue a query over a resource without specifying a bucket, then
Cloud Logging uses the history of the sinks in the Google Cloud project to
determine where entries might have been written for that resource. If
Cloud Logging identifies more than 200 buckets where entries
might have been written, then the query fails with the message
Error: Invalid query
.
To resolve this issue, refine the scope of your query to a subset of the storage. For more information, see Refine scope.
Query results time range doesn't match query
The logs data you see in the Query results and Log fields panes adjusts according to the time range captured by the histogram timeline. You adjust the histogram timeline using the histogram's time controls or the time-range selector. Adjusting these time controls doesn't alter the query expression in the Query pane.
When you have a query with a timestamp, the time-range selector is disabled. The query uses the timestamp expression as its time-range restriction. If a query doesn't use a timestamp expression, then the query uses the time-range selector as its time-range restriction.
Get support
For information on getting support, see the Google Cloud Observability support page.