Viewing Logs (v1)

This guide shows you how to search logs and view log entries with the Logs Viewer. To export your log entries, see Exporting Logs. To read log entries through the API, see entries.list. To read log entries using the SDK, see Reading log entries.

Before you begin

  1. Sign in to your Google account.

    If you don't already have one, sign up for a new account.

  2. Select or create a Cloud Platform project.

    Go to the Manage resources page

  3. Enable billing for your project.

    Enable billing

  4. Go to the Logs Viewer in the Cloud Platform Console:
  5. Go to the Logs Viewer page

  6. Using the drop-down menus, select the logs you want to view. If you do not see any logs in the Logs Viewer, then go through the Quickstart to get some logs into your project.

Understand the logs viewer interface

The following screenshot shows the Logs Viewer's basic filter interface. Three Google Compute Engine log entries are shown. The third entry has been expanded by selecting its expander arrow (▸).

Logs Viewer

The Logs Viewer interface has the following major components:

  1. The window tabs let you choose Logs, Metrics (see Logs-based metrics), or Exports (see Exporting logs).
  2. The search bar lets you filter log entries by label or text search. The basic filter is shown, and the menu at the end (▾) switches to the advanced logs filter interface. The bar-graph icon is used to create logs-based metrics.
  3. The logs selector is a set of cascading menus that let you choose which logs and entries to display.
  4. The date selector, to the right of the menus, shows the date of the displayed log entries and lets you scroll the entries to a different date and time.
  5. The streaming selector, to the right of the date selector, controls whether new log entries are displayed as they arrive.
  6. The View Options menu, at the far right, has additional display options.
  7. The expander arrow (▸) opens up a log entry.

Scroll and stream logs

When you first look at the Logs Viewer, you see the most recent available log entries plus enough older entries to fill the screen. When you scroll through your log entries, the Logs Viewer fetches additional entries, if available. A yellow bar appears above the topmost log entry and below the bottommost log entry to let you know if more log entries might be available.

By using the View Options menu, you can have the newest log entries added at the top or the bottom. In the following screenshot, the view options are set to put the newest log entries at the top of the screen:

Scroll

The button showing the play ▶ or pause ▐▐ icons controls whether to start or stop the streaming of new log entries into the viewer. Streaming stops when you scroll through log entries, when you select a log entry, and when your computer is locked or sleeping. Clicking the refresh icon (Show newest logs) retrieves new log entries without streaming. The following screenshot shows the pause and refresh controls:

Scroll

The following messages can appear in the yellow bars at the top and bottom of your log entries:

  • "Scanned up to...": Shows the local date and time of the most recent log entry. The log entries themselves contain timestamps in UTC (Zulu) time.
  • "Loading...": The Logs Viewer is attempting to fetch additional log entries.
  • "No new entries found...": There are no newer log entries than those shown.
  • "No older entries found...": There are no older log entries than those shown.
  • "Waiting for more.": The Logs Viewer is streaming new log entries and will show them when they are available.
  • "...matching the current filter.": This phrase appears whether or not you use a filter. If you use an advanced logs filter, the filter may limit the entries shown to a particular time period.

If the yellow bars contain no messages, scroll the display slightly to refresh their status.

Expand log entries

The Logs Viewer displays a summary line for each log entry by default. To see the full log entry, click the expander arrow (▸) for a structured view of the log entry.

Except for their individual payloads, all log entries in Stackdriver Logging have a common structure. Using the nested expander arrows, you can see all the fields in each log entry. If the log entry's payload is also structured, then you can see all the payload fields, too.

The following screenshot shows the structured view of a log entry. The log entry's payload is in the unexpanded protoPayload field:

Structured request log entry

Show similar log entries

You can select the value of an individual field in the expanded log entry view, and then either show or hide all log entries with the same value.

For example, the previous App Engine request log screenshot shows a log entry containing the field metadata.zone:"us3". Selecting that field and then selecting Show similar entries creates and runs the following advanced logs filter, which displays only App Engine log entries whose metadata.zone field is "us3":

metadata.serviceName="appengine.googleapis.com"
log="appengine.googleapis.com/request_log"
metadata.zone="us3"

Selecting Hide similar entries will show all entries except those with the same value in the selected field.

Tip: You can edit the advanced filter to modify your query. For example, if you want to show request log entries from any us zone, then change the last line of the filter in the previous screenshot to be:

metadata.zone : "us"

Select Submit Filter to see the results. See Advanced Logs Filters for more details about these filters.

Search and filter logs

This section describes the basic logs filter provided by the Logs Viewer. The basic filter lets you drill down into your logs in several ways:

  • Select which logs you want to see.
  • Include log entries that contain specific text.
  • Move to a certain date and time in the log stream.
  • Search log entries for specific label values, if available for your log type.

Although the basic logs filter is easy to use, you may find it difficult or impossible to express complex filter conditions. In that case, see the following section, Using advanced logs filters, for an alternative way to filter your logs.

Select the logs you want to see

Use the drop-down menus of the logs selector to choose the logs and instances you want to see. Use the first menu to select App Engine or Compute Engine as your logs source, and then drill down to individual instances and modules.

If you select App Engine as the source of your logs, you will see the following menus:

Logs Viewer for App Engine

  1. Select your application module and version in the menus.
  2. Use the log level menu to select a minimum severity of log entries. For example, selecting Warning will show log entries of severity Warning, Error, and Critical. Some log entries do not have an assigned severity, and you will see them only if you search for Any log level.

If you select Compute Engine as the source of your logs, you will see the following menus:

Logs Viewer for Compute Engine

  1. Select a resource type and resource ID in the menus.
  2. Use the logs menu to select a specific log type from the list, or All logs.
  3. Use the log level menu to select a minimum severity of log entries. For example, selecting Warning will show log entries of severity Warning, Error, and Critical. Some log entries do not have an assigned severity, and you will see them only if you search for Any log level.

Search by date and time

To search for log entries by date and time, use the date selector in the menu bar. Selecting a date and time will scroll the log display to that place in the log stream. See the Quota Policy to learn how long log entries are held in Stackdriver Logging.

You can also use text search to find a specific date listed in the log entries.

Search log field labels

Searching with field labels

The Google App Engine request log separates its information into labeled fields, and you can filter log entries based on the values of those fields. For example, in the preceding screenshot you see a number-range search on the status label.

To enter a field filter in the search box, type the following:

  1. Type the name of the field label followed by a colon. As you type, you might see suggestions for label names. Choose a suggestion or press ENTER to accept the topmost suggestion. If you do not see suggestions other than text:, then your entry is classified as a generic text search. See the following section, Search Log Text, for more information.

  2. Type the value you are searching for in the field, and press ENTER.

    • If you type a number, as in bytes:72, the search matches entries whose field value equals that number.
    • If you type a range, as in status:100..199, the search matches entries whose field value lies in that range.
    • If you type text with or without quotation marks, as in path:"hello" or path:hello, the search matches entries whose field contains that text, ignoring letter case. If the text contains spaces or special characters, you should use quotations.
  3. Add more field searches. If your search has two or more different fields, the search matches entries whose fields match both of your searches. If your search has two or more values for the same field, the search matches entries whose field has either of the specified values.

Example

The App Engine request log includes (among others) the fields status and useragent. Following are some queries you can make on the request log:

status:404
View only log entries with an HTTP status of 404.
status:400..499
View log entries with any status in the HTTP 400 status range.
status:404 status:405
View log entries with status 404 or 405.
status: 404 useragent:"Google"
View log entries that have a status of 404, and a user agent containing the string Google. The user agent search would match Google, googlecomputeengine, The Google Cloud Platform, etc.

See Request log fields for a complete list of fields in the request log.

Search log text

You can filter log entries by supplying a text string that must appear somewhere in the log entry but not in any specific field. You can use text search combined with field searches described in the previous section, or you can use text search alone.

To use text search, type in the search box the string text: followed by a quoted or unquoted text string, or simply type some quoted or unquoted text, and press ENTER. If your text contains spaces or special characters, you should use quotations.

The search will match log entries whose expanded text contains the specified string, in any letter case. Expanded text is the text you see when you select the expander arrow on the log entry in the Logs Viewer. Like field search, if you type two or more text searches, you get log entries that match either text search.

Use advanced logs filters

The Logs Viewer filtering interface that includes the log selector menus and the search bar is the basic logs filter. There is also an advanced logs filter that you can use to filter log entries. As an example of its benefits, only the advanced logs filter can select log entries from multiple log services. See Advanced Logs Filters to learn how to write the advanced filters.

Switch from basic to advanced filters

To use advanced filters in the Logs Viewer, select the menu (▾) at the end of the search bar and choose Convert to advanced filter:

Create an advanced filter

The advanced filter appears in place of the basic filter, preconfigured with the search that was specified in the menus and the search box of the basic filter. Advanced filters in the Logs Viewer use the v1 log entry format:

An advanced logs filter

You can now edit the advanced filter. When you are finished, select Submit Filter or press CTRL+ENTER. The Logs Viewer displays the log entries matching your filter. If you have been using the Logs Viewer's basic filters, see Differences between basic and advanced filters before you start writing your own advanced filters.

You can copy the advanced filter text and save it in a document to use again.

Switch from advanced to basic filters

To return to the basic filter, do one of the following:

  • Select your browser's Go back function until you see the basic filter. The basic filter will be configured as it was before you switched to the advanced filter.

  • At the end of the advanced filter text box, select the menu (▾) and choose Clear filters and return to basic mode. This reverts the basic filter to its default settings.

In both cases, you lose any changes you made in the advanced filter.

Write effective advanced filters

Search expressions are different in basic filters and advanced filters. The Log Viewer's Convert to advanced filter command correctly translates basic filter expressions to advanced filter expressions. However, if you enter the advanced filter manually, you might use a basic filter expression by mistake.

Don't use "text:" in advanced filters

The Logs Viewer shows text searches in the basic filter by prefixing the text with the label text:. The text: label must not be used with advanced filters. The following table shows equivalent text searches:

Logs Viewer basic filter Advanced logs filter with the same meaning
text:"one two" "one two"
text:three "three" or three
text:n=5 "n=5"

If you accidentally use text: in the advanced filter, you will be searching for a match in a field called text, which doesn't exist.

Don't use Logs Viewer field names in advanced filters

The Logs Viewer basic filter has built-in field names for certain logs, including the App Engine request log. Those field names do not exist in advanced filters. For example, the following table shows an equivalent field search for an App Engine request log:

Logs Viewer basic filter Advanced logs filter with the same meaning
querystring:var=3 protoPayload.resource:"var=3"

If you accidentally use the basic filter field name, you will be searching in a field named querystring, which doesn't exist.

Choose between exact and substring matches

In Logs Viewer's basic filters, all searches are case-insensitive and they look only for substrings. That is, the searches text:abc and somefieldname:abc will match log entries containing abc, xyabcyx, and ABc. In advanced log filters, you should use the "has" search operator (:) for the same behavior.

The advanced logs filter expression field=abc requires that field contain exactly abc, in any letter case. That type of search cannot be expressed in basic filters.

Be careful with AND and OR

In the basic filter, two comparisons using the same field label name are implicitly joined with OR, whereas comparisons with different labels are joined by AND. This also applies to comparisons using the label text:. In advanced filters, all comparisons are joined by AND unless OR is specified explicitly. The following table shows equivalent searches in the two filters:

Logs Viewer basic filter Advanced logs filter with the same meaning
text:abc querystring:def text:xyz protoPayload.resource:"def" AND ("abc" OR "xyz")

If you write comparisons in an advanced filter as if they were in a basic filter, your search will return different log entries or no entries at all.

What's next

Monitor your resources on the go

Get the Google Cloud Console app to help you manage your projects.

Send feedback about...

Stackdriver Logging