Configure log-based alerts

Stay organized with collections Save and categorize content based on your preferences.

You can use log-based alerts to notify you when Network Analyzer detects specific insights. Examples for Network Analyzer insights include the following:

  • View all the insights on GKE cluster-related issues
  • View all high priority insights
  • View all load balancer firewall health check issues
  • View all insights in the region us-central1

Network Analyzer logs are part of the Google Cloud platform logs. The log names are in the following format:

projects/{project-id}/logs/networkanalyzer.googleapis.com%2Fanalyzer_reports

You can find the log ID, monitored resource, and the payload proto details in the Network Analyzer logs API. By default, the logs are routed to the default log bucket.

Create log queries

You can use the Logging query language to query and filter Cloud Logging data. For more information, see Logging query language. Following are some examples of log queries for specific Network Analyzer insights:

  • Example: The following query returns the insights on all GKE cluster-related issues:

    LOG_ID("networkanalyzer.googleapis.com%2Fanalyzer_reports")
    jsonPayload.resourceName=~"^//container.googleapis.com/projects/.+/clusters/"
    
  • Example: The following query returns all high priority insights:

    LOG_ID("networkanalyzer.googleapis.com%2Fanalyzer_reports")
    jsonPayload.priority="HIGH"
    
  • Example: The following query returns all insights that belong to either of the two specific Load Balancer Health Check insight types:

    (jsonPayload.causeCode="LOAD_BALANCER_HEALTH_CHECK_FIREWALL_HEALTH_CHECK_RANGE_BLOCKED" OR
    jsonPayload.causeCode="LOAD_BALANCER_HEALTH_CHECK_FIREWALL_HEALTH_CHECK_FIREWALL_NOT_CONFIGURED"
    )
    
  • Example: The following query returns all insights with location us-central1:

    LOG_ID("networkanalyzer.googleapis.com%2Fanalyzer_reports")
    jsonPayload.location="us-central1"
    
  • Example: The following query returns all insights that belong to the hybrid connectivity category:

    LOG_ID("networkanalyzer.googleapis.com%2Fanalyzer_reports")
    jsonPayload.reportGroups="HYBRID_CONNECTIVITY"
    

Set up log-based alerts

You can use the log queries to set up log-based alerts to notify you when the matching insights are discovered by Network Analyzer. You can create log-based alerts from the Logs Explorer in the Google Cloud console or by using the Cloud Monitoring API.

Configure log-based alerts for organizations, folders, and metrics scopes

To route logs of multiple projects to a single destination project, see Route logs between log buckets in different Cloud projects. You can then configure alerts in the destination project.

Export logs to a third-party platform

You can configure a customized log sink to export logs to Cloud Storage, BigQuery, Pub/Sub, and third-party platforms. For more information, see Configure and manage sinks.

Enable or disable logging

To enable the Cloud Logging API, see Enable the Logging API. To access the logs data in the Logging API, the Logs Explorer, and the Google Cloud CLI, you must grant the required Identity and Access Management (IAM) roles and permissions. For more information, see Access control with IAM.

To disable Network Analyzer logs for a project, you can configure an exclusion filter to filter out Network Analyzer logs for the project.