gcloud alpha logging tail

NAME: gcloud alpha logging tail - tail log entries
SYNOPSIS: gcloud alpha logging tail [LOG_FILTER] [--buffer-window=BUFFER_WINDOW] [--billing-account=BILLING_ACCOUNT_ID | --folder=FOLDER_ID | --organization=ORGANIZATION_ID | --project=PROJECT_ID] [--bucket=BUCKET --location=LOCATION --view=VIEW] [GCLOUD_WIDE_FLAG …]
DESCRIPTION: (ALPHA) gcloud alpha logging tail streams newly received log entries. Log entries matching log-filter are returned in the order that Cloud Logging received them. If the log entries come from multiple logs, then entries from different logs might be mixed in the results. To help return log entries in order, use --buffer-window.
Before you can use gcloud alpha logging tail, you must complete the installation instructions at Live tailing log entries.
For the quotas and limits associated with gcloud alpha logging tail, see Logging API quotas and limits.
EXAMPLES: To stream log entries from Google Compute Engine instances, run:
gcloud alpha logging tail "resource.type=gce_instance"

To stream log entries with severity ERROR or higher, run:
gcloud alpha logging tail "severity>=ERROR"

To stream log entries with severity ERROR but only output the timestamps and instance IDs, run:
gcloud alpha logging tail "severity>=ERROR" --format="default(timestamp,resource["labels"]["instance_id"])"

To stream with minimal latency but potentially incorrect ordering:
gcloud alpha logging tail "resource.type=gce_instance" --buffer-window=0s

To stream log entries in your project's syslog log from Compute Engine instances containing payloads that include the word SyncAddress and format the output in JSON format, run:
gcloud alpha logging tail "resource.type=gce_instance AND log_id(syslog) AND textPayload:SyncAddress" --format=json

To stream log entries from a folder, run:
gcloud alpha logging tail "resource.type=global" --folder=[FOLDER_ID]

Detailed information about filters can be found at: https://cloud.google.com/logging/docs/view/logging-query-language
POSITIONAL ARGUMENTS: [LOG_FILTER]

Filter expression that specifies the log entries to return. A detailed guide on the Logging query language can be found at: https://cloud.google.com/logging/docs/view/logging-query-language.
FLAGS: --buffer-window=BUFFER_WINDOW

The duration of time for which entries should be buffered for ordering before being returned. A longer buffer window helps to return logs in chronological order, but it also increases the latency from when entries are received by Cloud Logging to when they are returned. If unset, Cloud Logging will use 2s by default.

At most one of these can be specified:

--billing-account=BILLING_ACCOUNT_ID

Billing account of the log entries to tail.

--folder=FOLDER_ID

Folder of the log entries to tail.

--organization=ORGANIZATION_ID

Organization of the log entries to tail.

--project=PROJECT_ID

Project of the log entries to tail.
The Google Cloud project ID to use for this invocation. If omitted, then the current project is assumed; the current project can be listed using gcloud config list --format='text(core.project)' and can be set using gcloud config set project PROJECTID.
--project and its fallback core/project property play two roles in the invocation. It specifies the project of the resource to operate on. It also specifies the project for API enablement check, quota, and billing. To specify a different project for quota and billing, use --billing-project or billing/quota_project property.

These arguments are used in conjunction with the parent to construct a view resource.

--bucket=BUCKET

Id of the bucket. If this argument is provided, then --location and --view must also be specified.
This flag argument must be specified if any of the other arguments in this group are specified.

--location=LOCATION

Location of the bucket. If this argument is provided, then --bucket and --view must also be specified.
This flag argument must be specified if any of the other arguments in this group are specified.

--view=VIEW

Id of the view. If this argument is provided, then --location and --bucket must also be specified.
This flag argument must be specified if any of the other arguments in this group are specified.
GCLOUD WIDE FLAGS: These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.
Run $ gcloud help for details.
NOTES: This command is currently in alpha and might change without notice. If this command fails with API permission errors despite specifying the correct project, you might be trying to access an API with an invitation-only early access allowlist. This variant is also available:
gcloud beta logging tail