# Google Cloud Logging Configuration and Query Syntax Examples > Master Google Cloud Logging with configuration and query syntax examples. Learn to use gcloud logging read commands with logName, resource type, and jsonPayload filters for efficient log analysis. - Repository: [Google/skills](https://github.com/google/skills) - Tags: how-to-guide - Published: 2026-08-13 --- **Google Cloud Logging provides a unified platform for ingesting, storing, and querying log data using `gcloud logging read` commands that combine `logName`, `resource.type`, and `jsonPayload` filter expressions.** The `google/skills` repository contains authoritative skill guides that demonstrate how to build centralized logging foundations, configure cross-project log routing, and execute targeted queries for security analysis. This article distills those production patterns into actionable configuration steps and query syntax examples. ## Centralized Logging Architecture A robust Google Cloud logging deployment relies on four core components that separate storage from access and routing. **Central Log Projects** act as dedicated aggregation points (e.g., `logging-[SUFFIX]`) hosting global or regional log buckets. According to the foundation builder reference at [`/skills/cloud/google-cloud-recipe-foundation-builder/references/logging-monitoring.md`](https://github.com/google/skills/blob/main//skills/cloud/google-cloud-recipe-foundation-builder/references/logging-monitoring.md) (lines 9-15), these projects collect audit logs, VPC Flow logs, and firewall logs under a single retention policy. **Log Buckets** serve as logical containers for log storage. As defined in [`/skills/cloud/cloud-logging-configuration-basics/SKILL.md`](https://github.com/google/skills/blob/main//skills/cloud/cloud-logging-configuration-basics/SKILL.md) (lines 4-13), buckets can be global (default) or regional to satisfy data residency requirements and reduce query latency. **Log Sinks** route logs from source projects, folders, or organizations into central buckets. The sink creation process documented in [`/skills/cloud/google-cloud-recipe-foundation-builder/references/logging-monitoring.md`](https://github.com/google/skills/blob/main//skills/cloud/google-cloud-recipe-foundation-builder/references/logging-monitoring.md) (lines 28-34) uses `gcloud logging sinks create` with filters to select specific log types. **Log Views** provide fine-grained access control over bucket contents. The configuration basics guide at [`/skills/cloud/cloud-logging-configuration-basics/SKILL.md`](https://github.com/google/skills/blob/main//skills/cloud/cloud-logging-configuration-basics/SKILL.md) (lines 180-207) demonstrates creating views like "security-logs-view" that restrict visibility to Cloud Audit logs only. ## Configuring Log Buckets and Sinks Establishing a centralized pipeline requires creating the bucket first, then configuring sinks with appropriate IAM permissions. ### Create a Central Log Bucket Create a global bucket with a defined retention period to store aggregated logs: ```bash gcloud logging buckets create myorg-logging \ --project=logging-01 \ --location=global \ --description="Central log bucket" \ --retention-days=30 ``` This command matches the pattern found in [`/skills/cloud/google-cloud-recipe-foundation-builder/references/logging-monitoring.md`](https://github.com/google/skills/blob/main//skills/cloud/google-cloud-recipe-foundation-builder/references/logging-monitoring.md) (lines 9-15), where the bucket location determines latency characteristics and compliance boundaries. ### Configure Log Sinks Route logs from source projects to the central bucket using filter expressions: ```bash gcloud logging sinks create audit-sink \ logging.googleapis.com/projects/logging-01/locations/global/buckets/myorg-logging \ --project=my-target-project \ --filter='logName:"logs/cloudaudit.googleapis.com%2Factivity"' ``` ### Grant IAM Roles The sink's service account requires specific permissions to write to the destination bucket. As detailed in [`/skills/cloud/google-cloud-recipe-foundation-builder/references/admin-iam.md`](https://github.com/google/skills/blob/main//skills/cloud/google-cloud-recipe-foundation-builder/references/admin-iam.md) (lines 67-81), assign `roles/logging.admin` or more restrictive viewer roles to the sink's unique service account. ### Define Log Views (Optional) Create restricted views for security teams to limit exposure: ```bash gcloud logging views create security-logs-view \ --bucket=myorg-logging \ --filter='protoPayload.serviceName="compute.googleapis.com" AND severity>=ERROR' ``` ## Query Syntax Fundamentals The `gcloud logging read` command retrieves log entries using a query language that supports Boolean logic, regular expressions, and time-range selectors. Query execution targets the log entries stored in specific projects or buckets. Key syntax elements include: - **Field selectors**: `logName`, `resource.type`, `jsonPayload.field_name` - **Logical operators**: `AND`, `OR`, `NOT` - **Comparison operators**: `=`, `!=`, `<`, `>`, `<=`, `>=`, `:`, `=~` - **Time modifiers**: `--freshness` flag or timestamp comparisons ## Common Query Patterns for Network and Security Analysis The following examples demonstrate production queries for investigating VPC flows, firewall events, and threats. ### Query VPC Flow Logs Retrieve recent VPC flow entries for subnet analysis using the pattern from [`/skills/cloud/google-cloud-networking-observability/references/vpc-flow-analysis.md`](https://github.com/google/skills/blob/main//skills/cloud/google-cloud-networking-observability/references/vpc-flow-analysis.md) (line 57): ```bash gcloud logging read \ '(logName:"projects/${PROJECT_ID}/logs/compute.googleapis.com%2Fvpc_flows" OR \ logName:"projects/${PROJECT_ID}/logs/networkmanagement.googleapis.com%2Fvpc_flows") \ AND resource.type="gce_subnetwork"' \ --project ${PROJECT_ID} \ --limit 10 \ --format json \ --quiet ``` ### Filter High-Severity Threat Alerts Identify denied high-severity firewall threats as documented in [`/skills/cloud/google-cloud-networking-observability/references/threat-analysis.md`](https://github.com/google/skills/blob/main//skills/cloud/google-cloud-networking-observability/references/threat-analysis.md) (line 92): ```bash gcloud logging read \ 'logName:("projects/${PROJECT_ID}/logs/networksecurity.googleapis.com%2Ffirewall_threat" OR \ "projects/${PROJECT_ID}/logs/ids.googleapis.com%2Fthreat") \ AND jsonPayload.threatDetails.severity=("HIGH" OR "CRITICAL") \ AND jsonPayload.action="DENY"' \ --project ${PROJECT_ID} \ --limit 10 \ --format json \ --quiet ``` ### Inspect Firewall Deny Rules List firewall events where traffic was explicitly denied, referencing [`/skills/cloud/google-cloud-networking-observability/references/firewall-analysis.md`](https://github.com/google/skills/blob/main//skills/cloud/google-cloud-networking-observability/references/firewall-analysis.md) (line 65): ```bash gcloud logging read \ 'resource.type="gce_subnetwork" AND \ logName="projects/${PROJECT_ID}/logs/compute.googleapis.com%2Ffirewall" AND \ jsonPayload.rule_details.action="DENY"' \ --project ${PROJECT_ID} \ --limit 10 \ --format json \ --quiet ``` ### Explore NAT Drops Filter Cloud NAT flow logs for dropped packets per [`/skills/cloud/google-cloud-networking-observability/references/cloud-nat-analysis.md`](https://github.com/google/skills/blob/main//skills/cloud/google-cloud-networking-observability/references/cloud-nat-analysis.md) (line 56): ```bash gcloud logging read \ 'resource.type="nat_gateway" AND \ logName="projects/${PROJECT_ID}/logs/compute.googleapis.com%2Fnat_flows" AND \ jsonPayload.allocation_status="DROPPED"' \ --project ${PROJECT_ID} \ --limit 10 \ --format json \ --quiet ``` ### Query Cloud Run Revision Logs Retrieve error-level logs for serverless applications as shown in [`/skills/cloud/cloud-run-basics/SKILL.md`](https://github.com/google/skills/blob/main//skills/cloud/cloud-run-basics/SKILL.md) (line 352): ```bash gcloud logging read \ "resource.type=cloud_run_revision AND jsonPayload.message:\"ERROR\"" \ --project ${PROJECT_ID} \ --limit 20 ``` ### Cross-Project Log Reading Access logs from source projects through a central logging project using the pattern in [`/skills/cloud/cloud-logging-cross-project-configuration/SKILL.md`](https://github.com/google/skills/blob/main//skills/cloud/cloud-logging-cross-project-configuration/SKILL.md) (line 310): ```bash gcloud logging read \ 'logName:"projects/${SOURCE_PROJECT_ID}/logs/${TEST_LOG_ID}"' \ --project ${CENTRAL_LOG_PROJECT} ``` ## Summary - **Centralized architecture** uses dedicated log projects, buckets, sinks, and views to aggregate data across organizational boundaries. - **Bucket configuration** determines retention periods (via `--retention-days`) and geographical placement (global vs. regional) for compliance. - **Sink filters** control which log types flow into central storage, using expressions like `resource.type="gce_subnetwork"` to limit volume. - **Query syntax** leverages `gcloud logging read` with Boolean combinations of `logName`, `jsonPayload`, and `resource` fields. - **Security queries** target specific indicators such as `jsonPayload.threatDetails.severity` or `jsonPayload.allocation_status="DROPPED"` for threat hunting and debugging. ## Frequently Asked Questions ### What is the difference between a log bucket and a log sink? A **log bucket** is a storage container that holds log entries for a specified retention period, while a **log sink** is a routing rule that directs matching log entries from a source (project, folder, or organization) to a destination bucket. As implemented in `google/skills`, sinks use filter expressions to select which logs enter centralized buckets. ### How do I query logs across multiple Google Cloud projects? Configure a **central log bucket** in a dedicated logging project, then create **log sinks** in each source project targeting that bucket. Use `gcloud logging read` against the central project while specifying the original source project in the `logName` filter, as demonstrated in [`/skills/cloud/cloud-logging-cross-project-configuration/SKILL.md`](https://github.com/google/skills/blob/main//skills/cloud/cloud-logging-cross-project-configuration/SKILL.md) (line 310). ### What filter syntax retrieves only high-severity firewall deny events? Combine the `jsonPayload.action` field with severity selectors: `jsonPayload.rule_details.action="DENY"` for standard firewall rules or `jsonPayload.threatDetails.severity=("HIGH" OR "CRITICAL")` for threat detection logs. The exact syntax varies by log type and is documented in the networking observability references within `google/skills`. ### Can I restrict which logs users see without creating separate buckets? Yes. **Log Views** provide row-level security within a single bucket. Create a view with a filter expression (e.g., `protoPayload.serviceName="compute.googleapis.com" AND severity>=ERROR`) and grant users access to only that view rather than the entire bucket, as described in [`/skills/cloud/cloud-logging-configuration-basics/SKILL.md`](https://github.com/google/skills/blob/main//skills/cloud/cloud-logging-configuration-basics/SKILL.md) (lines 180-207).