Google Cloud Logging Configuration and Query Syntax Examples

Google Cloud Logging provides a unified platform for ingesting, storing, and querying log data using gcloud logging read commands that combine logName, resource.type, and jsonPayload filter expressions.

The google/skills repository contains authoritative skill guides that demonstrate how to build centralized logging foundations, configure cross-project log routing, and execute targeted queries for security analysis. This article distills those production patterns into actionable configuration steps and query syntax examples.

Centralized Logging Architecture

A robust Google Cloud logging deployment relies on four core components that separate storage from access and routing.

Central Log Projects act as dedicated aggregation points (e.g., logging-[SUFFIX]) hosting global or regional log buckets. According to the foundation builder reference at /skills/cloud/google-cloud-recipe-foundation-builder/references/logging-monitoring.md (lines 9-15), these projects collect audit logs, VPC Flow logs, and firewall logs under a single retention policy.

Log Buckets serve as logical containers for log storage. As defined in /skills/cloud/cloud-logging-configuration-basics/SKILL.md (lines 4-13), buckets can be global (default) or regional to satisfy data residency requirements and reduce query latency.

Log Sinks route logs from source projects, folders, or organizations into central buckets. The sink creation process documented in /skills/cloud/google-cloud-recipe-foundation-builder/references/logging-monitoring.md (lines 28-34) uses gcloud logging sinks create with filters to select specific log types.

Log Views provide fine-grained access control over bucket contents. The configuration basics guide at /skills/cloud/cloud-logging-configuration-basics/SKILL.md (lines 180-207) demonstrates creating views like "security-logs-view" that restrict visibility to Cloud Audit logs only.

Configuring Log Buckets and Sinks

Establishing a centralized pipeline requires creating the bucket first, then configuring sinks with appropriate IAM permissions.

Create a Central Log Bucket

Create a global bucket with a defined retention period to store aggregated logs:

gcloud logging buckets create myorg-logging \
    --project=logging-01 \
    --location=global \
    --description="Central log bucket" \
    --retention-days=30

This command matches the pattern found in /skills/cloud/google-cloud-recipe-foundation-builder/references/logging-monitoring.md (lines 9-15), where the bucket location determines latency characteristics and compliance boundaries.

Configure Log Sinks

Route logs from source projects to the central bucket using filter expressions:

gcloud logging sinks create audit-sink \
    logging.googleapis.com/projects/logging-01/locations/global/buckets/myorg-logging \
    --project=my-target-project \
    --filter='logName:"logs/cloudaudit.googleapis.com%2Factivity"'

Grant IAM Roles

The sink's service account requires specific permissions to write to the destination bucket. As detailed in /skills/cloud/google-cloud-recipe-foundation-builder/references/admin-iam.md (lines 67-81), assign roles/logging.admin or more restrictive viewer roles to the sink's unique service account.

Define Log Views (Optional)

Create restricted views for security teams to limit exposure:

gcloud logging views create security-logs-view \
    --bucket=myorg-logging \
    --filter='protoPayload.serviceName="compute.googleapis.com" AND severity>=ERROR'

Query Syntax Fundamentals

The gcloud logging read command retrieves log entries using a query language that supports Boolean logic, regular expressions, and time-range selectors. Query execution targets the log entries stored in specific projects or buckets.

Key syntax elements include:

• Field selectors: logName, resource.type, jsonPayload.field_name
• Logical operators: AND, OR, NOT
• Comparison operators: =, !=, <, >, <=, >=, :, =~
• Time modifiers: --freshness flag or timestamp comparisons

Common Query Patterns for Network and Security Analysis

The following examples demonstrate production queries for investigating VPC flows, firewall events, and threats.

Query VPC Flow Logs

Retrieve recent VPC flow entries for subnet analysis using the pattern from /skills/cloud/google-cloud-networking-observability/references/vpc-flow-analysis.md (line 57):

gcloud logging read \
    '(logName:"projects/${PROJECT_ID}/logs/compute.googleapis.com%2Fvpc_flows" OR \
      logName:"projects/${PROJECT_ID}/logs/networkmanagement.googleapis.com%2Fvpc_flows") \
     AND resource.type="gce_subnetwork"' \
    --project ${PROJECT_ID} \
    --limit 10 \
    --format json \
    --quiet

Filter High-Severity Threat Alerts

Identify denied high-severity firewall threats as documented in /skills/cloud/google-cloud-networking-observability/references/threat-analysis.md (line 92):

gcloud logging read \
    'logName:("projects/${PROJECT_ID}/logs/networksecurity.googleapis.com%2Ffirewall_threat" OR \
      "projects/${PROJECT_ID}/logs/ids.googleapis.com%2Fthreat") \
     AND jsonPayload.threatDetails.severity=("HIGH" OR "CRITICAL") \
     AND jsonPayload.action="DENY"' \
    --project ${PROJECT_ID} \
    --limit 10 \
    --format json \
    --quiet

Inspect Firewall Deny Rules

List firewall events where traffic was explicitly denied, referencing /skills/cloud/google-cloud-networking-observability/references/firewall-analysis.md (line 65):

gcloud logging read \
    'resource.type="gce_subnetwork" AND \
     logName="projects/${PROJECT_ID}/logs/compute.googleapis.com%2Ffirewall" AND \
     jsonPayload.rule_details.action="DENY"' \
    --project ${PROJECT_ID} \
    --limit 10 \
    --format json \
    --quiet

Explore NAT Drops

Filter Cloud NAT flow logs for dropped packets per /skills/cloud/google-cloud-networking-observability/references/cloud-nat-analysis.md (line 56):

gcloud logging read \
    'resource.type="nat_gateway" AND \
     logName="projects/${PROJECT_ID}/logs/compute.googleapis.com%2Fnat_flows" AND \
     jsonPayload.allocation_status="DROPPED"' \
    --project ${PROJECT_ID} \
    --limit 10 \
    --format json \
    --quiet

Query Cloud Run Revision Logs

Retrieve error-level logs for serverless applications as shown in /skills/cloud/cloud-run-basics/SKILL.md (line 352):

gcloud logging read \
    "resource.type=cloud_run_revision AND jsonPayload.message:\"ERROR\"" \
    --project ${PROJECT_ID} \
    --limit 20

Cross-Project Log Reading

Access logs from source projects through a central logging project using the pattern in /skills/cloud/cloud-logging-cross-project-configuration/SKILL.md (line 310):

gcloud logging read \
    'logName:"projects/${SOURCE_PROJECT_ID}/logs/${TEST_LOG_ID}"' \
    --project ${CENTRAL_LOG_PROJECT}

Summary

• Centralized architecture uses dedicated log projects, buckets, sinks, and views to aggregate data across organizational boundaries.
• Bucket configuration determines retention periods (via --retention-days) and geographical placement (global vs. regional) for compliance.
• Sink filters control which log types flow into central storage, using expressions like resource.type="gce_subnetwork" to limit volume.
• Query syntax leverages gcloud logging read with Boolean combinations of logName, jsonPayload, and resource fields.
• Security queries target specific indicators such as jsonPayload.threatDetails.severity or jsonPayload.allocation_status="DROPPED" for threat hunting and debugging.

Frequently Asked Questions

What is the difference between a log bucket and a log sink?

A log bucket is a storage container that holds log entries for a specified retention period, while a log sink is a routing rule that directs matching log entries from a source (project, folder, or organization) to a destination bucket. As implemented in google/skills, sinks use filter expressions to select which logs enter centralized buckets.

How do I query logs across multiple Google Cloud projects?

Configure a central log bucket in a dedicated logging project, then create log sinks in each source project targeting that bucket. Use gcloud logging read against the central project while specifying the original source project in the logName filter, as demonstrated in /skills/cloud/cloud-logging-cross-project-configuration/SKILL.md (line 310).

What filter syntax retrieves only high-severity firewall deny events?

Combine the jsonPayload.action field with severity selectors: jsonPayload.rule_details.action="DENY" for standard firewall rules or jsonPayload.threatDetails.severity=("HIGH" OR "CRITICAL") for threat detection logs. The exact syntax varies by log type and is documented in the networking observability references within google/skills.

Can I restrict which logs users see without creating separate buckets?

Yes. Log Views provide row-level security within a single bucket. Create a view with a filter expression (e.g., protoPayload.serviceName="compute.googleapis.com" AND severity>=ERROR) and grant users access to only that view rather than the entire bucket, as described in /skills/cloud/cloud-logging-configuration-basics/SKILL.md (lines 180-207).

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}