Filter logs
Query and filter your structured logs using a custom query language with operators and boolean expressions.
Read time 2 minutesLast updated 7 months ago
The Logging service supports a custom query language that allows you to easily filter your structured logs. This section walks you through the syntax and usage of the query language, and provides some examples to help you get started.
Basic syntax and operators
A filter query consists of one or more conditions. The basic syntax of a condition consists of the following components:Component | Condition |
|---|---|
| Field | The field you want to filter on, such as |
| Operator | One of the supported operators. Refer to the table of operators below. |
| Value | The value you want to compare the field against. |
Operator | Meaning |
|---|---|
| equals |
| not equals |
| contains (only available on |
| does not contain (only available on |
| greater than |
| less than |
| less than or equal to |
| greater than or equal to |
Boolean expressions and grouping
You can create complex filter queries using boolean expressions and grouping with parentheses. This allows you to combine multiple conditions to create precise filters.Boolean expression | Meaning |
|---|---|
| Require both conditions on either side to be true. |
| Require at least one of the conditions on either side to be true. |
| Grouping | Use parentheses ( and ) to group expressions and control the order of evaluation. |
ANDExamples of filter queries
Select all logs with a certain severity level:Select all logs from Cloud Code that are above a certain severity level (newlines are treated as AND):severityText = "ERROR"
Exclude logs with a particular word in the message:resourceAttributes.service.name = "cloud-code"severityNumber >= 12
Combine multiple conditions and groupings (using severity alias):body !~= "healthcheck"
(logAttributes.event.name = "example-event" AND body ~= "timeout") OR (logAttributes.custom.counter > 9000 AND severity = "WARN")
Notes
The following notes apply to the filter query language:- The field is also aliased as
severityTextfor convenienceseverity - Fuzzy match operators (~= and !~=) are only supported for the field
body - The keys are case-sensitive
logAttributes - The values are automatically converted to string
logAttributes