# gcp log query

- [query structure](
https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry)

"The cat in the hat"
resource.type = "gae_app"

第一列: 任何 LogEntry 或 payload 的 field 內容有包含 `"The cat in the hat"` 它就會被找出來

第二列: 會用 `[FIELD_NAME] [OP] [VALUE]` 這種形式去query

- FIELD_NAME : Log entry 的 filed
- OP : comparison ex: `=`

=           -- equal
!=          -- not equal
> < >= <=   -- numeric ordering
:           -- "has" matches any substring in the log entry field
=~          -- regular expression search for a pattern
!~          -- regular expression search not for a pattern

- VALUE : number, string, function ...

a=b AND c=d AND NOT e=f
a=b c=d -e=f

上下兩列是相等的, 可以忽略 AND, NOT 可以用 - 代替

- Boolean operator 是 capitalized (大寫)
- 有特殊字元的話要用 "" 包起來
- Boolean

jsonPayload.cat = ("longhair" OR "shorthair")
jsonPayload.animal : ("nice" AND "pet")

- timestamp
時間格式 `YYYY-MM-DD` 會被修正成 `YYYY-MM-DDT00:00:00Z`

timestamp >= "2016-06-27T12:40:00-04:00" AND timestamp <= "2016-06-27T14:40:00-04:00"

timestamp > "2016-11-29"

- [建議](
https://cloud.google.com/logging/docs/view/logging-query-language#no-global-searches)
- [搜尋範例](https://cloud.google.com/logging/docs/view/logging-query-language#searching-examples)
- `=` 等於某個值
- `:` 有某個值
- comment `--`

-- 註解部份

# 參考
- https://cloud.google.com/logging/docs/view/logging-query-language
- https://google.aip.dev/160

###### tags: `2022` `草稿` `google` `gcp` `google cloud platform` `query` `syntax`

{%hackmd BJrTq20hE %}