---
# System prepended metadata

title: gcp log query
tags: [syntax, 草稿, google cloud platform, gcp, google, query, '2022']

---

# gcp log query

- [query structure](
https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry)

```
"The cat in the hat"
resource.type = "gae_app"
```

第一列: 任何 LogEntry 或 payload 的 field 內容有包含 `"The cat in the hat"` 它就會被找出來

第二列: 會用 `[FIELD_NAME] [OP] [VALUE]` 這種形式去query

- FIELD_NAME : Log entry 的 filed
- OP : comparison ex: `=`

```
=           -- equal
!=          -- not equal
> < >= <=   -- numeric ordering
:           -- "has" matches any substring in the log entry field
=~          -- regular expression search for a pattern
!~          -- regular expression search not for a pattern
```

- VALUE : number, string, function ...

```
a=b AND c=d AND NOT e=f
a=b c=d -e=f
```
上下兩列是相等的, 可以忽略 AND, NOT 可以用 - 代替

- Boolean operator 是 capitalized (大寫)
- 有特殊字元的話要用 "" 包起來
- Boolean
```
jsonPayload.cat = ("longhair" OR "shorthair")
jsonPayload.animal : ("nice" AND "pet")
```
- timestamp 
時間格式 `YYYY-MM-DD` 會被修正成 `YYYY-MM-DDT00:00:00Z`
```
timestamp >= "2016-06-27T12:40:00-04:00" AND timestamp <= "2016-06-27T14:40:00-04:00"
```

```
timestamp > "2016-11-29"
```

- [建議](
https://cloud.google.com/logging/docs/view/logging-query-language#no-global-searches)
- [搜尋範例](https://cloud.google.com/logging/docs/view/logging-query-language#searching-examples)
- `=` 等於某個值
- `:` 有某個值
- comment `--` 
```
-- 註解部份
```


# 參考
- https://cloud.google.com/logging/docs/view/logging-query-language
- https://google.aip.dev/160

###### tags: `2022` `草稿` `google` `gcp` `google cloud platform` `query` `syntax`

{%hackmd BJrTq20hE %}