Search code examples
gcloudgoogle-cloud-logging

gcloud logging with regular expression

I'm trying to use gcloud logging along with regular expression. My query works in the console but I can't get it going via the CLI.

gcloud logging read "resource.type=gce_instance AND protoPayload.authenticationInfo.principalEmail=~'.*@example.com.au'" --limit=10 --format=json

I get the error:

ERROR: (gcloud.logging.read) INVALID_ARGUMENT: Unparseable filter: unrecognized node at token 'MEMBER'

I've tried with and without various quotes '' "" "\"\

I also have the same trouble when doing timestamp dates as well:

gcloud logging read "resource.type=gce_instance AND timestamp > '2021-06-15T00:00:00.000000Z'"

I get the error:

ERROR: (gcloud.logging.read) INVALID_ARGUMENT: Unparseable filter: syntax error at line 1, column 112, token ':';
Solution

  • Your first gcloud expression should look like this:

    cloud logging read "resource.type=gce_instance AND protoPayload.authenticationInfo.principalEmail:'.*@example.com.au'"

    I changed = sign to :.

    And the second one like this:

    gcloud logging read 'resource.type=gce_instance AND timestamp > "2021-08-15T00:00:00.000000Z"'

    I exchanged single with double quotes (literally).

    It's best to have a quick look at the gcloud logging read command documentation (I figured out a proper syntax this way).