gcp-logs

# Query GCP Logs

Search GCP Cloud Logging for application errors, service logs, and traces.

## When to Use

- Investigating errors in GCP-hosted services
- Finding request traces for debugging
- Analyzing service behavior over time
- Correlating events across services

## Pre-flight Checks

### Authentication and Context
```bash
# Check gcloud auth
gcloud auth list 2>/dev/null | grep -q ACTIVE || {
  echo "Not authenticated. Run: gcloud auth login"
  exit 1
}

# Show current project
CURRENT_PROJECT=$(gcloud config get-value project 2>/dev/null)
echo "Current GCP Project: $CURRENT_PROJECT"

# If context suggests different project, prompt to switch
# Example: User mentions "production" but current project is "staging"
# Detect from query context and prompt:
# echo "Query mentions 'production' but current project is '$CURRENT_PROJECT'"
# echo "Switch to production project? Run: gcloud config set project example-production"
# read -p "Continue with current project? (y/n) " -n 1 -r
```

## Common Query Patterns

### 1. Query by Severity
```bash
# Get ERROR and higher severity logs
gcloud logging read \
  'severity>=ERROR' \
  --limit=100 \
  --format=json \
  --project=<project-name>

# Get CRITICAL logs only
gcloud logging read \
  'severity=CRITICAL' \
  --limit=50 \
  --format=json
```

### 2. Query by Kubernetes Resource Labels

Kubernetes container logs have a `resource.type="k8s_container"` with these labels:

```bash
# Filter by container name (most useful for finding service logs)
gcloud logging read \
  'resource.type="k8s_container" AND resource.labels.container_name="service-b"' \
  --limit=100 \
  --format=json

# Filter by namespace and container
gcloud logging read \
  'resource.labels.namespace_name="app-namespace" AND resource.labels.container_name="service-b"' \
  --limit=100

# Filter by pod name (specific pod instance)
gcloud logging read \
  'resource.labels.pod_name="service-b-5ddcfbd7f8-bt5j9"' \
  --limit=100

# Filter by cluster name
gcloud logg