Find logs between timestamps using stackdriver CLI

Question

I need to find logs between two timestamps using stackdriver CLI. I used the below command.

gcloud beta logging read "timestamp>=\"2017-02-19T00:00:00Z\" AND timestamp<\"2017-03-14T00:00:00Z\"" 

But its giving me the error:

The filename, directory name, or volume label syntax is incorrect.

Here is my gcloud version details

Herat

Answer 1

I'm a product manager with Stackdriver logging. We've tested the command and it seemed to work fine. The issue may be with Windows command shell? One guess is that perhaps the ">" and "<" need "/" in front? Copying and pasting your query into cloud shell works fine.

Kudos go to a Google engineer who recommended this: I came across this issue a lot with gcloud --filter commands on windows. The following works:

gcloud beta logging read "timestamp^>=""2017-02-19T00:00:00Z"" AND ""timestamp^<2017-03-14T00:00:00Z"""

Note use of double "" and ^ escape characters.

You can add --verbosity debug to the command line, it will show you how exactly parameters were understood by gcloud.

Friedcake

As you mentioned the command is working fine from gcloud shell in the browser, but is failing in Windows command shell. – Herat

After adding ^ before < and adding the extra " the command is working fine. Thank you Team. Here is the command I used. gcloud beta logging read "logName=projects/myproject/logs/output_log AND Exception AND timestamp^>=""2017-03-22T14:01:32Z"" AND timestamp^<""2017-03-22T15:50:04Z""" --format=table(resource.labels.zone,labels.'compute.googleapis.com/resource_name',timestamp,textPayload) – Herat

Does this still work? ❯ gcloud logging read 'timestamp^>="2019-08-08T21:00:00Z"' ERROR: (gcloud.logging.read) INVALID_ARGUMENT: Field not found: 'timestamp^'. – Surfactant

Answer 2

The above answer doesn't seem to work anymore. Here's the new command.

gcloud logging read 'receiveTimestamp>="2019-08-08T21:00:00Z" AND receiveTimestamp<="2019-08-08T22:00:00Z"'

Actually, this is simpler. The escape characters has been removed along with the double "double quotes". :)

Surfactant

Answer 3

you can simply use the following command to get logs based on timestamps and other filter conditions-

gcloud logging read 
"resource.type=cloud_run_revision
 resource.labels.service_name=new_service
 timestamp>=\"2021-08-30T00:00:01.086988Z\" AND timestamp<=\"2021-08-30T23:59:59.086988Z\""
 --format json > logs.json

This is tested and verified on 03 Sept 2021

Satang

Worked for me, once I added timestamp inside the same quote after read gcloud logging read "resource.type="k8s_pod" timestamp>=\"2022-06-14T11:13:54.052235Z\ and timestamp<=\"2022-06-14T15:00:00Z\""" – Simonetta