AutoGineer
Generated banner for Cloud Logging Query Generation
Generated logo for Cloud Logging Query Generation

Cloud Logging Query Generation

GoogleOfficialPublished by Google

  • Skill
  • Tool integration
  • Cloud and DevOps
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Generates Logging Query Language (LQL) queries for Cloud Logging on Google Cloud from natural language. Use this skill when you need to query log data or when you are debugging issues. You can filter log data by Google Cloud service. Don't use this skill to query other databases, such as SQL or Cloud Spanner.
— the description by Google

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill assists users in constructing precise Logging Query Language (LQL) queries for Google Cloud Logging. It provides structured guidance on syntax, resource types, and field filtering to help users debug issues or analyze log data. The skill adheres to specific formatting rules, including the use of double quotes for strings, capitalized boolean operators, and explicit grouping with parentheses. It also includes logic for handling audit logs and global keyword searches when specific schemas are unavailable.

What it does

  • Translates natural language requests into valid LQL queries.
  • Provides syntax enforcement for boolean operators and string literals.
  • Identifies correct resource types for various Google Cloud services.
  • Handles audit and admin log queries using specific protoPayload schemas.
  • Generates global search queries using the SEARCH function when schemas are unknown.
  • Applies mandatory attribution headers for direct CLI or API interactions.

When to use it

  • When you need to filter or search through Google Cloud logs.
  • When debugging specific service issues and requiring log data.
  • When you are unsure of the correct LQL syntax or resource type for a specific service.
  • When you need to extract audit logs for security or operational review.

Advantages

  • Reduces manual effort in writing complex LQL syntax.
  • Ensures adherence to Google Cloud logging best practices.
  • Provides service-specific guidance for accurate filtering.
  • Maintains consistent attribution for observability operations.

Usage examples

“Show me all error logs for my GCE instance named web-server-01.”
resource.type="gce_instance" AND resource.labels.instance_name="web-server-01" AND severity>=ERROR
“Find audit logs for BigQuery dataset deletions.”
resource.type="bigquery_dataset" AND protoPayload.methodName="google.cloud.bigquery.v2.DatasetService.DeleteDataset"

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/google/cloud-logging-query-generation/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip cloud-logging-query-generation.zip -d .agents/skills

Documentation by Google

Generate Logging Query Language queries

Use this skill to generate correct Logging Query Language (LQL) queries for Cloud Logging.

Attribution

MUST READ: Before executing any gcloud, REST API, or MCP command, you MUST read Usage Attribution. For commands executed directly in the terminal (never in generated scripts, Terraform, or user code), prefix gcloud with CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:cloud-logging-query-generation)" and append agent-skills/1.0 (skill:cloud-logging-query-generation) to User-Agent headers.

Core rules

  1. Strict syntax requirements:

    • Always use double quotes (") for string literals. Do not use single quotes (').

    • Write boolean operators in all capitals: AND, OR, NOT.

    • Always use parentheses to group terms and explicitly enforce precedence.

  2. Common pitfalls:

    • Instance ID vs. Instance Name: For the gce_instance resource type, do NOT compare instance names to instance IDs. Instance names are strings (for example, my-instance). Instance IDs are numeric. If you only have the name, then search by instance name, SEARCH("my-instance"), or use resource.labels.instance_name if that label is available for the resource.

    • Resource Type Accuracy: Do not guess resource types. You must look up the correct resource.type value in the service-specific reference files. For example, use internal_http_lb_rule for Internal HTTP(S) Load Balancer rules when filtering by forwarding rule name or region (instead of http_load_balancer).

  3. Output format and placeholders:

    • Output only the raw LQL query text. Do not include conversational filler. Do not wrap the query in markdown code blocks unless explicitly requested by the user. Valid LQL comments (using --) are allowed, and are the ONLY acceptable way to include explanations or warnings.

    • Never block on missing variables. If the user's request lacks specific identifiers (like a project ID, instance name, or IP address), do not ask them for clarification. If the variable is required for a functional query (like a log bucket name for a regional log), insert an uppercase placeholder string wrapped in angle brackets (for example, "<PROJECT_ID>"). CRITICALLY: If you include a placeholder for a variable the user omitted, it will act as an explicit filter that causes logs to be missed. Therefore, you MUST omit the entire filter/line containing the placeholder if the field is not strictly required. For example, completely omit resource.labels.instance_id="..." if the user didn't specify an instance, but you MUST include logName=".../projects/<PROJECT_ID>/..." with a placeholder if constructing a regional log bucket query where a project ID is strictly required.

  4. Preferred fields:

    • Include resource.type and log_id restrictions when the query targets specific Google Cloud services or resources. Global queries (for example, "latest error logs") do not require these restrictions.

Detailed reference

Refer to references/api_reference.md for LQL syntax rules, including Operators, NULL handling, SEARCH, and Regex.

Service reference files

Before generating a query, you MUST read the examples for the specific service. LQL schemas and resource.type values are service-specific. Do not stop reading after finding the Base Schema in the file. You must verify if there are specific requirements for state tracking (like previousState) or resource-specific log IDs detailed in the paragraphs or specific query examples below the schema block.

For the following services, read the exact file listed:

For Google Cloud services that aren't listed: If the service is not listed above, write the LQL query based on your general knowledge.

Query generation rules

  1. Resource Types: Explicitly define the resource.type in your queries when focusing on specific services. For some queries, you may need to search across multiple types (for example, resource.type=("bigquery_project" OR "bigquery_dataset")).

  2. Audit and Admin Logs: If the user asks for audit logs, admin logs, API logs, or logs about who created, updated, deleted, read, or accessed a resource:

    • You MUST read references/query_audit_logs.md for the correct protoPayload schema paths and common examples.

    • If a specific example is not listed, guess the protoPayload.methodName by combining the service and verb. When guessing, you MUST use the scoped SEARCH() function (e.g., SEARCH(protoPayload.methodName, "compute.instances.insert")) instead of the exact match operator (=) to avoid version prefix mismatches. Do NOT use the colon operator (:) as it may cause substring false positives.

    • For generic API enable/disable events (e.g., a service was disabled), always use resource.type="audited_resource".

  3. Handling Unknown Schemas (Crucial): If the user asks to filter by a specific field or condition, and if you cannot find a matching example or schema in the reference files, then you must generate a query using global search.

    • Only specify jsonPayload.* or protoPayload.* field structures when you are certain of their exact name.

    • Use the SEARCH() function to find the keyword globally within the correct resource.type.

    • Mandatory LQL Comment: When delivering a query that uses SEARCH, you MUST add an LQL comment (using --) at the top of the query indicating you used a global keyword search because the exact schema wasn't in your references. Do NOT output conversational text, strictly adhere to the Output Format rule.

Supporting links

Files

references/query_gke.md

Kubernetes Engine (GKE) LQL queries

Table of contents

  • Base schema and structural patterns (L72-L141)

  • Resource types (L78-L91)

  • Application logs (stdout / stderr) pattern (L93-L102)

  • Kubernetes events pattern (L104-L111)

  • System and control plane logs pattern (L113-L121)

  • Google Cloud vs Kubernetes Audit Logs (L123-L132)

  • User-defined Kubernetes labels gotcha (L134-L141)

  • Example queries (L143-L771)

  • Cluster logs in a specific Google Cloud location (L145-L152)

  • Pod eviction events (L154-L162)

  • Container errors from a specific pod (L164-L172)

  • Google Kubernetes Engine cluster operations (L174-L181)

  • Google Kubernetes Engine cluster creation (L183-L191)

  • Kubernetes cluster deployment (L193-L201)

  • Kubernetes cluster authentication failure (L203-L211)

  • Kubernetes cluster operations and events in us-central1-b (L213-L220)

  • Kubernetes pod requests from users (L222-L231)

  • Kubernetes events (L233-L240)

  • Kubernetes endpoints update (L242-L250)

  • Kubernetes control plane logs (L252-L260)

  • Kubernetes Engine control plane logs (L262-L270)

  • Pod deletion (L272-L280)

  • Kubernetes pod audit logs from control plane (L282-L292)

  • Kubernetes pod evictions (L294-L304)

  • Kubernetes node audit logs from the control plane (L306-L316)

  • Kubernetes cluster control plane for Addon Manager Activity (L318-L328)

  • Kubernetes control plane errors (excluding Conflict , which is normal) (L330-L341)

  • Ingress Controller events (L343-L353)

  • Service Controller events (kube-controller-manager) (L355-L365)

  • Cluster Autoscaler events (L367-L377)

  • Cluster Autoscaler scale up failures (visibility logs) (L379-L389)

  • Query pod during creation (L391-L399)

  • Scheduler events (L401-L411)

  • Scheduler events (preemptions) (L413-L424)

  • Node events (L426-L433)

  • Out of memory (OOM) events (L435-L444)

  • Looking at Kube-proxy logs (L446-L453)

  • Looking at dockerd logs (L455-L462)

  • Looking at kubelet errors or failures (L464-L472)

  • Looking at node logs for GKE system logs (L474-L490)

  • Container and pod logs for GKE system logs (L492-L508)

  • Stdout container logs across all pods and containers in a cluster (L510-L517)

  • Container error logs across all pods and containers in a cluster (L519-L527)

  • Container error logs for a pod with a specific name (L529-L537)

  • Container error logs for a specific container in a specific pod (L539-L548)

  • Container error logs for a specific namespace and container (L550-L559)

  • Container logs for a pod with a specific label (L561-L569)

  • Container error logs for pods running on a specific node (L571-L579)

  • Container logs for a pod with a label generated using skaffold (L581-L590)

  • Container error logs for a specific pod containing a POST in the textPayload (L592-L601)

  • Container error logs for a specific pod containing a GET in the structured JSON (L603-L612)

  • Container errors logs in the kube-system namespace (L614-L622)

  • Container error in the container insights log (L624-L631)

  • Kubernetes container logs (L633-L640)

  • Kubernetes API server logs (L642-L651)

  • Kubernetes Scheduler logs (L653-L662)

  • Kubernetes Controller Manager logs (L664-L673)

  • Stdout container logs across all TPU nodes with the same prefix (L675-L683)

  • Container error logs across all TPU nodes with the same prefix (L685-L694)

  • Stdout container logs from the same GKE Job (L696-L704)

  • Container error logs from the same GKE Job (L706-L715)

  • Stdout container logs from the same GKE JobSet (L717-L725)

  • Container error logs from the same GKE JobSet (L727-L736)

  • Node auto-repair events (L738-L747)

  • Cluster deletion events (L749-L757)

  • Pod IP assignment and release (L759-L771)

Base schema and structural patterns

GKE logs are split across multiple resource.type values depending on what generated the log. Always constrain your query to the correct resource type first before searching payloads.

Resource types

  • Containers (k8s_container): Use for application logs, standard out (textPayload), and structured JSON logs (jsonPayload) emitted by your workloads. This is the most common resource type for debugging applications.

  • Pods (k8s_pod): Use for Kubernetes pod lifecycle events (for example, evictions, scheduling gaps, readiness probes).

  • Nodes (k8s_node): Use for infrastructure-level node events (for example, kubelet errors, container runtime logs, node auto-repair).

  • Cluster/Control Plane (k8s_cluster or gke_cluster): Use for control plane logs (API server, scheduler, controller-manager) and cluster-level operations. Kubernetes-native components log to k8s_cluster, while GCP infrastructure operations (like deleting the GKE cluster) log to gke_cluster.

Application logs (stdout / stderr) pattern

When a user asks to search for "errors in my application", "logs from the foo-pod", or "stdout from a container":

  • Target resource.type="k8s_container".

  • Filter by resource.labels.pod_name, resource.labels.container_name, or resource.labels.namespace_name.

  • The raw log string is found in textPayload (unstructured) or jsonPayload (structured log records).

Kubernetes events pattern

When a user asks about Kubernetes events like Pod evictions, Node scaling, or BackOffs:

  • Filter by log_id("events").

  • Search within jsonPayload.reason (for example, "Evicted", "FailedScheduling", "BackOff") and jsonPayload.message.

System and control plane logs pattern

When debugging GKE internal infrastructure (for example, ingress controllers, kube-dns):

  • Target the kube-system namespace (resource.labels.namespace_name="kube-system").

  • Control plane components generally log under the k8s_cluster resource type.

Google Cloud vs Kubernetes Audit Logs

When auditing infrastructure (for example, who created the GKE cluster itself), this falls under general Google Cloud API audit logs. However, when auditing inside the cluster (for example, who deleted a Namespace or Pod):

  • Target resource.type="k8s_cluster".

  • Filter by log_id("cloudaudit.googleapis.com/activity") (or data_access).

  • Search within protoPayload.methodName using native Kubernetes API strings (for example, "io.k8s.core.v1.namespaces.create").

User-defined Kubernetes labels gotcha

When filtering by custom Kubernetes pod labels (like app: my-app or tier: backend), do NOT look in resource.labels or labels.app (or similar unwrapped keys). Cloud Logging stores custom Kubernetes metadata in the global labels object, automatically prefixed with "k8s-pod/".

  • Example: labels."k8s-pod/app"="my-app"

Example queries

Cluster logs in a specific Google Cloud location

Variables to replace: <LOCATION>

resource.type="k8s_cluster" AND
resource.labels.location="<LOCATION>"
Pod eviction events

Variables to replace: None

resource.type="k8s_pod" AND
log_id("events") AND
jsonPayload.reason="Evicted"
Container errors from a specific pod

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
severity=ERROR
Google Kubernetes Engine cluster operations

Variables to replace: None

resource.type="gke_cluster" AND
log_id("cloudaudit.googleapis.com/activity")
Google Kubernetes Engine cluster creation

Variables to replace: None

resource.type="gke_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.container.v1.ClusterManager.CreateCluster"
Kubernetes cluster deployment

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "deployments")
Kubernetes cluster authentication failure

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.authenticationInfo.principalEmail="system:anonymous"
Kubernetes cluster operations and events in us-central1-b

Variables to replace: None

resource.type="k8s_cluster" AND
resource.labels.location="us-central1-b"
Kubernetes pod requests from users

Variables to replace: <USER_EMAIL>

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "io.k8s.core.v1.pods") AND
protoPayload.authenticationInfo.principalEmail="<USER_EMAIL>"
Kubernetes events

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("events")
Kubernetes endpoints update

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.request.kind="Endpoints"
Kubernetes control plane logs

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="k8s.io"
Kubernetes Engine control plane logs

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="container.googleapis.com"
Pod deletion

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName=~"io\.k8s\.core\.v1\.pods\.(create|delete)"
Kubernetes pod audit logs from control plane

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>, <POD_NAME>, <POD_NAMESPACE>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.resourceName="core/v1/namespaces/<POD_NAMESPACE>/pods/<POD_NAME>"
Kubernetes pod evictions

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="io.k8s.core.v1.pods.eviction.create"
Kubernetes node audit logs from the control plane

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "io.k8s.core.v1.nodes")
Kubernetes cluster control plane for Addon Manager Activity

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.authenticationInfo.principalEmail="system:addon-manager"
Kubernetes control plane errors (excluding Conflict , which is normal)

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.status.message!="Conflict" AND
protoPayload.status.code!=0
Ingress Controller events

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="loadbalancer-controller"
Service Controller events (kube-controller-manager)

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="service-controller"
Cluster Autoscaler events

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="cluster-autoscaler"
Cluster Autoscaler scale up failures (visibility logs)

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("container.googleapis.com/cluster-autoscaler-visibility") AND
jsonPayload.resultInfo.results.errorMsg.messageId:"scale.up"
Query pod during creation

Variables to replace: <POD_NAME>

resource.type="k8s_pod" AND
resource.labels.pod_name="<POD_NAME>" AND
log_id("events")
Scheduler events

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_pod" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="default-scheduler"
Scheduler events (preemptions)

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_pod" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="default-scheduler" AND
jsonPayload.reason="Preempted"
Node events

Variables to replace: None

resource.type="k8s_node" AND
log_id("events")
Out of memory (OOM) events

Variables to replace: None

resource.type="k8s_node"
log_id("events")
(jsonPayload.reason:("OOMKilling" OR "SystemOOM")
  OR jsonPayload.message:("OOM encountered" OR "out of memory"))
Looking at Kube-proxy logs

Variables to replace: None

resource.type="k8s_node" AND
log_id("kube-proxy")
Looking at dockerd logs

Variables to replace: None

resource.type="k8s_node" AND
log_id("container-runtime")
Looking at kubelet errors or failures

Variables to replace: None

resource.type="k8s_node" AND
log_id("kubelet") AND
jsonPayload.MESSAGE:("error" OR "fail")
Looking at node logs for GKE system logs

Variables to replace: None

resource.type = "k8s_node" AND
logName:( "logs/container-runtime" OR
"logs/docker" OR
"logs/kube-container-runtime-monitor" OR
"logs/kube-logrotate" OR
"logs/kube-node-configuration" OR
"logs/kube-node-installation" OR
"logs/kubelet" OR
"logs/kubelet-monitor" OR
"logs/node-journal" OR
"logs/node-problem-detector")
Container and pod logs for GKE system logs

Variables to replace: None

resource.type = ("k8s_container" OR "k8s_pod") AND
resource.labels.namespace_name = (
"cnrm-system" OR
"config-management-system" OR
"gatekeeper-system" OR
"gke-connect" OR
"gke-system" OR
"istio-system" OR
"knative-serving" OR
"monitoring-system" OR
"kube-system")
Stdout container logs across all pods and containers in a cluster

Variables to replace: None

resource.type="k8s_container" AND
log_id("stdout")
Container error logs across all pods and containers in a cluster

Variables to replace: None

resource.type="k8s_container" AND
log_id("stderr") AND
severity=ERROR
Container error logs for a pod with a specific name

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
severity=ERROR
Container error logs for a specific container in a specific pod

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
resource.labels.container_name="server" AND
severity=ERROR
Container error logs for a specific namespace and container

Variables to replace: None

resource.type="k8s_container" AND
resource.labels.namespace_name="istio-system" AND
resource.labels.container_name="egressgateway" AND
severity=ERROR
Container logs for a pod with a specific label

Variables to replace: None

resource.type="k8s_container" AND
labels."k8s-pod/app"="loadgenerator" AND
severity=ERROR
Container error logs for pods running on a specific node

Variables to replace: <NODE_NAME>

resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"="<NODE_NAME>" AND
severity=ERROR
Container logs for a pod with a label generated using skaffold

Variables to replace: <SKAFFOLD_RUN_ID>

resource.type="k8s_container" AND
labels."k8s-pod/app"="loadgenerator" AND
labels."k8s-pod/skaffold_dev/run-id"="<SKAFFOLD_RUN_ID>" AND
severity=ERROR
Container error logs for a specific pod containing a POST in the textPayload

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
textPayload:"POST" AND
severity=ERROR
Container error logs for a specific pod containing a GET in the structured JSON

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
jsonPayload."http.req.method"="GET" AND
severity=ERROR
Container errors logs in the kube-system namespace

Variables to replace: None

resource.type="k8s_container" AND
resource.labels.namespace_name="kube-system" AND
severity=ERROR
Container error in the container insights log

Variables to replace: None

resource.type="k8s_container" AND
log_id("clouderrorreporting.googleapis.com/insights")
Kubernetes container logs

Variables to replace: <CONTAINER_NAME>

resource.type="k8s_container" AND
resource.labels.container_name="<CONTAINER_NAME>"
Kubernetes API server logs

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_control_plane_component" AND
resource.labels.component_name="apiserver" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>"
Kubernetes Scheduler logs

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_control_plane_component" AND
resource.labels.component_name="scheduler" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>"
Kubernetes Controller Manager logs

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_control_plane_component" AND
resource.labels.component_name="controller-manager" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>"
Stdout container logs across all TPU nodes with the same prefix

Variables to replace: <TPU_NODE_PREFIX>

resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"=~"<TPU_NODE_PREFIX>.*" AND
log_id("stdout")
Container error logs across all TPU nodes with the same prefix

Variables to replace: <TPU_NODE_PREFIX>

resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"=~"<TPU_NODE_PREFIX>.*" AND
log_id("stderr") AND
severity=ERROR
Stdout container logs from the same GKE Job

Variables to replace: <JOB_NAME>

resource.type="k8s_container" AND
labels."k8s-pod/batch.kubernetes.io/job-name" = "<JOB_NAME>" AND
log_id("stdout")
Container error logs from the same GKE Job

Variables to replace: <JOB_NAME>

resource.type="k8s_container" AND
labels."k8s-pod/batch.kubernetes.io/job-name"="<JOB_NAME>" AND
log_id("stderr") AND
severity=ERROR
Stdout container logs from the same GKE JobSet

Variables to replace: <JOBSET_NAME>

resource.type="k8s_container" AND
labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="<JOBSET_NAME>" AND
log_id("stdout")
Container error logs from the same GKE JobSet

Variables to replace: <JOBSET_NAME>

resource.type="k8s_container" AND
labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="<JOBSET_NAME>" AND
log_id("stderr") AND
severity=ERROR
Node auto-repair events

Variables to replace: <CLUSTER_NAME>

resource.type="gke_nodepool" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.container.v1.ClusterManager.RepairNodePool"
Cluster deletion events

Variables to replace: <CLUSTER_NAME>

resource.type="gke_cluster" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
SEARCH(protoPayload.methodName, "DeleteCluster")
Pod IP assignment and release

Variables to replace: <CLUSTER_NAME>, <POD_NAME>

resource.type="k8s_cluster" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
protoPayload.resourceName:"<POD_NAME>" AND
((protoPayload.methodName="io.k8s.core.v1.pods.status.patch" AND
  protoPayload.request.status.podIP:*) OR
 (protoPayload.methodName="io.k8s.core.v1.pods.delete" AND
  protoPayload.response.status.podIP:*))

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Google
Publisher
Google (Official)
Source
google/skills · skills/cloud/cloud-logging-query-generation · commit 2194d3b
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Google.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download cloud-logging-query-generation.zip