skilld
All skills
google avatar

/cloud-logging-query-generation

@becc4b8
by googlegoogle/skills21k stars
1,698

Generates Logging Query Language (LQL) queries for Google Cloud Logging from natural language. Use this skill when you need to query log data or when you are debugging issues. You can filter log data by Google Cloud service. Don't use this skill to query other databases, such as SQL or Cloud Spanner.

Ask your Agent

Use this Skill: https://skilld.dev/gh/google/skills/cloud-logging-query-generation

This session only. Nothing lands on disk.

referencesquery_gke.md

≈6k tokens on demand. Your agent reads this file only when SKILL.md points to it.

Kubernetes Engine (GKE) LQL queries

Table of contents

Base schema and structural patterns

GKE logs are split across multiple resource.type values depending on what generated the log. Always constrain your query to the correct resource type first before searching payloads.

Resource types

  • Containers (k8s_container): Use for application logs, standard out (textPayload), and structured JSON logs (jsonPayload) emitted by your workloads. This is the most common resource type for debugging applications.
  • Pods (k8s_pod): Use for Kubernetes pod lifecycle events (for example, evictions, scheduling gaps, readiness probes).
  • Nodes (k8s_node): Use for infrastructure-level node events (for example, kubelet errors, container runtime logs, node auto-repair).
  • Cluster/Control Plane (k8s_cluster or gke_cluster): Use for control plane logs (API server, scheduler, controller-manager) and cluster-level operations. Kubernetes-native components log to k8s_cluster, while GCP infrastructure operations (like deleting the GKE cluster) log to gke_cluster.

Application logs (stdout / stderr) pattern

When a user asks to search for "errors in my application", "logs from the foo-pod", or "stdout from a container":

  • Target resource.type="k8s_container".
  • Filter by resource.labels.pod_name, resource.labels.container_name, or resource.labels.namespace_name.
  • The raw log string is found in textPayload (unstructured) or jsonPayload (structured log records).

Kubernetes events pattern

When a user asks about Kubernetes events like Pod evictions, Node scaling, or BackOffs:

  • Filter by log_id("events").
  • Search within jsonPayload.reason (for example, "Evicted", "FailedScheduling", "BackOff") and jsonPayload.message.

System and control plane logs pattern

When debugging GKE internal infrastructure (for example, ingress controllers, kube-dns):

  • Target the kube-system namespace (resource.labels.namespace_name="kube-system").
  • Control plane components generally log under the k8s_cluster resource type.

Google Cloud vs Kubernetes Audit Logs

When auditing infrastructure (for example, who created the GKE cluster itself), this falls under general Google Cloud API audit logs. However, when auditing inside the cluster (for example, who deleted a Namespace or Pod):

  • Target resource.type="k8s_cluster".
  • Filter by log_id("cloudaudit.googleapis.com/activity") (or data_access).
  • Search within protoPayload.methodName using native Kubernetes API strings (for example, "io.k8s.core.v1.namespaces.create").

User-defined Kubernetes labels gotcha

When filtering by custom Kubernetes pod labels (like app: my-app or tier: backend), do NOT look in resource.labels or labels.app (or similar unwrapped keys). Cloud Logging stores custom Kubernetes metadata in the global labels object, automatically prefixed with "k8s-pod/".

  • Example: labels."k8s-pod/app"="my-app"

Example queries

Cluster logs in a specific Google Cloud location

Variables to replace: <LOCATION>

resource.type="k8s_cluster" AND
resource.labels.location="<LOCATION>"

Pod eviction events

Variables to replace: None

resource.type="k8s_pod" AND
log_id("events") AND
jsonPayload.reason="Evicted"

Container errors from a specific pod

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
severity=ERROR

Google Kubernetes Engine cluster operations

Variables to replace: None

resource.type="gke_cluster" AND
log_id("cloudaudit.googleapis.com/activity")

Google Kubernetes Engine cluster creation

Variables to replace: None

resource.type="gke_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.container.v1.ClusterManager.CreateCluster"

Kubernetes cluster deployment

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "deployments")

Kubernetes cluster authentication failure

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.authenticationInfo.principalEmail="system:anonymous"

Kubernetes cluster operations and events in us-central1-b

Variables to replace: None

resource.type="k8s_cluster" AND
resource.labels.location="us-central1-b"

Kubernetes pod requests from users

Variables to replace: <USER_EMAIL>

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "io.k8s.core.v1.pods") AND
protoPayload.authenticationInfo.principalEmail="<USER_EMAIL>"

Kubernetes events

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("events")

Kubernetes endpoints update

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.request.kind="Endpoints"

Kubernetes control plane logs

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="k8s.io"

Kubernetes Engine control plane logs

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.serviceName="container.googleapis.com"

Pod deletion

Variables to replace: None

resource.type="k8s_cluster" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName=~"io\.k8s\.core\.v1\.pods\.(create|delete)"

Kubernetes pod audit logs from control plane

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>, <POD_NAME>, <POD_NAMESPACE>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.resourceName="core/v1/namespaces/<POD_NAMESPACE>/pods/<POD_NAME>"

Kubernetes pod evictions

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="io.k8s.core.v1.pods.eviction.create"

Kubernetes node audit logs from the control plane

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
SEARCH(protoPayload.methodName, "io.k8s.core.v1.nodes")

Kubernetes cluster control plane for Addon Manager Activity

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.authenticationInfo.principalEmail="system:addon-manager"

Kubernetes control plane errors (excluding Conflict , which is normal)

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.status.message!="Conflict" AND
protoPayload.status.code!=0

Ingress Controller events

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="loadbalancer-controller"

Service Controller events (kube-controller-manager)

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="service-controller"

Cluster Autoscaler events

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="cluster-autoscaler"

Cluster Autoscaler scale up failures (visibility logs)

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_cluster" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("container.googleapis.com/cluster-autoscaler-visibility") AND
jsonPayload.resultInfo.results.errorMsg.messageId:"scale.up"

Query pod during creation

Variables to replace: <POD_NAME>

resource.type="k8s_pod" AND
resource.labels.pod_name="<POD_NAME>" AND
log_id("events")

Scheduler events

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_pod" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="default-scheduler"

Scheduler events (preemptions)

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_pod" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("events") AND
jsonPayload.source.component="default-scheduler" AND
jsonPayload.reason="Preempted"

Node events

Variables to replace: None

resource.type="k8s_node" AND
log_id("events")

Out of memory (OOM) events

Variables to replace: None

resource.type="k8s_node"
log_id("events")
(jsonPayload.reason:("OOMKilling" OR "SystemOOM")
  OR jsonPayload.message:("OOM encountered" OR "out of memory"))

Looking at Kube-proxy logs

Variables to replace: None

resource.type="k8s_node" AND
log_id("kube-proxy")

Looking at dockerd logs

Variables to replace: None

resource.type="k8s_node" AND
log_id("container-runtime")

Looking at kubelet errors or failures

Variables to replace: None

resource.type="k8s_node" AND
log_id("kubelet") AND
jsonPayload.MESSAGE:("error" OR "fail")

Looking at node logs for GKE system logs

Variables to replace: None

resource.type = "k8s_node" AND
logName:( "logs/container-runtime" OR
"logs/docker" OR
"logs/kube-container-runtime-monitor" OR
"logs/kube-logrotate" OR
"logs/kube-node-configuration" OR
"logs/kube-node-installation" OR
"logs/kubelet" OR
"logs/kubelet-monitor" OR
"logs/node-journal" OR
"logs/node-problem-detector")

Container and pod logs for GKE system logs

Variables to replace: None

resource.type = ("k8s_container" OR "k8s_pod") AND
resource.labels.namespace_name = (
"cnrm-system" OR
"config-management-system" OR
"gatekeeper-system" OR
"gke-connect" OR
"gke-system" OR
"istio-system" OR
"knative-serving" OR
"monitoring-system" OR
"kube-system")

Stdout container logs across all pods and containers in a cluster

Variables to replace: None

resource.type="k8s_container" AND
log_id("stdout")

Container error logs across all pods and containers in a cluster

Variables to replace: None

resource.type="k8s_container" AND
log_id("stderr") AND
severity=ERROR

Container error logs for a pod with a specific name

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
severity=ERROR

Container error logs for a specific container in a specific pod

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
resource.labels.container_name="server" AND
severity=ERROR

Container error logs for a specific namespace and container

Variables to replace: None

resource.type="k8s_container" AND
resource.labels.namespace_name="istio-system" AND
resource.labels.container_name="egressgateway" AND
severity=ERROR

Container logs for a pod with a specific label

Variables to replace: None

resource.type="k8s_container" AND
labels."k8s-pod/app"="loadgenerator" AND
severity=ERROR

Container error logs for pods running on a specific node

Variables to replace: <NODE_NAME>

resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"="<NODE_NAME>" AND
severity=ERROR

Container logs for a pod with a label generated using skaffold

Variables to replace: <SKAFFOLD_RUN_ID>

resource.type="k8s_container" AND
labels."k8s-pod/app"="loadgenerator" AND
labels."k8s-pod/skaffold_dev/run-id"="<SKAFFOLD_RUN_ID>" AND
severity=ERROR

Container error logs for a specific pod containing a POST in the textPayload

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
textPayload:"POST" AND
severity=ERROR

Container error logs for a specific pod containing a GET in the structured JSON

Variables to replace: <POD_NAME>

resource.type="k8s_container" AND
resource.labels.pod_name="<POD_NAME>" AND
jsonPayload."http.req.method"="GET" AND
severity=ERROR

Container errors logs in the kube-system namespace

Variables to replace: None

resource.type="k8s_container" AND
resource.labels.namespace_name="kube-system" AND
severity=ERROR

Container error in the container insights log

Variables to replace: None

resource.type="k8s_container" AND
log_id("clouderrorreporting.googleapis.com/insights")

Kubernetes container logs

Variables to replace: <CONTAINER_NAME>

resource.type="k8s_container" AND
resource.labels.container_name="<CONTAINER_NAME>"

Kubernetes API server logs

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_control_plane_component" AND
resource.labels.component_name="apiserver" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>"

Kubernetes Scheduler logs

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_control_plane_component" AND
resource.labels.component_name="scheduler" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>"

Kubernetes Controller Manager logs

Variables to replace: <CLUSTER_LOCATION>, <CLUSTER_NAME>

resource.type="k8s_control_plane_component" AND
resource.labels.component_name="controller-manager" AND
resource.labels.location="<CLUSTER_LOCATION>" AND
resource.labels.cluster_name="<CLUSTER_NAME>"

Stdout container logs across all TPU nodes with the same prefix

Variables to replace: <TPU_NODE_PREFIX>

resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"=~"<TPU_NODE_PREFIX>.*" AND
log_id("stdout")

Container error logs across all TPU nodes with the same prefix

Variables to replace: <TPU_NODE_PREFIX>

resource.type="k8s_container" AND
labels."compute.googleapis.com/resource_name"=~"<TPU_NODE_PREFIX>.*" AND
log_id("stderr") AND
severity=ERROR

Stdout container logs from the same GKE Job

Variables to replace: <JOB_NAME>

resource.type="k8s_container" AND
labels."k8s-pod/batch.kubernetes.io/job-name" = "<JOB_NAME>" AND
log_id("stdout")

Container error logs from the same GKE Job

Variables to replace: <JOB_NAME>

resource.type="k8s_container" AND
labels."k8s-pod/batch.kubernetes.io/job-name"="<JOB_NAME>" AND
log_id("stderr") AND
severity=ERROR

Stdout container logs from the same GKE JobSet

Variables to replace: <JOBSET_NAME>

resource.type="k8s_container" AND
labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="<JOBSET_NAME>" AND
log_id("stdout")

Container error logs from the same GKE JobSet

Variables to replace: <JOBSET_NAME>

resource.type="k8s_container" AND
labels."k8s-pod/jobset_sigs_k8s_io/jobset-name"="<JOBSET_NAME>" AND
log_id("stderr") AND
severity=ERROR

Node auto-repair events

Variables to replace: <CLUSTER_NAME>

resource.type="gke_nodepool" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="google.container.v1.ClusterManager.RepairNodePool"

Cluster deletion events

Variables to replace: <CLUSTER_NAME>

resource.type="gke_cluster" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
SEARCH(protoPayload.methodName, "DeleteCluster")

Pod IP assignment and release

Variables to replace: <CLUSTER_NAME>, <POD_NAME>

resource.type="k8s_cluster" AND
resource.labels.cluster_name="<CLUSTER_NAME>" AND
protoPayload.resourceName:"<POD_NAME>" AND
((protoPayload.methodName="io.k8s.core.v1.pods.status.patch" AND
  protoPayload.request.status.podIP:*) OR
 (protoPayload.methodName="io.k8s.core.v1.pods.delete" AND
  protoPayload.response.status.podIP:*))

Source: SKILL.md on GitHub

Third-party checks

No alerts9d3 checks · Risk SAFE
  • Gen Agent Trust Hub9d

    This skill is designed to generate Logging Query Language (LQL) queries for Google Cloud Logging from natural language input. It provides comprehensive reference guides, syntax rules, and examples for various Google Cloud services. No security issues were detected.

  • Socket9d

    No alerts

  • Snyk9d

    Risk: LOW · No issues

Provenance

Signed by skilld at becc4b8. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 2 weeks ago

Capability

metadata
{
  "version": "1.0.0",
  "category": "CloudObservabilityAndMonitoring"
}

README badge

README badge for google/skills/cloud-logging-query-generation