gcloud-help/gcloud/logging/read

NAME
    gcloud logging read - read log entries

SYNOPSIS
    gcloud logging read [LOG_FILTER] [--freshness=FRESHNESS; default="1d"]
        [--order=ORDER; default="desc"]
        [--billing-account=BILLING_ACCOUNT_ID | --folder=FOLDER_ID
          | --organization=ORGANIZATION_ID | --project=PROJECT_ID]
        [--bucket=BUCKET --location=LOCATION --view=VIEW] [--limit=LIMIT]
        [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
    gcloud logging read reads log entries. Log entries matching log-filter are
    returned in order of decreasing timestamps, most-recent entries first. If
    the log entries come from multiple logs, then entries from different logs
    might be intermingled in the results.

EXAMPLES
    To read log entries from Google Compute Engine instances, run:

        $ gcloud logging read "resource.type=gce_instance"

    To read log entries with severity ERROR or higher, run:

        $ gcloud logging read "severity>=ERROR"

    To read log entries written in a specific time window, run:

        $ gcloud logging read \
            'timestamp<="2015-05-31T23:59:59Z" AND
         timestamp>="2015-05-31T00:00:00Z"'

    To read up to 10 log entries in your project's syslog log from Compute
    Engine instances containing payloads that include the word SyncAddress and
    format the output in JSON format, run:

        $ gcloud logging read \
            "resource.type=gce_instance AND \
        logName=projects/[PROJECT_ID]/logs/syslog AND \
        textPayload:SyncAddress" --limit=10 --format=json

    To read a log entry from a folder, run:

        $ gcloud logging read "resource.type=global" --folder=[FOLDER_ID] \
            --limit=1

    To read a log entry from a global log bucket, run:

        $ gcloud logging read --bucket=<bucket-id> --location=[LOCATION] \
            --limit=1

    To read a log entry from the global Required log bucket using the bucket's
    Default log view:

        $ gcloud logging read "" --bucket=_Required --location=global \
            --view=_Default --limit=1

    To read a log entry from a log bucket using the bucket's AllLogs log view:

        $ gcloud logging read "" --bucket=[BUCKET_ID] \
            --location=[LOCATION] --view=_AllLogs --limit=1

    To read a log entry from a log bucket using a custom log view that you have
    created for the bucket:

        $ gcloud logging read "" --bucket=[BUCKET_ID] \
            --location=[LOCATION] --view=[VIEW_ID] --limit=1

POSITIONAL ARGUMENTS
     [LOG_FILTER]
        Filter expression that specifies the log entries to return. Detailed
        information about filters can be found at:
        https://cloud.google.com/logging/docs/view/logging-query-language

FLAGS
     --freshness=FRESHNESS; default="1d"
        Return entries that are not older than this value. Works only with DESC
        ordering and filters without a timestamp. See $ gcloud topic datetimes
        for information on duration formats.

     --order=ORDER; default="desc"
        Ordering of returned log entries based on timestamp field. ORDER must
        be one of: desc, asc.

     At most one of these can be specified:

       --billing-account=BILLING_ACCOUNT_ID
          Read log entries associated with this billing account.

       --folder=FOLDER_ID
          Read log entries associated with this folder.

       --organization=ORGANIZATION_ID
          Read log entries associated with this organization.

       --project=PROJECT_ID
          Read log entries associated with this project.

          The Google Cloud project ID to use for this invocation. If omitted,
          then the current project is assumed; the current project can be
          listed using gcloud config list --format='text(core.project)' and can
          be set using gcloud config set project PROJECTID.

          --project and its fallback core/project property play two roles in
          the invocation. It specifies the project of the resource to operate
          on. It also specifies the project for API enablement check, quota,
          and billing. To specify a different project for quota and billing,
          use --billing-project or billing/quota_project property.

     These arguments are used in conjunction with the parent to construct a
     view resource.

       --bucket=BUCKET
          Id of the log bucket. If this argument is provided then --location
          and --view must also be specified.

          This flag argument must be specified if any of the other arguments in
          this group are specified.

       --location=LOCATION
          Location of the log bucket. If this argument is provided then
          --bucket and --view must also be specified.

          This flag argument must be specified if any of the other arguments in
          this group are specified.

       --view=VIEW
          Id of the view. If this argument is provided then --location and
          --bucket must also be specified.

          This flag argument must be specified if any of the other arguments in
          this group are specified.

LIST COMMAND FLAGS
     --limit=LIMIT
        Maximum number of resources to list. The default is unlimited. This
        flag interacts with other flags that are applied in this order:
        --flatten, --sort-by, --filter, --limit.

GCLOUD WIDE FLAGS
    These flags are available to all commands: --access-token-file, --account,
    --billing-project, --configuration, --flags-file, --flatten, --format,
    --help, --impersonate-service-account, --log-http, --project, --quiet,
    --trace-token, --user-output-enabled, --verbosity.

    Run $ gcloud help for details.

NOTES
    These variants are also available:

        $ gcloud alpha logging read

        $ gcloud beta logging read