gcloud-help/gcloud/alpha/logging/read

NAME
    gcloud alpha logging read - read log entries

SYNOPSIS
    gcloud alpha logging read [LOG_FILTER]
        [--freshness=FRESHNESS; default="1d"] [--order=ORDER; default="desc"]
        [--billing-account=BILLING_ACCOUNT_ID | --folder=FOLDER_ID
          | --organization=ORGANIZATION_ID | --project=PROJECT_ID]
        [--resource-names=[RESOURCE,...]
          | --bucket=BUCKET --location=LOCATION --view=VIEW] [--limit=LIMIT]
        [GCLOUD_WIDE_FLAG ...]

DESCRIPTION
    (ALPHA) gcloud alpha logging read reads log entries. Log entries matching
    log-filter are returned in order of decreasing timestamps, most-recent
    entries first. If the log entries come from multiple logs, then entries
    from different logs might be intermingled in the results.

EXAMPLES
    To read log entries from Google Compute Engine instances, run:

        $ gcloud alpha logging read "resource.type=gce_instance"

    To read log entries with severity ERROR or higher, run:

        $ gcloud alpha logging read "severity>=ERROR"

    To read log entries written in a specific time window, run:

        $ gcloud alpha logging read \
            'timestamp<="2015-05-31T23:59:59Z" AND
         timestamp>="2015-05-31T00:00:00Z"'

    To read up to 10 log entries in your project's syslog log from Compute
    Engine instances containing payloads that include the word SyncAddress and
    format the output in JSON format, run:

        $ gcloud alpha logging read \
            "resource.type=gce_instance AND \
        logName=projects/[PROJECT_ID]/logs/syslog AND \
        textPayload:SyncAddress" --limit=10 --format=json

    To read a log entry from a folder, run:

        $ gcloud alpha logging read "resource.type=global" \
            --folder=[FOLDER_ID] --limit=1

    To read a log entry from a global log bucket, run:

        $ gcloud alpha logging read --bucket=<bucket-id> \
            --location=[LOCATION] --limit=1

    To read a log entry from the global _Required log bucket using the bucket's
    _Default log view:

        $ gcloud alpha logging read "" --bucket=_Required \
            --location=global --view=_Default --limit=1

    To read a log entry from a log bucket using the bucket's _AllLogs log view:

        $ gcloud alpha logging read "" --bucket=[BUCKET_ID] \
            --location=[LOCATION] --view=_AllLogs --limit=1

    To read a log entry from a log bucket using a custom log view that you have
    created for the bucket:

        $ gcloud alpha logging read "" --bucket=[BUCKET_ID] \
            --location=[LOCATION] --view=[VIEW_ID] --limit=1

    To read log entries from multiple resources, specify them as a
    comma-delimeted sequence with --resource-names. Each resource name can be
    specified either as a top-level resource (e.g., projects/[PROJECT_ID],
    folders/[FOLDER_ID], etc.) or as a Log View resource (e.g.,
    projects/[PROJECT_ID]/locations/[LOCATION]/buckets/[BUCKET_NAME]/views/[VIEW_ID]).

        $ gcloud alpha logging read "" \
            --resource-names=[RESOURCE-1],[RESOURCE-2]

POSITIONAL ARGUMENTS
     [LOG_FILTER]
        Filter expression that specifies the log entries to return. Detailed
        information about filters can be found at:
        https://cloud.google.com/logging/docs/view/logging-query-language

FLAGS
     --freshness=FRESHNESS; default="1d"
        Return entries that are not older than this value. Works only with DESC
        ordering and filters without a timestamp. See $ gcloud topic datetimes
        for information on duration formats.

     --order=ORDER; default="desc"
        Ordering of returned log entries based on timestamp field. ORDER must
        be one of: desc, asc.

     At most one of these can be specified:

       --billing-account=BILLING_ACCOUNT_ID
          Billing account of the log entries to read.

       --folder=FOLDER_ID
          Folder of the log entries to read.

       --organization=ORGANIZATION_ID
          Organization of the log entries to read.

       --project=PROJECT_ID
          Project of the log entries to read.

          The Google Cloud project ID to use for this invocation. If omitted,
          then the current project is assumed; the current project can be
          listed using gcloud config list --format='text(core.project)' and can
          be set using gcloud config set project PROJECTID.

          --project and its fallback core/project property play two roles in
          the invocation. It specifies the project of the resource to operate
          on. It also specifies the project for API enablement check, quota,
          and billing. To specify a different project for quota and billing,
          use --billing-project or billing/quota_project property.

     At most one of these can be specified:

       --resource-names=[RESOURCE,...]
          Resource name(s) to read logs from. A resource can either be an
          top-level resource (e.g., "projects/my-project") or a full log view
          resource path (e.g.,
          "projects/my-project/locations/my-location/buckets/my-bucket/views/my-view").
          Multiple resources can be specified, separated by a comma.

       These arguments are used in conjunction with the parent to construct a
       view resource.

         --bucket=BUCKET
            Id of the log bucket. If this argument is provided then --location
            and --view must also be specified.

            This flag argument must be specified if any of the other arguments
            in this group are specified.

         --location=LOCATION
            Location of the log bucket. If this argument is provided then
            --bucket and --view must also be specified.

            This flag argument must be specified if any of the other arguments
            in this group are specified.

         --view=VIEW
            Id of the view. If this argument is provided then --location and
            --bucket must also be specified.

            This flag argument must be specified if any of the other arguments
            in this group are specified.

LIST COMMAND FLAGS
     --limit=LIMIT
        Maximum number of resources to list. The default is unlimited. This
        flag interacts with other flags that are applied in this order:
        --flatten, --sort-by, --filter, --limit.

GCLOUD WIDE FLAGS
    These flags are available to all commands: --access-token-file, --account,
    --billing-project, --configuration, --flags-file, --flatten, --format,
    --help, --impersonate-service-account, --log-http, --project, --quiet,
    --trace-token, --user-output-enabled, --verbosity.

    Run $ gcloud help for details.

NOTES
    This command is currently in alpha and might change without notice. If this
    command fails with API permission errors despite specifying the correct
    project, you might be trying to access an API with an invitation-only early
    access allowlist. These variants are also available:

        $ gcloud logging read

        $ gcloud beta logging read