Google Cloud Logging Ruby: Cannot find certain logs

Question

I am having an issue finding logs from the google-cloud-logging ruby gem.

I can find these logs through my google cloud console with the advanced search: jsonPayload.requestId=875325619

Which returns multiple results, one basic example:

{ insertId: "epfh5dffj67k5" jsonPayload: { requestId: 875325619 request: {…} timeSeconds: 5.296060973778367 } resource: { type: "gce_instance" labels: {…} } timestamp: "2017-05-08T19:31:20.145488859Z" severity: "WARNING" logName: "projects/myproject/logs/mylog" }

However through the ruby agent this returns an empty array:

logging = Google::Cloud::Logging.new logging.entries filter: "jsonPayload.requestId=875325619" => []

However looking for a different log message I send works:

logging.entries filter: 'jsonPayload.uploadKey="example"' [#<Google::Cloud::Logging::Entry:0x00000008e6ea30 (data here)>]

That data looks like this:

{ insertId: "8w81fbg2a077zl" jsonPayload: { processingTime: 0.79228602 uploadType: "type" uploadKey: "example" } resource: { type: "gce_instance" labels: {…} } timestamp: "2017-05-08T18:58:11Z" labels: {…} logName: "projects/myproject/logs/otherapp" }

Why can I find one set of log messages and not the other?

Answer 1

Edit:

It may take longer time for Stackdriver Logging to search through entries with just unindexed fields, such as jsonPayload.FIELD. The service may return the first page of result after a certain time limit, even if that first page is empty. You will be able to query through all the pages by calling: logging.entries(filter: "jsonPayload.requestId=875325619").all.to_a

Note this may fire multiple requests and take longer time.

One thing I find helpful is to always restrict the filter by including the indexed fields. Namely the resource.type field.

If you change your query code to:

logging.entries filter: "resource.type=gce_instance AND jsonPayload.requestId=875325619"

it should return the correct entries and run faster.