1

I am having problem while trying to filter my log files to a specific period of time. Everything beside timestamps works fine when i'm trying to write a command. The moment everything looks good:

gcloud logging read "resource.type=XXX logName=projects/YYY/logs/appengine.googleapis.com%2Fnginx.health_check" > test.txt

All other things like --limit or --freshness are working without problems, but when i'm trying to get a period of time in my text file the command stops working. I'm getting information:

The file name, directory name, or volume label syntax is incorrect.

I've tried many things and this is command which gives me some error at least:

gcloud logging read "resource.type=XXX logName=projects/YYY/logs/appengine.googleapis.com%2Fnginx.health_check timestamp='2020-01-22T14:02:41.41Z'"

Please help me with correct syntax of specifying timestamps to get any period of time as a result.

mackowi
  • 41
  • 5

2 Answers2

3

I got it!

gcloud logging read "resource.type=XXX logName=projects/YYY/logs/appengine.googleapis.com%2Fnginx.health_check timestamp^>=""2020-01-21T11:00:00Z"" timestamp^<=""2020-01-22T11:00:00Z""" >t.txt

I found it here: Find logs between timestamps using stackdriver CLI

Thank you Braulio Baron for your help!

mackowi
  • 41
  • 5
0

The syntax error is in the timestamp, it should be with \ before the date's quotes:

gcloud logging read "resource.type=gae_app AND logName=projects/xxxx/logs/syslog AND timestamp=\"2020-01-22T14:02:41.41Z\""

For more detail have a look into gcloud logging read

Joss Baron
  • 1,441
  • 10
  • 13
  • Your command's working but whenever i'm putting "<" or ">"symbol to it, it stops working. As i mentioned i need a period of time for example between 21.01 and 22.01. I made this command with your hints but still got some problems: gcloud logging read "resource.type=XXX AND logName=projects/YYY/logs/appengine.googleapis.com%2Fnginx.health_check" AND timestamp>=\"2020-01-21T12:00:00Z\" timestamp<=\"2020-01-22T12:00:00Z\" – mackowi Jan 23 '20 at 09:34
  • Try adding `AND` in the last part, it should be like this: `gcloud logging read "resource.type=XXX AND logName=projects/YYY/logs/appengine.googleapis.com%2Fnginx.health_check AND timestamp>=\"2020-01-21T12:00:00Z\" AND timestamp<=\"2020-01-22T12:00:00Z\" "` – Joss Baron Jan 23 '20 at 15:06
  • Unfortunately it's not working. Whenever i'm using "<" i'm getting: "The file name, directory name, or volume label syntax is incorrect." Maybe i can do what i want by making command to give back logs before some date and limit it with "--limit" but even this doesn't work for me. – mackowi Jan 23 '20 at 15:22
  • I found command which passes, but gives me no logs in command window or in text file it's making: `gcloud beta logging read "timestamp^>=""2020-01-21T11:00:00Z"" AND ""timestamp^<2020-01-22T11:00:00Z"""` – mackowi Jan 23 '20 at 15:34