How can I transfer logs from Logs Viewer of GCP to Slack or email?

Question

I have been exploring to transfer the JsonPayload message field from Logs viewer service (which are syslogs of a service) of GCP to a slack network, but owing to this I am not able to find any predefined services (like alerting policies to transfer Payload) available on Stackdriver. I have been able to create a counter or distribution user-metrics for logs but this will only provide me with some int64 value instead of a string value or the actual message body. Is there a way in GCP to actually send a payload of logs over slack or any email?

Do you want to transfer existing Stackdriver log entries to Slack or setup a service to send new log entries to Slack? Neither is directly supported by GCP, but you can create a log sink, write a Cloud Function to process new entries and post to Slack via a WebHook. — John Hanley, Apr 15 '20 at 19:31
I would create this in the first step before creating a new service and send logs from the start irrespective of old and new. Where would log sink send the data to? Would it be a BigQuery or Pubsub? — john mich, Apr 16 '20 at 15:26
If you are using a Cloud Function to post to Slack, you would use Pub/Sub. — John Hanley, Apr 16 '20 at 15:48

score 1 · Answer 1 · answered Apr 15 '20 at 18:02

1

In GCP, you can export logs to Pub/Sub, Cloud Storage, or BigQuery. There is no other way within GCP to export logs at the moment.

answered Apr 15 '20 at 18:02

Jason Gawrych

120
5

score 1 · Accepted Answer · edited Jun 08 '21 at 20:21

1

We had a similar issue where we wanted to be able to send certain events to slack and for fatal issues trigger an issue with our ops team via VictorOps.

Couldn't find anything out there to fit our needs so we just created our own slack / VictorOps Cloudfunction.

https://github.com/patiently/gcloud-slack-logger

edited Jun 08 '21 at 20:21

Dharman

30,962
25
85
135

answered Jun 08 '21 at 20:16

pgilmore

96
3

This is some good development, thanks! – john mich Feb 16 '22 at 17:21

score 1 · Answer 3 · answered Apr 18 '22 at 18:44

As of 2022, I found this can be done as follows:

In GCP Logs viewer (not legacy version) choose the create alert button.. One of the options here is a GCP notification channel, which supports slack. Some points here:

The slack channel can't be private as far as I can tell
Slack channel must be in your correct slack space. If your org has multiple slack spaces, make sure GCP is trying to connect to correct one.

Put in the log query criteria you want. THen go into Monitoring and you will see this in Alerting dropdown.

How can I transfer logs from Logs Viewer of GCP to Slack or email?

3 Answers3