2

I'm trying to use gcloud logging along with regular expression. My query works in the console but I can't get it going via the CLI.

gcloud logging read "resource.type=gce_instance AND protoPayload.authenticationInfo.principalEmail=~'.*@example.com.au'" --limit=10 --format=json

I get the error:

ERROR: (gcloud.logging.read) INVALID_ARGUMENT: Unparseable filter: unrecognized node at token 'MEMBER'

I've tried with and without various quotes '' "" "\"\

I also have the same trouble when doing timestamp dates as well:

gcloud logging read "resource.type=gce_instance AND timestamp > '2021-06-15T00:00:00.000000Z'"

I get the error:

ERROR: (gcloud.logging.read) INVALID_ARGUMENT: Unparseable filter: syntax error at line 1, column 112, token ':';
Wytrzymały Wiktor
  • 11,492
  • 5
  • 29
  • 37
Ari
  • 5,301
  • 8
  • 46
  • 120
  • I'm getting the same error. Can you update your question with more details about how you're doing this using console ? – Wojtek_B Sep 14 '21 at 12:47
  • @Wojtek_B using Cloud Logging via the console my query would look like: `resource.type="gce_instance" AND protoPayload.authenticationInfo.principalEmail =~ ".*@example.com.au"`. My intent is to find active users in projects that shouldn't be used. The above doesn't work within the python SDK. – Ari Sep 14 '21 at 14:40

1 Answers1

2

Your first gcloud expression should look like this:

cloud logging read "resource.type=gce_instance AND protoPayload.authenticationInfo.principalEmail:'.*@example.com.au'"

I changed = sign to :.

And the second one like this:

gcloud logging read 'resource.type=gce_instance AND timestamp > "2021-08-15T00:00:00.000000Z"'

I exchanged single with double quotes (literally).

It's best to have a quick look at the gcloud logging read command documentation (I figured out a proper syntax this way).

Wojtek_B
  • 4,245
  • 1
  • 7
  • 21
  • 1
    Thanks again. I spent half the day learning Cloud Logging queries via the console then tried to jump into using gcloud and just hit a block. But looks like each has its own variation of the language. – Ari Sep 16 '21 at 02:12