Stay organized with collections
Save and categorize content based on your preferences.
This document explains common issues that you might encounter when using
the Logging query language.
Syntax issues
If you have problems with your queries' expressions, check the
following:
Your query obeys the syntax rules, with matched parentheses and quotation
marks.
Your log entry field names are correctly spelled.
Boolean operations are in uppercase letters (AND, OR, NOT).
Ensure that you're using
NULL_VALUE
to represent JSON null values.
Boolean expressions as global restrictions or as the right-hand side of
comparisons should be parenthesized for clarity. For example, the
following two queries look the same, but are not:
insertId = "ABC-1" OR "ABC-2" -- ERROR!?
insertId = ("ABC-1" OR "ABC-2")
Unquoted text must not contain any special characters. When in doubt, add
double quotation marks. For example, in the following, the first comparison
is illegal
because of the embedded substring operator (:). The comparison must be
written with quotation marks:
The Google Cloud CLI requires
the query to be in double quotes. To use double quotes for escaping special
characters using the gcloud logging command, wrap the entire query with
single quotes instead:
When you are filtering on a field that is associated with the
Any
message type, the value field is automatically traversed. Therefore,
don't include value in the query.
For example, the
Status
field in an
AuditLog
message has a details field that is of type google.protobuf.Any.
To query the details field, omit the value field when specifying the
filter:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[],[],null,["# Troubleshoot Logging query language\n\nThis document explains common issues that you might encounter when using\nthe Logging query language.\n\n### Syntax issues\n\nIf you have problems with your queries' expressions, check the\nfollowing:\n\n- Your query obeys the syntax rules, with matched parentheses and quotation\n marks.\n\n- Your log entry field names are correctly spelled.\n\n- Boolean operations are in uppercase letters (`AND`, `OR`, `NOT`).\n\n- Ensure that you're using\n [`NULL_VALUE`](https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#nullvalue)\n to represent JSON null values.\n\n- Boolean expressions as global restrictions or as the right-hand side of\n comparisons should be parenthesized for clarity. For example, the\n following two queries look the same, but are not:\n\n ```\n insertId = \"ABC-1\" OR \"ABC-2\" -- ERROR!?\n insertId = (\"ABC-1\" OR \"ABC-2\")\n ```\n- Unquoted text must not contain any special characters. When in doubt, add\n double quotation marks. For example, in the following, the first comparison\n is illegal\n because of the embedded substring operator (`:`). The comparison must be\n written with quotation marks:\n\n ```\n insertId = abc:def -- ILLEGAL!\n insertId = \"abc:def\"\n ```\n | **Note:** If you use the search bar and if you don't wrap the search terms in double quotes, then the [`SEARCH` function](/logging/docs/view/logging-query-language#search-functions) is used. The `SEARCH` function performs a search along token boundaries. For example, if you enter `world` in the search bar, then Logging runs the query `SEARCH(\"world\")`. The previous query matches `world` but it doesn't match `worlds`.\n- The [Google Cloud CLI](/logging/docs/reference/tools/gcloud-logging) requires\n the query to be in double quotes. To use double quotes for escaping special\n characters using the `gcloud logging` command, wrap the entire query with\n single quotes instead:\n\n ```\n gcloud logging read 'resource.type=gce_instance AND jsonPayload.message=\"Stopped Unattended Upgrades Shutdown.\"'\n gcloud logging read 'timestamp\u003e=\"2020-06-17T21:00:00Z\"'\n ```\n\n- When you are filtering on a field that is associated with the\n [`Any`](https://github.com/protocolbuffers/protobuf/blob/main/src/google/protobuf/any.proto)\n message type, the `value` field is automatically traversed. Therefore,\n don't include `value` in the query.\n\n For example, the\n [`Status`](https://github.com/grpc/grpc/blob/master/src/proto/grpc/status/status.proto)\n field in an\n [`AuditLog`](/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog)\n message has a `details` field that is of type `google.protobuf.Any`.\n To query the `details` field, omit the `value` field when specifying the\n filter:\n - Do\n\n ```\n protoPayload.status.details.conditionNotMet.userVisibleMessage =~ \"Specified reservation.*\"\n ```\n - Don't\n\n ```\n protoPayload.status.details.value.conditionNotMet.userVisibleMessage =~ \"Specified reservation.*\"\n ```"]]
