How do I set a default limit and order?

The skill defaults are limit=20 and order=desc. You can override them by supplying --limit and --order in the command.

How should the filter string be written?

Use valid Cloud Logging filter syntax, combining resource types, severities, and labels. For example: resource.type=gae_app AND severity>=ERROR.

What happens if I omit the project?

The tool uses the active project from gcp-context. Provide --project to ensure the correct project is used.

Logging Read

npx machina-cli add skill yu-iskw/google-cloud-observability-plugin/logging-read --openclaw

Files (1)

SKILL.md

1.5 KB

Logs Read

Read log entries from Google Cloud Logging.

Purpose

Retrieve log entries based on a filter. This is the primary tool for investigating past events and errors.

Inputs

project (optional): The Google Cloud project ID to read logs from.
filter (optional): A valid Cloud Logging filter string. Defaults to empty (all logs).
limit (optional): Maximum number of entries to return. Defaults to 20. Max 1000.
order (optional): Sort order of entries (asc or desc). Defaults to desc (newest first).
freshness (optional): Only read entries as old as this duration (e.g., 1h, 5h, 1d).
bucket (optional): The log bucket to read from.
view (optional): The log view to read from.

Behavior

Validate that limit does not exceed 1000.
Construct the command with provided flags: gcloud logging read "[FILTER]" --project=[PROJECT] --limit=[LIMIT] --order=[ORDER] --format=json.
If project is not provided, use the active project from gcp-context.
Append --freshness=[FRESHNESS] if provided.
Append --bucket=[BUCKET] and --view=[VIEW] if provided.
Ensure the command is scoped to the target project.

Output

Returns a JSON list of log entries.

References

Source

git clone https://github.com/yu-iskw/google-cloud-observability-plugin/blob/main/skills/logging-read/SKILL.mdView on GitHub

Overview

Logs Read fetches entries from Google Cloud Logging using a filter. It supports optional project scoping, limit, order, freshness, bucket, and view, helping you investigate past events and errors efficiently.

How This Skill Works

It validates that limit does not exceed 1000, builds a gcloud logging read command with the provided filter and flags, and defaults to the active project if none is provided. It then appends freshness, bucket, and view when provided and returns a JSON array of log entries.

When to Use It

Investigate a specific error by filtering by severity and label
Audit activity in a project within a chosen time window
Fetch the most recent logs for a service to reproduce an incident
Read logs from a particular bucket or view for targeted analysis
Run a broad search to collect logs for correlation across services

Quick Start

Step 1: Ensure your target project is set (or provide --project). You can also set the active project with gcloud config set project PROJECT_ID.
Step 2: Create a filter string that captures the logs you want (e.g., resource.type=gae_app AND severity>=ERROR).
Step 3: Run the command and parse the JSON output, for example: gcloud logging read "[FILTER]" --project=PROJECT --limit=100 --order=desc --format=json

Best Practices

Keep limit under 1000 to avoid large responses
Write precise Cloud Logging filter strings to reduce noise
Use --format=json and parse programmatically
Use --freshness to bound historical data and reduce latency
Verify the active project or always set --project to avoid cross-project leakage

Example Use Cases

Read error logs for service-a in the last 2 hours: gcloud logging read "resource.type=service AND resource.labels.service_id=service-a AND severity>=ERROR" --limit=200 --order=desc --format=json
List 404 not found events for web app in the default project: gcloud logging read "httpRequest.status=404 AND resource.type=gae_app" --limit=100 --order=desc --format=json
Inspect user login failures across all regions for a project: gcloud logging read "protoPayload.methodName=Login AND severity>=WARNING" --limit=50 --format=json
Fetch logs from a specific bucket with a particular view: gcloud logging read "logName=projects/PROJECT/logs/cloud-ops" --bucket=my-bucket --view=FULL --format=json
Query logs using Cloud Logging query language to find latency spikes: gcloud logging read "resource.type=gae_app AND metric.latency>0.5" --limit=100 --format=json

Frequently Asked Questions

Add this skill to your agents