Cloud Logging

This chapter follows Protecting services with Cloud Armor. Cloud Logging centralizes logs from Google Cloud services and applications. Cloud Run automatically collects stdout and stderr from your container; the load balancer emits access logs when enabled.

Structured logs from Cloud Run

Logging agents parse JSON written to stdout when you include a severity field:

1
export function logInfo(message: string, extra: Record<string, unknown> = {}) {
2
  console.log(JSON.stringify({ severity: "INFO", message, ...extra }));
3
}
4

5
export function logError(message: string, err: unknown) {
6
  console.error(
7
    JSON.stringify({
8
      severity: "ERROR",
9
      message,
10
      error: err instanceof Error ? err.message : String(err),
11
    }),
12
  );
13
}

Use DEBUG, INFO, WARNING, ERROR, CRITICAL so Logs Explorer filters by severity.

When you propagate X-Cloud-Trace-Context, add logging.googleapis.com/trace in JSON to link logs to Cloud Trace (optional for the series).

Logs Explorer and the query language

Open Logging → Logs Explorer. Scope to your project and filter Cloud Run:

1
resource.type="cloud_run_revision"
2
resource.labels.service_name="file-api"
3
severity>=ERROR

Search message text:

1
jsonPayload.message:"upload"

Save useful queries as log-based metrics or pin them for on-call.

Buckets, retention, and views

Logs land in _Default and _Required buckets with default retention. Log buckets can be created with custom retention (for example 400 days for compliance).

Log views restrict which entries IAM principals can read inside a bucket—useful for separating security logs from application logs.

Sinks and exclusions

Log sinks export matching entries to BigQuery, Cloud Storage, or Pub/Sub for analysis or archival:

1
gcloud logging sinks create file-api-errors bigquery.googleapis.com/projects/YOUR_PROJECT_ID/datasets/logs \
2
  --log-filter='resource.type="cloud_run_revision" AND severity>=ERROR'

The sink’s writer identity needs permission to write the destination.

Exclusions drop noisy debug logs from storage to save cost—apply carefully so you do not hide incidents.

Audit logs

Admin Activity audit logs record configuration changes (IAM, firewall, Run deploy). Data Access logs record reads/writes to user data when enabled—higher volume and cost.

Review audit logs when investigating who changed Cloud Armor policies or IAM bindings.

Next: Cloud Monitoring turns metrics and SLOs into dashboards and alerts for the same service.