Goal

Inspect Cloud Logging and Cloud Monitoring data quickly and repeatably from the terminal.

Inputs to collect (ask only if missing)

• project_id

• time_window for investigation (for example: last 30m , 2h , or explicit UTC start/end )

• service/resource context (cloud_run_revision , k8s_container , gce_instance , load balancer, etc.)

• signals of interest (errors, latency, CPU, memory, request count, restarts)

• output_format (table for quick scans, json for deeper analysis)

Execution workflow

• Validate prerequisites: bash .agents/skills/gcp-logs-monitoring/scripts/check_prereqs.sh --project <project_id>

• Query Cloud Logging: bash .agents/skills/gcp-logs-monitoring/scripts/read_logs.sh --project <project_id> --filter '<LOG_FILTER>' --freshness 1h --limit 100 --format json

• Query Cloud Monitoring time series: bash .agents/skills/gcp-logs-monitoring/scripts/read_metrics.sh --project <project_id> --filter '<METRIC_FILTER>' --start <UTC_ISO8601> --end <UTC_ISO8601> --format json

• Correlate timestamps between logs and metrics, then summarize likely root cause and next checks.

Common filter templates

Cloud Logging

• Cloud Run errors: resource.type="cloud_run_revision" severity>=ERROR

• GKE container errors: resource.type="k8s_container" severity>=ERROR

• HTTP 5xx in load balancer logs: resource.type="http_load_balancer" jsonPayload.statusDetails=~"5.."

• Timeout text search: textPayload:"timeout" OR jsonPayload.message:"timeout"

Cloud Monitoring

• Cloud Run request count: metric.type="run.googleapis.com/request_count" AND resource.type="cloud_run_revision"

• Cloud Run request latencies: metric.type="run.googleapis.com/request_latencies" AND resource.type="cloud_run_revision"

• VM CPU utilization: metric.type="compute.googleapis.com/instance/cpu/utilization" AND resource.type="gce_instance"

Guardrails

• Prefer passing --project on every command instead of changing global gcloud config.

• Start with short windows (15m to 2h ) and widen only when needed.

• Use --format json when output will be parsed or compared across sources.

• If auth or project checks fail, fix environment first and then re-run queries.