Your team is conducting a post-incident root-cause analysis for an outage affecting a microservice deployed on Google Kubernetes Engine (GKE). During the investigation, you must use the Logs Explorer to query ingested logs for entries that meet the following strict criteria: Originates from the GKE container resource type (k8s_container) Contains a severity level of ERROR or higher Occurred between 2024-10-15T14:00:00Z and 2024-10-15T14:30:00Z Contains a nested JSON payload field where jsonPayload.errorMessage matches either "connection refused" or "connection timeout" (case-insensitive) Which Logging query language expression should you execute in the Logs Explorer?

resource.type="k8s_container" severity >= ERROR timestamp >= "2024-10-15T14:00:00Z" AND timestamp <= "2024-10-15T14:30:00Z" jsonPayload.errorMessage =~ "(?i)connection (refused|timeout)": ### What the Logging Query Language Solution Is In Google Cloud Observability, the **Logging query language** is the native expression syntax used within the **Logs Explorer** to evaluate, filter, and extract log entries from Cloud Logging buckets based on structured and unstructured attributes. ### How it meets the requirements - **Resource type restriction**: Evaluates the monitored resource using exact field comparison `resource.type="k8s_container"`. - **Severity filtering**: Cloud Logging treats log severities as ordered enumerations (`DEFAULT`, `DEBUG`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `CRITICAL`, `ALERT`, `EMERGENCY`). The comparison `severity >= ERROR` correctly matches all logs at `ERROR` level and above without having to enumerate each higher severity. - **Historical time range**: Compares the `timestamp` field directly against RFC 3339 / ISO 8601 formatted string literals using comparison operators (`>=` and `<=`) joined by the `AND` operator. - **Nested payload & Regular Expression matching**: Accesses the nested JSON property using dot notation (`jsonPayload.errorMessage`) and uses the regex comparison operator (`=~`) with the `(?i)` case-insensitive flag and regex pattern `"(?i)connection (refused|timeout)"`. ### Key Advantages - Employs indexed attributes (`resource.type`, `severity`, `timestamp`) to narrow scan volume rapidly before evaluating payload expressions. - Directly leverages RE2 regular expression syntax supported natively by Google Cloud Logging. - Allows exact targeting of nested fields within structured payloads without parsing overhead. ### Why this is optimal This expression correctly uses standard **Logging query language** syntax, avoiding SQL-specific constructs or invalid comparison operators that would fail validation in the standard Logs Explorer query pane.

Logging Query Language Nested Regex Timestamp Filter | Professional Cloud DevOps Engineer

Logging Query Language Nested Regex Timestamp Filter

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your team is conducting a post-incident root-cause analysis for an outage affecting a microservice deployed on Google Kubernetes Engine (GKE). During the investigation, you must use the Logs Explorer to query ingested logs for entries that meet the following strict criteria:

Originates from the GKE container resource type (k8s_container)
Contains a severity level of ERROR or higher
Occurred between 2024-10-15T14:00:00Z and 2024-10-15T14:30:00Z
Contains a nested JSON payload field where jsonPayload.errorMessage matches either "connection refused" or "connection timeout" (case-insensitive)

Which Logging query language expression should you execute in the Logs Explorer?

resource.type: "k8s_container" severity: "ERROR" timestamp = "2024-10-15T14:00:00Z" ... "2024-10-15T14:30:00Z" jsonPayload.errorMessage: ("connection refused" OR "connection timeout")

SELECT * FROM VIEW WHERE resource.type = "k8s_container" AND severity >= "ERROR" AND timestamp BETWEEN "2024-10-15T14:00:00Z" AND "2024-10-15T14:30:00Z" AND REGEXP_CONTAINS(jsonPayload.errorMessage, r'(?i)connection (refused|timeout)')

resource.type="k8s_container" severity >= ERROR timestamp >= "2024-10-15T14:00:00Z" AND timestamp <= "2024-10-15T14:30:00Z" jsonPayload.errorMessage =~ "(?i)connection (refused|timeout)"

resource_type = "k8s_container" severity = "ERROR+" timestamp >= TIMESTAMP_SUB("2024-10-15T14:30:00Z", INTERVAL 30 MINUTE) jsonPayload.errorMessage LIKE "%connection refused%" OR jsonPayload.errorMessage LIKE "%connection timeout%"

Professional Cloud DevOps Engineer

Logging Query Language Nested Regex Timestamp Filter

Related questions