Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your team is conducting a post-incident root-cause analysis for an outage affecting a microservice deployed on Google Kubernetes Engine (GKE). During the investigation, you must use the Logs Explorer to query ingested logs for entries that meet the following strict criteria:
StudyCerts
StudyCertsk8s_container)ERROR or higher2024-10-15T14:00:00Z and 2024-10-15T14:30:00ZjsonPayload.errorMessage matches either "connection refused" or "connection timeout" (case-insensitive)Which Logging query language expression should you execute in the Logs Explorer?
resource.type="k8s_container" severity >= ERROR timestamp >= "2024-10-15T14:00:00Z" AND timestamp <= "2024-10-15T14:30:00Z" jsonPayload.errorMessage =~ "(?i)connection (refused|timeout)"
resource_type = "k8s_container" severity = "ERROR+" timestamp >= TIMESTAMP_SUB("2024-10-15T14:30:00Z", INTERVAL 30 MINUTE) jsonPayload.errorMessage LIKE "%connection refused%" OR jsonPayload.errorMessage LIKE "%connection timeout%"
SELECT * FROM VIEW
WHERE resource.type = "k8s_container"
AND severity >= "ERROR"
AND timestamp BETWEEN "2024-10-15T14:00:00Z" AND "2024-10-15T14:30:00Z"
AND REGEXP_CONTAINS(jsonPayload.errorMessage, r'(?i)connection (refused|timeout)')
resource.type: "k8s_container" severity: "ERROR" timestamp = "2024-10-15T14:00:00Z" ... "2024-10-15T14:30:00Z" jsonPayload.errorMessage: ("connection refused" OR "connection timeout")
resource.type="k8s_container" severity >= ERROR timestamp >= "2024-10-15T14:00:00Z" AND timestamp <= "2024-10-15T14:30:00Z" jsonPayload.errorMessage =~ "(?i)connection (refused|timeout)"
In Google Cloud Observability, the Logging query language is the native expression syntax used within the Logs Explorer to evaluate, filter, and extract log entries from Cloud Logging buckets based on structured and unstructured attributes.
resource.type="k8s_container".DEFAULT, DEBUG, INFO, NOTICE, WARNING, ERROR, CRITICAL, ALERT, EMERGENCY). The comparison severity >= ERROR correctly matches all logs at ERROR level and above without having to enumerate each higher severity.timestamp field directly against RFC 3339 / ISO 8601 formatted string literals using comparison operators (>= and <=) joined by the AND operator.jsonPayload.errorMessage) and uses the regex comparison operator (=~) with the (?i) case-insensitive flag and regex pattern "(?i)connection (refused|timeout)".resource.type, severity, timestamp) to narrow scan volume rapidly before evaluating payload expressions.This expression correctly uses standard Logging query language syntax, avoiding SQL-specific constructs or invalid comparison operators that would fail validation in the standard Logs Explorer query pane.
resource_type = "k8s_container" severity = "ERROR+" timestamp >= TIMESTAMP_SUB("2024-10-15T14:30:00Z", INTERVAL 30 MINUTE) jsonPayload.errorMessage LIKE "%connection refused%" OR jsonPayload.errorMessage LIKE "%connection timeout%"
SELECT * FROM VIEW
WHERE resource.type = "k8s_container"
AND severity >= "ERROR"
AND timestamp BETWEEN "2024-10-15T14:00:00Z" AND "2024-10-15T14:30:00Z"
AND REGEXP_CONTAINS(jsonPayload.errorMessage, r'(?i)connection (refused|timeout)')
resource.type: "k8s_container" severity: "ERROR" timestamp = "2024-10-15T14:00:00Z" ... "2024-10-15T14:30:00Z" jsonPayload.errorMessage: ("connection refused" OR "connection timeout")