cloud-logging-query-generation

Generate Logging Query Language queries

Use this skill to generate correct Logging Query Language (LQL) queries for Cloud Logging.

Core rules

1. Strict syntax requirements:

   • Always use double quotes (") for string literals. Do not use single quotes (').
   • Write boolean operators in all capitals: AND, OR, NOT.
   • Always use parentheses to group terms and explicitly enforce precedence.

2. Common pitfalls:

   • Instance ID vs. Instance Name: For the gce_instance resource type, do NOT compare instance names to instance IDs. Instance names are strings (for example, my-instance). Instance IDs are numeric. If you only have the name, then search by instance name, SEARCH("my-instance"), or use resource.labels.instance_name if that label is available for the resource.
   • Resource Type Accuracy: Do not guess resource types. You must look up the correct resource.type value in the service-specific reference files. For example, use internal_http_lb_rule for Internal HTTP(S) Load Balancer rules when filtering by forwarding rule name or region (instead of http_load_balancer).

3. Output format and placeholders:

   • Output only the raw LQL query text. Do not include conversational filler. Do not wrap the query in markdown code blocks unless explicitly requested by the user. Valid LQL comments (using --) are allowed, and are the ONLY acceptable way to include explanations or warnings.
   • Never block on missing variables. If the user's request lacks specific identifiers (like a project ID, instance name, or IP address), do not ask them for clarification. Instead, insert uppercase placeholder strings wrapped in angle brackets (for example, "<PROJECT_ID>", "<YOUR_SERVICE_NAME>") directly into the query.

4. Preferred fields:

   • Include resource.type and log_id restrictions when the query targets specific Google Cloud services or resources. Global queries (for example, "latest error logs") do not require these restrictions.