GCP Logs: How to query within an array of objects (regex like)

Question

Let's say I have logs that look like :

{
  jsonPayload: {
    anArray: [
      {
        someField: 10000
      }
    ]
  }
}

In my GCP log query, I want to query something like:

jsonPayload.anArray.*.someField > 1000

Of course, the query above is incorrect, but I'd like to know if its possible to query for any item in the array of objects which has a someField value above 1000.

Thanks

user_14733669 · Answer

Let us say you have a data structure that looks like this:

{
  "message":{
    "message1":[
      {
        "value":950
      },
      {
        "value":2000
      },
      {
        "value":1200
      }
    ]
  }
}

In Logs Explorer, you can run the query below and return the whole JsonPayload if at least 1 object in it satisfies the condition value > 1000 . This query follows the logic 950 > 1000 OR 9 > 1000 OR 1200 > 1000. You can read more about the querying in the Querying Logging docs.

resource.type="global"
jsonPayload.message.message1.value > 1000

I have another JsonPayload entry that has a value of 5000 and is only the lone value for that entry. Thus returning both entries.

Result:

GCP Logs: How to query within an array of objects (regex like)

1 Answers