# Google Cloud Platform: Search Logs

Queries GCP Cloud Logging with a Logging Query Language expression and a time window to pull matching log entries into an incident.


> **Availability:** See the [Incident Workflow Actions Overview table](/workflow-actions) for the plans this workflow is available on.

## Description

Search for log entries in Google Cloud Platform Logging using Logging Query Language (LQL). This action lets you query GCP Cloud Logging directly from an Incident Workflow, filtering by LQL expression and time window, so you can pull relevant log entries into the incident timeline without leaving PagerDuty.

## Prerequisites

- A configured Google Cloud Platform Workflow Integration.
- A GCP Cloud Connection created in PagerDuty.

## Instructions

1. If you have not done so, follow the instructions to [Create an Incident Workflow](/ai-automation/automation/incident-workflows#create-an-incident-workflow).
2. When the instructions prompt you to [add actions](/ai-automation/automation/incident-workflows#add-actions), select **this action**.
3. Enter the following **Inputs** and click **Save**.
4. Continue following instructions to **Publish** the Workflow.
5. When the action runs, you will see the **Outputs** listed below.

## Inputs

> **Field References:** Fields with the **\{+\}** icon accept [Field References](/ai-automation/automation/incident-workflows#field-references), which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click **\{+\}**, or enter `{{`, and select relevant fields. Refer to the [Field References](/ai-automation/automation/incident-workflows#field-references) article for more information.

| Name                                   | Description                                                                                                    |
| :------------------------------------- | :------------------------------------------------------------------------------------------------------------- |
| **Connection Input**<br />(_Required_) | The GCP Cloud connection.                                                                                      |
| **Filter**                             | Logging Query Language filter expression. Example: `severity>=ERROR resource.type="k8s_container"`.            |
| **Start Time**                         | Start of the search window. Pick a preset or enter an ISO 8601 timestamp (for example `2024-01-01T00:00:00Z`). |
| **End Time**                           | End of the search window. Pick a preset or enter an ISO 8601 timestamp (for example `2024-01-01T01:00:00Z`).   |
| **Result Limit**                       | Maximum number of log entries to return (1 to 1000).                                                           |

## Outputs

| Name                 | Description                                                                         |
| :------------------- | :---------------------------------------------------------------------------------- |
| **Logs**             | Array of log entries returned from GCP Cloud Logging.                               |
| **Log Count**        | Number of log entries returned.                                                     |
| **Filter Used**      | The filter expression sent to the API.                                              |
| **Time Range Start** | Start time used for the query.                                                      |
| **Time Range End**   | End time used for the query.                                                        |
| **Has More Results** | Whether more results are available via `nextPageToken`.                             |
| **Next Page Token**  | Token for retrieving the next page of results.                                      |
| **Result**           | Value that shows if the action was successful or not. Either "Success" or "Failed." |
| **Result Summary**   | Brief description of what the action did or if it failed.                           |
| **Error**            | Brief description that is populated if the action failed.                           |

> **Tips:** **Pagination**: If **Has More Results** is true, use the **Next Page Token** output in a subsequent call to retrieve additional log entries beyond the **Result Limit**.

## Examples

### Example 1: Find Container Errors During an Incident

Set **Filter** to `severity>=ERROR resource.type="k8s_container"`, **Start Time** to a preset such as the last hour, and leave **End Time** at its default. This returns container-level error and above log entries from the search window, which can be posted to the incident for the responding team to review.

### Example 2: Paginate through a large result set

Set **Result Limit** to `1000` for the initial search. If the **Has More Results** output is `true`, use the **Next Page** **Token** output to configure a follow-up **Search Logs** step and retrieve the remaining log entries.