📘
Availability
This workflow action is available on Business and Enterprise for Incident Management pricing plans. Contact the Sales Team to upgrade to an account with this action.

Description

Search for log entries in Google Cloud Platform Logging using Logging Query Language (LQL). This action lets you query GCP Cloud Logging directly from an Incident Workflow, filtering by LQL expression and time window, so you can pull relevant log entries into the incident timeline without leaving PagerDuty.

Prerequisites

A configured Google Cloud Platform Workflow Integration.
A GCP Cloud Connection created in PagerDuty.

Instructions

If you have not done so, follow the instructions to Create an Incident Workflow.
When the instructions prompt you to add actions, select this action.
Enter the following Inputs and click Save.
Continue following instructions to Publish the Workflow.
When the action runs, you will see the Outputs listed below.

Inputs

📘
Field References
Fields with the {+} icon accept Field References, which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click {+}, or enter {{, and select relevant fields. Refer to the Field References article for more information.

Name	Description
Connection Input (Required)	The GCP Cloud connection.
Filter	Logging Query Language filter expression. Example: `severity>=ERROR resource.type="k8s_container"`.
Start Time	Start of the search window. Pick a preset or enter an ISO 8601 timestamp (for example `2024-01-01T00:00:00Z`).
End Time	End of the search window. Pick a preset or enter an ISO 8601 timestamp (for example `2024-01-01T01:00:00Z`).
Result Limit	Maximum number of log entries to return (1 to 1000).

Outputs

Name	Description
Logs	Array of log entries returned from GCP Cloud Logging.
Log Count	Number of log entries returned.
Filter Used	The filter expression sent to the API.
Time Range Start	Start time used for the query.
Time Range End	End time used for the query.
Has More Results	Whether more results are available via `nextPageToken`.
Next Page Token	Token for retrieving the next page of results.
Result	Value that shows if the action was successful or not. Either "Success" or "Failed."
Result Summary	Brief description of what the action did or if it failed.
Error	Brief description that is populated if the action failed.

📘
Tips
Pagination: If Has More Results is true, use the Next Page Token output in a subsequent call to retrieve additional log entries beyond the Result Limit.

Examples

Example 1: Find Container Errors During an Incident

Set Filter to severity>=ERROR resource.type="k8s_container", Start Time to a preset such as the last hour, and leave End Time at its default. This returns container-level error and above log entries from the search window, which can be posted to the incident for the responding team to review.

Example 2: Paginate through a large result set

Set Result Limit to 1000 for the initial search. If the Has More Results output is true, use the Next Page Token output to configure a follow-up Search Logs step and retrieve the remaining log entries.