Troubleshoot log-based alerting policies

This document provides troubleshooting information for using log-based alerting policies.

No matching logs are available

When you test your filter for a log-based alerting policy, no logs are returned. Check the following common errors:

• You are trying to filter on excluded logs. Log-based alerting policies operate only on included logs.

• You are trying to filter by log buckets, or for other Google Cloud resources such as Cloud Billing accounts or organizations. Log-based alerting policies operate at Google Cloud project level.

• Your query is too restrictive. Check that your field names and regular expressions are correct. You can use the Querypane in Logs Explorer or the Preview logsbutton in the alert-configuration interface to help validate the query. For information about creating queries, see Logging query language .

Alerting policy isn't working

You've created a log-based alerting policy, but it isn't working as you expected. For example:

• Cloud Monitoring isn't sending notifications for the alerting policy.

  If your alerting policy extracts labels, then verify that it isn't extracting the timestamp label. Extraction of this label prevents the alerting policy from creating incidents and sending notifications.

  If you've stopped receiving notifications, then you might have reached the rate limit of 20 incidents a day for each log-based alerting policy. Check the most recent notification you received for this log-based alerting policy and look for a statement that the incident limit has been exceeded for the day.

  If you aren't receiving as many notifications as you expect, then check the configuration of the log-based alerting policy. You might need to adjust the value for time between notifications.

• Cloud Monitoring isn't creating incidents when policy conditions are met.

  If your alerting policy extracts labels, then verify that it isn't extracting the timestamp label. Extraction of this label prevents the alerting policy from creating incidents and sending notifications.

  Go to the Incidents page in Cloud Monitoring and filter the table by policy name. The results show the current and past alerts:

  • If there are no incidents, then verify that the query used is finding matching logs. Check that your field names and regular expressions are correct. You can use the Querypane in Logs Explorer or the Preview logsbutton in the alert-configuration interface to help validate the query. For information about creating queries, see Logging query language .

  • If there are past incidents but no recent ones for the current day, then you might have reached the limit of 20 incidents a day for each log-based alerting policy. Check the most recent notification you received for this alerting policy and look for a statement that the incident limit has been exceeded for the day.

• Cloud Monitoring creates incidents for more log entries than you expected:

  It's possible that your log query is insufficiently restrictive. Check that your field names and regular expressions are correct. You can use the Querypane in Logs Explorer or the Preview logsbutton in the alert-configuration interface to help validate the query. For information about creating queries, see Logging query language .

Incidents aren't closing

If you don't close an incident, then Cloud Logging closes the incident after the autoclose duration for the alerting policy has passed. The default autoclose duration is 7 days, but you can set it to any value between 30 minutes and 7 days. You can also manually close incidents at any time, as described in Closing incidents .