Configure log-based alerts

You can use log-based alerts to notify you when Network Analyzer detects specific insights. Examples for Network Analyzer insights include the following:

• View all the insights on GKE cluster-related issues
• View all high priority insights
• View all load balancer firewall health check issues
• View all insights in the region us-central1

Network Analyzer logs are part of the Google Cloud platform logs. The log names are in the following format:

projects/{project-id}/logs/networkanalyzer.googleapis.com%2Fanalyzer_reports

You can find the log ID, monitored resource, and the payload proto details in the Network Analyzer logs API . By default, the logs are routed to the default log bucket .

To get details about supported Cloud Logging insight types, see Insight groups and types .

Create log queries

You can use the Logging query language to query and filter Cloud Logging data. For more information, see Logging query language . Following are some examples of log queries for specific Network Analyzer insights:

• Example:The following query returns the insights on all GKE cluster-related issues:

  LOG_ID("networkanalyzer.googleapis.com%2Fanalyzer_reports")
  jsonPayload.resourceName=~"^//container.googleapis.com/projects/.+/clusters/"

• Example:The following query returns all high priorityinsights:

  LOG_ID("networkanalyzer.googleapis.com%2Fanalyzer_reports")
  jsonPayload.priority="HIGH"

• Example:The following query returns all insights that belong to either of the two specific Load Balancer Health Checkinsight types:

  (jsonPayload.causeCode="LOAD_BALANCER_HEALTH_CHECK_FIREWALL_HEALTH_CHECK_RANGE_BLOCKED" OR
  jsonPayload.causeCode="LOAD_BALANCER_HEALTH_CHECK_FIREWALL_HEALTH_CHECK_FIREWALL_NOT_CONFIGURED"
  )

• Example:The following query returns all insights with location us-central1 :

  LOG_ID("networkanalyzer.googleapis.com%2Fanalyzer_reports")
  jsonPayload.location="us-central1"

• Example:The following query returns all insights that belong to the hybrid connectivity category:

  LOG_ID("networkanalyzer.googleapis.com%2Fanalyzer_reports")
  jsonPayload.reportGroups="HYBRID_CONNECTIVITY"

Set up log-based alerts

You can use the log queries to set up log-based alerts to notify you when the matching insights are discovered by Network Analyzer. You can create log-based alerts from the Logs Explorer in the Google Cloud console or by using the Cloud Monitoring API .

Configure log-based alerts for organizations, folders, and metrics scopes

To route logs from multiple projects to a single destination project, see Create a sink . You can then configure alerts in the destination project.

Export logs to a third-party platform

You can configure a customized log sink to export logs to Cloud Storage, BigQuery, Pub/Sub, and third-party platforms. For more information, see Configure and manage sinks .

Enable or disable logging

To enable the Cloud Logging API, see Enable the Logging API . To access the logs data in the Logging API , the Logs Explorer , and the Google Cloud CLI , you must grant the required Identity and Access Management (IAM) roles and permissions. For more information, see Access control with IAM .

To disable Network Analyzer logs for a project, you can configure an exclusion filter to filter out Network Analyzer logs for the project.