Question

A microservice on GKE writes plain-text log lines to stdout like 'ERROR user 4521 checkout failed timeout=3000ms'. The reliability team wants to filter these entries by severity in Logs Explorer and build a log-based metric that counts only checkout failures per user tier, but currently all entries appear with severity 'Default' and the message body is treated as a single unstructured string. What is the most effective change to enable reliable severity filtering and field-based extraction?

Accepted Answer

Emit logs as structured JSON to stdout with a 'severity' field and separate fields for event, userId, and tier, so the GKE logging agent parses them into jsonPayload and LogEntry severity.

Answer

Configure a Cloud Logging sink that routes all entries to BigQuery, then run SQL regular expressions over the text payload to reconstruct the fields at query time.

Answer

Increase the log retention period on the _Default bucket so the plain-text entries persist long enough for the team to search them manually.

Answer

Add a log exclusion filter on the _Default sink to drop non-error lines, reducing volume so the remaining text entries are easier to scan.