ymotongpoo / logging-analytics-samples

Cloud Logging Analytics Samples

This repository contains samples that may be used with the Cloud Logging Analytics feature.

#	Query Sample	Log Source
1	Google Cloud Load Balancing
1.1	The average amount of data that is passing through	HTTP(S) LB Logs
1.2	All targets that the Load Balancer is routing traffic to and how many times	HTTP(S) LB Logs
1.3	All client IP addresses that accessed the HTTP LB, and times they accessed the LB	HTTP(S) LB Logs
1.4	List clients by the amount of data they received from the LB	HTTP(S) LB Logs
1.5	List clients by the number of times that each client visited a specified URL	HTTP(S) LB Logs
1.6	The LB latency was more than 2 seconds	HTTP(S) LB Logs
1.7	View the first top access log entries in chronological order	HTTP(S) LB Logs
1.8	Count the number of HTTP GET requests	HTTP(S) LB Logs
1.9	List top requests that having error status	HTTP(S) LB Logs
1.10	List the top URLs that Firefox users accessed most frequently	HTTP(S) LB Logs
2	Kubernetes
2.1	Get min, max, avg # of requests grouped for a service	Kubernetes Logs
2.2	List most recent container errors from Kubernetes	Kubernetes Logs
2.3	Last Kubernetes log entries with completed requests for a service	Kubernetes Logs
2.4	Get the number of logs for the top producers of container error logs	Kubernetes Logs
2.5	Get the number of logs for the top grouped producers of container logs	Kubernetes Logs
2.6	Get the number of logs for the top producers of container logs	Kubernetes Logs
2.7	Get the number of logs for the top producers of container logs by namespace	Kubernetes Logs
2.8	Get the total bytes sent between 2 Kubernetes pods	VPC Flow Logs
2.9	Get the total bytes and packets to/from Kubernetes clusters	VPC Flow Logs
2.10	Top destination IPs by total bytes and packets to/from Kubernetes clusters.	VPC Flow Logs
2.11	Get the total bytes and packets by protocol over the past day	VPC Flow Logs
2.12	Get the count of logs by severity	Kubernetes Logs
2.13	Get the count of logs by k8s service and severity	Kubernetes Logs
3	Serverless
3.1	Recent functions run time and status code	Cloud Functions V1 logs
3.2	Top Cloud Functions instances that used most of time in a specified date range	Cloud Functions V1 logs
3.3	Top instances that having error status in the last 24 hours	Cloud Run logs
3.4	Average amount of data that is passing through the Cloud Run services	Cloud Run logs
3.5	Client IP addresses that accessed the Cloud Run service	Cloud Run logs
3.6	List clients by the amount of data they received from the Cloud Run services	Cloud Run logs
3.7	List clients by the number of times they visited a specified URL	Cloud Run logs
3.8	Each time the Cloud Run service latency was more than 2 seconds	Cloud Run logs
3.9	Count HTTP GET requests received by the LB grouped by the client IP address	Cloud Run logs
3.10	Top requests that having error status	Cloud Run logs
3.11	Get the number of logs for the top producers of Clour Run error logs	Cloud Run logs
3.11	Get the number of logs for the top grouped producers of Cloud Run error logs	Cloud Run logs
3.12	Top requests with the longest latencies	Cloud Run logs
3.13	Top URLs that Chrome users accessed most frequently, in descending order	Cloud Run logs
4	Networking
4.1	External traffic by IP	VPC Flow logs
4.2	Internet egress by country	VPC Flow logs
4.3	Internet egress by ISP	VPC Flow logs
4.4	Internet egress by geo	VPC Flow logs
4.5	Top Talkers	VPC Flow logs
4.6	Total egress by zone	VPC Flow logs
4.6	VM to VM traffic	VPC Flow logs

Security analytics

You can find additional query examples for security analytics in the GitHub repo Community Security Analytics (CSA).

Support

This is not an officially supported Google product. Queries, rules and other assets in Community Security Analytics (CSA) are community-supported. Please don't hesitate to open a GitHub issue if you have any question or a feature request.

Contributions are also welcome via Github pull requests if you have fixes or enhancements to source code or docs. Please refer to our Contributing guidelines.

Copyright & License

Copyright 2022 Google LLC

Queries, rules and other assets under Community Security Analytics (CSA) are licensed under the Apache license, v2.0. Details can be found in LICENSE file.