Google Stackdriver - How can I show the logs of multiple containers in one view?

Question

I am currently using Google Stackdriver (the new layout!) to investigate my logging. In my case there are three services communicating between each other. I'd love to see their communication between each other in the form of my INFO logging in the most convenient way possible.

FooService > BarService > SnickerService

Status Quo

Currently I am only able to see the log of one of either services. So I started to open three browser tabs and having all three mentioned service logs opened. Now I figure out a timestamp/range where the FooService started calling BarService. This timerange I apply to the other remaining two services. That way I have a overview how the process is being distributed among those services.

This way to do it however is super awkward to setup every time

This leads me to the question if I can bring the logging of three containers into one Stackdriver view?

In the log query I see this field (example FooService)

resource.labels.pod_name="fooservice-bd4c9bf4d-nv4k2"

Questions

• Is there a way to have a AND operation here?
• Is there also a way to "search" for pods? At the moment I always have to dive into my Workloads and dig for the pod id (example above: bd4c9bf4d-nv4k2) so I can use it in the query. By doing so I would be way faster just clicking View Logs in the Google Cloud Console. So this can't be much of a fast way imho.

Answer 1

You can use 2 operators

• : is the contain operator
• () is a group operator

With : you can search on partial name. Use this resource.labels.pod_name: "fooservice" matches all the fooservice pod name.

With () you can group values or comparison, like this ("foo" OR "bar")

If you put all together

resource.labels.pod_name: ("fooservice" OR "barservice")

-> This filter allows you to filter on the pod_name which contains the values "fooservice" OR "barservice"