Read a Kubernetes workload’s logs
Use a fixed k8s_container and namespace filter, then investigate specific error messages without opening unrelated application logs.
APIs & logs · MCP integration
Connect Google Cloud Logging to AI with scoped MCP access.
Search Google Cloud logs using the Logging query language through GateRook. Select projects or log views, configure Application Default Credentials or a service account key, and optionally impersonate a dedicated service account for the connection.
Connection in GateRook
stage-cloud-logs
Google Cloud Logging
stage / QA- Connector type
- GCP Cloud Logging
- Name / environment
- stage-cloud-logs / stage
- Resource names
- projects/orders-stage
- Credentials source
- adc
The route
Your AI requests a tool. GateRook checks the endpoint policy, resolves credentials locally, and calls the configured service.
Understand the request flowAsk your AI
Find recent order 48213 errors in Google Cloud Logging and explain the sequence.
logs_search · arguments
{
"connection": "stage-cloud-logs",
"query": "severity>=ERROR AND SEARCH(\"48213\")",
"from": "-15m",
"to": "now",
"limit": 20
}Example result
{
"backend": "gcp-logging",
"entries": [
{
"timestamp": "2026-10-22T12:29:00Z",
"severity": "ERROR",
"message": "Payment authorization timed out for order 48213"
}
],
"count": 1,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Put context to work
What you can do with Google Cloud Logging and AI
Investigate structured events
Ask the AI to inspect returned jsonPayload or other structured fields and compare events by an application identifier.
Use a dedicated log view
Point the connection to an existing log view to narrow its accessible data independently of the query supplied by the agent.
From service to MCP
How to connect Google Cloud Logging
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select Logs. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Prepare the Google Cloud identity
Use gcloud auth application-default login on the GateRook computer for ADC, or prepare a service account key for the connection. Grant read access only to the intended logs. Configure impersonation permissions if you use a target service account.
Choose resources and an enforced filter
Open Connections, Add connection and GCP Cloud Logging. Select the resource names, identity source and optional impersonation target. Add an always-on scope filter for the service or namespace.
Test and save the connection
Run Test connection and finish Add to endpoint. Verify a short Logging query language search in Playground before using it from an AI app.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure Google Cloud Logging in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Connector type | GCP Cloud Logging | The Google Cloud backend of the Logs connector. |
Name / environment | stage-cloud-logs / stage | Keep environments and access scopes recognizable. |
Resource names | projects/orders-stage | Use project, folder, organization, billing account or supported log view resource names. A log view provides the tightest scope. |
Credentials source | adc | Use Application Default Credentials on this computer, or select serviceAccountKey and enter the JSON key in GateRook. |
Impersonate | gw-reader@orders-stage.iam.gserviceaccount.com | Optional service account impersonation. The source identity needs permission to impersonate the target. |
Always add this filter | resource.type="k8s_container" AND resource.labels.namespace_name="orders" | A fixed filter applied in addition to the agent query. |
Know what you expose
Google Cloud Logging tools and access boundaries
The connector determines what is possible. Endpoint modes and connection policies determine what a particular AI client may use.
| Tool | Purpose | Access behavior |
|---|---|---|
logs_search | Search a bounded time range in the backend query language, with a cursor for older results. | Read only |
logs_tail | Read new log entries since a cursor, waiting up to eight seconds for another page. | Read only |
Before you enable access
- This integration reads logs. It does not edit entries, change retention or administer the logging service.
- The connection scope, environment policy and result limits all apply. A truncated page is only part of the evidence.
- Log messages may contain application data or sensitive payloads. Scope the source and review the data your AI app is permitted to receive.
- Google Cloud IAM and log-view permissions remain authoritative. Configuring a resource does not grant access to it.
- The connection includes a quota-per-minute setting for entries.list calls. Broad searches can still consume project API quota.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
Google Cloud Logging connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Must I upload a service account JSON key?
No. ADC is supported, and the connection can optionally impersonate a service account. A JSON key is an alternative credential source.
Can I force every query to one namespace?
Yes. Set Always add this filter to the namespace or resource condition. The connector applies that scope together with the agent’s query.
Does this use SQL?
No. A GCP Cloud Logging connection uses the Logging query language. The AI should form its filter for that backend.
Keep exploring
Connect the rest of your stack
Google Cloud
Use AI with Google Cloud through GateRook MCP tools. Search Cloud Asset inventory, inspect supported resources live and query Cloud Monitoring with scoped credentials.
Kubernetes
Connect AI to Kubernetes with GateRook. Inspect pods, events and logs over MCP, restrict namespaces, and review rollout restarts or manifest changes before execution.
Loki
Connect Loki to AI through MCP. Search and follow scoped logs with GateRook, using native queries, bounded time ranges and private credentials.
Your infrastructure, on your terms
Bring Google Cloud Logging into the conversation.
Start with one connection. Choose what your AI can do.