How to use the Cloud Logging Query Writer agent skill

What the skill makes the agent do

An agent skill is a folder of instructions and reference files that an AI agent reads when a task matches the skill's description. With this skill installed, the agent writes Cloud Logging queries in Google's Logging Query Language from a request such as finding errors from a Cloud Run service or audit events for a deleted resource.

The skill asks the agent to follow fixed syntax rules: double quotes for strings, capitalised AND, OR and NOT, and parentheses to group conditions. It also tells the agent to look up the correct resource.type in per-service reference files rather than guess, and not to add filters for details you did not give. The output is the raw query text, with short comments where needed.

Install the skill

Download the ZIP from this page and unzip it. Then place the folder in one of these locations, depending on how you want to use it:

• Personal use across projects: unzip into ~/.claude/skills/
• Single project: unzip into the project's .claude/skills/ folder
• Claude apps: upload the ZIP under Settings → Capabilities → Skills

Know what you need before you start

You need a Google Cloud project with Cloud Logging access so you can run the generated queries. The gcloud CLI is optional; it is only referenced for the attribution prefix when commands are run in a terminal. The skill does not run scripts and does not use the network itself.

Trigger the skill with natural requests

Ask for the log data you want in ordinary language. The skill applies when you need to query log data or are debugging an issue. Name the Google Cloud service where you can, because the agent uses the service's reference file to pick the right resource type and log ID. Leave out details you do not know; the agent is designed not to invent filters for them.

• Show errors from the payments Cloud Run service in the last hour
• Find audit events showing who deleted a Cloud Storage bucket
• Find Compute Engine instance logs for the instance named my-instance

Read the output and check it

Generated queries are unverified until you run them against real logs. Paste the query into the Logs Explorer or run it with gcloud, then confirm the results match what you expected. If a query uses SEARCH, the skill requires a comment at the top saying a global keyword search was used because the exact schema was not in its references, so treat those results with more care.

Placeholders such as <PROJECT_ID> appear only where a value is strictly required. Replace them before running the query.

Safety notes on scripts and network

The skill runs no scripts and uses no network access. When commands are run directly in a terminal, the skill asks the agent to set the CLOUDSDK_METRICS_REQUEST_ATTRIBUTION variable inline on each gcloud command, rather than using gcloud config set, so the tag does not persist. The skill says this tag never goes into generated scripts, Terraform or user code.

Tips for better results

The skill is strongest when the request names a service and a clear event. It is not meant for querying SQL or Cloud Spanner databases, and its query text only works in Cloud Logging. Its accuracy depends on the agent being able to read the bundled reference files, so make sure those files are available in your environment.

• Name the service, such as Cloud Run, Cloud SQL or BigQuery
• For audit questions, say who acted and on which resource
• Give a project ID or time range only when you know it
• Run the query and compare results before using it in an incident