Sending Google Cloud Logging Notifications to Slack

2024-01-30 GCP Juan Cruz Parise

TL;DR: Configure automatic notifications from Google Cloud Logging to Slack to receive specific alerts from your applications on GCP.

When managing projects on Google Cloud Platform (GCP), having effective control of what happens in your project is essential. In this article, we will explore the step-by-step process of notifying Cloud Logging log alerts directly to a Slack channel.

What is Google Cloud Logging?

It is a tool that allows real-time log management, with search, analysis, and storage capabilities.

To access Google Cloud Logging:

Go to Google Cloud
Search for “Logging”
Once inside, you will see a Log Explorer console and real-time logs

Logs Explorer

The console has a specific syntax and allows filtering logs easily with words or regular expressions.

Preliminary steps to create an alert

Google Cloud Monitoring in Slack

To add Google Cloud Monitoring to Slack and invite it to a channel, you must follow the steps in this link

Necessary Permissions

The GCP permissions required for this procedure are:

Add Slack Channel to Cloud Logging

To add a channel, click on Manage Notification Channel. It will open a new window where you can add a new Slack channel.

Then, allow Google Cloud Monitoring to access Slack.

Once allowed, enter the name of the channel you want to add.

Parameters for creating an alert

Once you’ve identified the logs you want to notify in the Log Explorer panel, proceed to create the alert. Simply click the ‘Create Alert’ button located in the same panel.

Then, complete a form, which includes the following parameters:

1: Alert details

Alert Policy Name: The name that will appear in the Slack alert.
Policy Severity Level: Select the severity level. Options are “No Severity,” “Critical,” “Error,” and “Warning.”
Documentation: Documentation to include with the message, such as how to resolve the alert or referencing a wiki. You can also format messages and include specific fields about the alert.

2: Choose logs to include in the alert**asd12

Define log entries to alert on: Filters that Cloud Logging will consider to find the alert. For example, we’ll look for logs indicating that the memory limit of an app running on CloudRun has been exceeded.
```
resource.type = "cloud_run_revision"
severity=ERROR
textPayload: "Memory limit of"
```

3: Set notification frequency and autoclose duration

Set notification frequency and autoclose duration: The frequency with which notifications are sent, with a minimum time of 5 minutes.
Incident autoclose duration: The period before an incident is automatically closed.

Section 4: Who should be notified?

Who should be notified?: Mark the Slack channel where the notification will be sent.

Result

When the alert is triggered, a Slack message will be sent with the content (link to the pre-filtered log in Log Explorer, documentation, alert name, etc.), similar to the following example. 🚀

Datos Cohen Blog