How to include the time (timestamp) in Documentation of logbased alert.

[utayoshida]

Hi,all.

In a log-based alert policy, I would like to use a label to include the time (timestamp) when the log was output in the email text.
I specified the field timestamp as the label and specified it in the Documentation with ${log.extracted_label.KEY}, but it is displayed as null in the email.
Please answer my questions.

1. Please teach me how to display the timestamp in the Documentation.
2. If 1 is successful, I would like to display only the date and only the time. Please teach me how to use regular expressions.

[-Rhett]

Hi @utayoshida,

Welcome to the Google Cloud Community!

The log.extracted_label.variable can have null values for the following reasons:

• The aggregation settings for the alerting policy eliminates the label you want to display.
• The regular expression syntax and applicability of the variable are invalid
• The timestamp field was extracted incorrectly in the log-based alert

Here are a couple options on how you can resolve this:

• Follow the troubleshooting steps for Variable for a metric label is null
• Create a custom log-based alerting policy by using the Monitoring API

If you plan to create a custom log-based alerting policy for timestamps, your code will depend on your application’s programming language and main use case. Here is a code sample to help you get started.

If you want to learn more about using regular expressions (regex) in Google Cloud, you may refer to these resources:

• Guidelines for using regular expressions
• Syntax for Regular Expressions
• Examples of regular expressions
• Tips and tricks for using new RegEx support in Cloud Logging

I hope this helps!