This is a practical workflow you can reuse during incidents.
Run summary first:
summarize_logs(scope="my-gcp-project", start_time="6h", severity="WARNING", text_filter="payment")
Look at:
severity_counts- top patterns with the highest counts
query_logs(scope="my-gcp-project", start_time="6h", severity="ERROR", text_filter="payment failed", limit=100)
Collect from entries:
- recurring endpoints
- customer ids (if present)
- trace IDs
trace_request(scope="my-gcp-project", trace_id="<trace-id>", start_time="6h")
Check service order and first failure point.
Narrow to recent window:
query_logs(scope="my-gcp-project", start_time="30m", text_filter="same error signature")
If count is zero, the issue may already be mitigated.