Guide · Agent skill
How to use the Cloud Logging Configuration Basics agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Cloud Logging Configuration Basics skill is an add-on for an AI coding agent that gives it a step-by-step playbook for setting up Google Cloud Logging inside one project. It covers regional log buckets with retention and analytics, routing logs with sinks, restricting sensitive logs with views and IAM, and creating logs-based metrics. This guide explains what the skill does, how to install it, how to ask for work in plain language, and what safety gates to expect before the agent changes anything.
Cloud Logging Configuration Basicsgoogle/skills · Apache-2.0 Download the skill Quick start
- 1Install gcloud and sign in. Install the Google Cloud CLI and authenticate it to a project where you have Cloud Logging and IAM permissions.
- 2Install the skill. Unzip the downloaded skill into ~/.claude/skills/ for personal use or into .claude/skills/ in your project, or upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
- 3Describe your logging goal. Ask the agent in plain language, naming the project, region, bucket or metric and any retention period or filter you need.
- 4Approve the confirmations. Read each Tier B command carefully and confirm it only if it matches what you intended. For Tier D, type the explicit confirmation phrase.
- 5Verify the result. Ask the agent to describe the new bucket or metric, which uses read-only commands that run without confirmation.
What does the Cloud Logging Configuration Basics skill make the agent do?
The skill tells the agent how to configure Cloud Logging for a single Google Cloud project. Its scope includes creating regional log buckets with a retention policy and Observability Analytics, routing log entries to a bucket with a log sink, hiding sensitive logs from the default view using views and IAM, and creating logs-based metrics that count matching log entries.
The agent runs gcloud commands on your behalf. Before it runs each one, the skill makes it sort the action into a risk tier, and some tiers require you to approve the exact command first.
- Create and inspect regional log buckets with retention and analytics
- Create log sinks that route matching entries to a bucket
- Restrict access to sensitive logs with log views and IAM conditions
- Create and check logs-based metrics
- Not for cross-project logging, organization-wide logging or multi-project setups
How do you install the skill?
Download the skill ZIP from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. To limit it to one project, place it in that project's .claude/skills/ folder instead.
In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
What do you need before the skill works?
The skill only does useful work if the commands can reach Google Cloud. You need the Google Cloud CLI (gcloud) installed and authenticated, a Google Cloud project where you have appropriate Cloud Logging and IAM permissions, and network access to Google Cloud APIs.
If gcloud is missing, the skill points to the official Google Cloud CLI installation guide. Without a Google Cloud account and gcloud access, the commands will not accomplish anything.
- Google Cloud CLI (gcloud), installed and authenticated
- A Google Cloud project with Cloud Logging and IAM permissions
- Network access to Google Cloud APIs
How do you trigger the skill with a natural request?
Describe the logging outcome you want and name your project and region. The agent will recognise the task as Cloud Logging configuration and follow the skill. Give it concrete names where you have them, such as a bucket ID, retention period, or filter expression, because the skill assumes the resources you name already exist.
Example requests you can adapt: 'Create a regional log bucket called my-custom-bucket in us-central1 in project my-project with 365 days retention and analytics enabled.' Or: 'Count log entries containing OutOfMemory as a logs-based metric called oom_error_count.' Or: 'Route ERROR logs from my-project to my-custom-bucket with a sink.'
- Name the project, region, and bucket or metric you want
- State the retention period in days if compliance requires one
- Give the log filter expression if you know it, such as textPayload:"OutOfMemory"
gcloud logging buckets create {bucket_id} --project={project_id} --location={region} --retention-days={retention_days} --enable-analyticsWhat confirmation steps should you expect?
The skill sorts actions into four tiers. Read-only commands such as listing or describing buckets run without asking. Creating buckets and views, which are non-billing, also run without asking, so review those requests before you send them. Anything that creates billing-inducing resources or changes access policies, such as creating logs-based metrics, sinks, links or IAM bindings, requires you to see the exact literal command and confirm it. Actions that permanently discard logs require you to type an explicit confirmation phrase, such as Yes, discard logs.
The skill also warns that after a log bucket has been upgraded to Observability Analytics, it cannot be downgraded to remove the analytics capability. Routing logs to a bucket and creating logs-based metrics both incur ongoing charges based on data volume.
- Tier R (read-only): runs without confirmation
- Tier M (non-billing configuration): runs without confirmation, so review first
- Tier B (billing or IAM change): you must confirm the exact command
- Tier D (irreversible log loss): you must type an explicit confirmation
What should you know about scripts, network and limits?
The skill runs scripts and uses the network, because its commands call Google Cloud APIs. The skill itself tells the agent not to run discovery commands to look up project IDs or resource names in restricted environments, and to assume named resources exist. If a resource name is wrong, expect the command to fail rather than be corrected automatically.
The skill also asks the agent to tag gcloud calls with an attribution environment variable that identifies the skill and its version, and it says this tag carries no user data. Review all Tier M commands in a production project before running them, since the skill does not ask for confirmation on those.
- Runs scripts and uses the network
- Does not check that named resources exist
- Adds an attribution tag to gcloud calls, set inline per command rather than through gcloud config
- Review Tier M commands before production use
What people use it for
- Setting up a regional log bucket with a fixed retention period for compliance and enabling Observability Analytics on it
- Routing matching log entries from one project into a dedicated bucket with a log sink
- Hiding sensitive log entries from the default _Default view using a log view and IAM conditions
- Creating a logs-based counter metric to track error rates in a single project
Frequently asked questions
How do I install the Cloud Logging Configuration Basics skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ in a project. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills instead.
What do I need to run this skill?
You need the Google Cloud CLI (gcloud) installed and authenticated, a Google Cloud project where you have Cloud Logging and IAM permissions, and network access to Google Cloud APIs. Without these, the commands will not take effect.
Is the Cloud Logging Configuration Basics skill free?
The skill is licensed under Apache-2.0. Google Cloud itself charges for some of the resources the skill creates, such as log bucket storage routed by sinks and logs-based metrics, so check Google Cloud pricing before you run billing-related commands.
Can this skill configure logging across multiple projects or an organization?
No. The skill is scoped to single projects and tells the agent not to use it for cross-project or multi-project setups.
Will the agent change my logging setup without asking?
Read-only commands and non-billing configuration commands such as creating buckets and views run without confirmation. Commands that create billing resources or change IAM require you to confirm the exact command, and commands that discard logs require a typed confirmation.
Why does the agent say it cannot find my bucket or project?
The skill tells the agent not to run discovery commands in restricted environments and to assume named resources exist. Give the exact project ID, region and bucket name in your request, and check spelling, since a wrong name will cause the command to fail.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits cloud engineers who want an agent to script single-project Cloud Logging setup with gcloud, especially where compliance retention in regional buckets matters and where they want approval gates before billing or IAM changes. It is a poor fit for cross-project or organization-wide logging, for anyone without a Google Cloud account and gcloud access, and for production changes made without review, since Tier M commands run without asking.
Download the skill