nested gcp logging query: pipe an output of first query to a second query

Question

I need to collect queries from gcp under the following scenario. First, I need to collect logs from container c1 having a textpayload: key1. As per the logging util, the output of the this log will contain a timestamp t. In this context, I need now to retrieve the logs from a container c2 having the timestamp t.

Any hint on how (the most efficient/brief) to write this query using gcp logging query language?

Answer 1

You can try this query to retrieve logs from container 2 with timestamp t, obtained from a previous query on container c1:

fetch container(c2)
where timestamp = (
  fetch container(c1)
  where textPayload: "key1"
  | timestamp
)