Google’s new query builder to tackle SQL complexity in cloud workload monitoring

Google has added a new query builder to its Log Analytics tool to help developers, DevOps teams, and site reliability engineers (SREs) quickly craft complex SQL queries for monitoring and troubleshooting cloud workloads.

Enterprises often rely on generating insights about cloud workloads to manage security and costs, such as avoiding data egress fees to third-party tools, and Log Analytics, part of Google’s Cloud Logging service, is a set of capabilities that is targeted at providing these insights by using SQL as the query language.

However, writing complex SQL code, required to generate these insights, can be a tedious and time-consuming task, which most SREs and security teams would find difficult, analysts say.

“The query builder solves a large SQL bottleneck by transforming log analysis from a time-consuming task into a real-time, self-service capability that’s fit for any DevOps or site reliability professional. This is an immense time-saver that can collapse typical investigation windows from hours to minutes,” said Bradley Shimmin, lead of the data, analytics, and infrastructure practice at The Futurum Group.

Seconding Shimmin, HyperFRAME Research’s practice lead for AI Stack, Stephanie Walter, pointed out that the query builder, which abstracts SQL complexity into an intuitive visual interface to improve productivity and reduce errors, should be a relief for “operators who have been drowning in SQL syntax.”

“For day-to-day triage, a visual builder that emits valid queries is a genuine quality-of-life boost and reduces copy-paste errors,” Walter added.

Some of the key features of the query builder include the ability to search across all fields with a single string or error message, previewing log schema with inferred JSON keys and values, intelligent value suggestions for fields and filters, automatic JSON handling, real-time SQL preview, and single-click visualization and dashboard saving.

Closing a gap with rivals

Rival cloud service providers, such as Microsoft and AWS, also offer a way to analyze logs of cloud workloads via Azure Monitor Logs and AWS CloudWatch Logs, and analysts say that Google is playing catch-up with them in terms of the query builder.

“Azure Monitor has a visual mode for composing KQL, the language Microsoft uses for querying logs. AWS CloudWatch Logs, too, offers an editor-driven approach with visualization tools. Google’s addition brings a comparable UI,” Walter said.

Furthermore, the analyst noted that Google is catching up to the usability curve that SaaS observability vendors established years ago. “Datadog, New Relic, and Sumo Logic have long offered intuitive builders and guided query experiences. Google’s new feature doesn’t leapfrog them. It closes a gap,” he said.

However, Walter pointed out that enterprises that are already invested in Google’s data stack will find the integration of the query builder helpful.

Google is most likely to integrate the query builder with Gemini’s natural language-to-SQL capabilities that will be helpful for users, Futurum Group’s Shimmin said.

Microsoft and AWS already offer generative AI-based assistants, such as Q and Copilot, for their individual offerings to make it easier for non-technical or semi-technical users to use natural language for generating insights from logs.

Growing need for agentic AI workloads

According to analysts, tools such as the query builder in Log Analytics will soon become indispensable for enterprises as AI workloads, especially agentic AI, continue to scale.

“Agentic AI workloads are black boxes that generate massive, high-dimensional log data, and the AI teams building them are often not SQL experts, and yet they’re now required to troubleshoot their own systems,” Shimmin said, emphasizing the importance of having a simplified log analytics tool.

Google, in its documentation, recommends using the new query builder for generating trends and insights into cloud workloads. The tool has been made generally available.

For troubleshooting, Google recommends using the Logs Explorer, another interface accessible via the Google Cloud Console, which uses a separate query language.

However, it warns that the Logs Explorer doesn’t support aggregate operations, like counting the number of log entries that contain a specific pattern, and similar queries should be performed via Log Analytics.

Google said it will not charge for queries to analyze logs. However, moving or routing the logs to a different Google service, such as BigQuery, for further analysis or storage will attract charges.