[Yandex Cloud documentation](../../index.md) > [Yandex Cloud Logging](../index.md) > [Tutorials](index.md) > Processing Cloud Logging logs

# Processing Yandex Cloud Logging logs

[Yandex Cloud Logging](../index.md) is a service for reading and writing logs of Yandex Cloud services and user applications.

You can send logs to a Yandex Data Streams [stream](../../data-streams/concepts/glossary.md#stream-concepts) to process in real time using Yandex Query. You can do the following with processed data:

* Send it to Yandex Monitoring to make charts and use it in alerting.
* Write it to a stream in Data Streams and then send to Yandex Cloud Functions for processing.
* Write it to a stream in Data Streams and then transfer to Yandex Data Transfer to [distribute to various storage systems](../../data-streams/tutorials/data-ingestion.md).

![cloud-logging-to-yq](../../_assets/query/cloud-logging.png)

In this tutorial, you will send Cloud Logging logs to a Data Streams stream and then query them using Query. The query will return the number of messages per host grouped by 10s interval.

For this tutorial:

1. [Create a data stream in Data Streams](#create-yds-stream).
1. [Create a Cloud Logging log group](#create-log-group).
1. [Start sending data to the log group](#send-to-loggroup).
1. [Connect Query to your data stream](#connect-query).
1. [Query the data](#query).

## Getting started {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).

Install the Yandex Cloud [command-line interface](../../cli/quickstart.md#install).

## Create a data stream in Data Streams {#create-yds-stream}

[Create a data stream](../../data-streams/operations/manage-streams.md#create-data-stream) named `cloud-logging-stream`.

## Create a log group in Cloud Logging {#create-log-group}

[Create a log group](../operations/create-group.md) named `cloud-logging-group`. When setting the log group parameters, specify `cloud-logging-stream` created in the previous step.

## Start sending data to the log group {#send-to-loggroup}

To start sending data to the log group, run this command:

```bash
while true; do yc logging write \
  --group-name=cloud-logging-group \
  --message="test_message" \
  --timestamp="1s ago" \
  --level=INFO \
  --json-payload='{"request_id": "1234", "host":"test_host"}' \
  --folder-id b1kmrhakmf8a********; \
  sleep 1; \
done
```

* `--group-name`: Name of the log group to send messages to.
* `--message`: Message text.
* `--json_payload`: Additional message data in JSON format.
* `--folder-id`: ID of the folder the log group is created in.

   {% note info %}

   You can leave out the `--group-name`, `--message`, and `--json-payload` parameters and provide only the values, e.g., `cloud-logging-group "test_message" '{"request_id": "1234", "host":"test_host"}'`.

   {% endnote %}

## Connect Query to your data stream {#connect-query}

1. [Create a connection](../../query/operations/connection.md#create) named `cloud-logging-connection` of the `Data Streams` type.
1. On the binding creation page:
    * Select **Automatically fill settings for Cloud Logging**.
    * Enter a name for the binding: `cloud-logging-binding`.
    * Specify the data stream: `cloud-logging-stream`.
    * Set the `json-list` format.
1. Click **Create**.

## Query the data {#query}

Open the query editor in the Query interface and run this query:

```sql
$cloud_logging_data = 
SELECT 
    CAST(JSON_VALUE(data, "$.timestamp") AS Timestamp) AS `timestamp`,
    JSON_VALUE(data, "$.jsonPayload.host") AS host
FROM bindings.`cloud-logging-binding`;

SELECT 
    host, 
    COUNT(*) AS message_count, 
    HOP_END() AS `timestamp`
FROM $cloud_logging_data
GROUP BY 
    HOP(`timestamp`, "PT10S", "PT10S", "PT10S"), 
    host
LIMIT 2;
```

Result:

| # | host | message_count | timestamp |
| :--- | :--- | ---: | :--- |
| 1 | "test_host" | 3 | 2023-05-09T10:34:00.000000Z |
| 2 | "test_host" | 4 | 2023-05-09T10:34:10.000000Z |

{% note info %}

Data from a streaming source is delivered as an infinite stream. To prevent infinite streaming and get output in the console, the example uses the `LIMIT` clause that limits the number of result rows.

{% endnote %}

## Useful links {#see-also}

* [Reading data from Data Streams via Query connections](../../query/sources-and-sinks/data-streams.md)