Cloud MonitoringAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

• Google Cloud metrics for freeCompute Engine, GKE, Cloud Run, Cloud SQL and other services publish system metrics automatically. You see them in Metrics Explorer and charge nothing for them.
• Your own metricsWrite custom metrics through the API or a client library, turn log entries into metrics with log-based metrics, or send OpenTelemetry and Prometheus data.
• Metrics scopesOne project can be the place where you look at many. A metrics scope adds monitored projects, so a platform team sees every production project’s graphs in one dashboard.
• Alerting policiesA policy has conditions (threshold, absence of data, a PromQL expression), notification channels, and documentation that appears in the alert. It opens an incident that closes by itself when the condition clears.
• Uptime checksGoogle probes your HTTP, HTTPS or TCP endpoint from several regions, and the result can be a chart, an alert and a dashboard tile. Private checks reach endpoints inside a VPC.
• Service level objectivesService monitoring lets you define a service, a measure of good events, and a target such as 99.9 percent over 28 days. Alerts can fire on how fast you burn the error budget.
• PromQLPromQL works in dashboards and alerting policies. It’s the language Google now recommends, with MQL no longer the recommended choice since October 2024.
• Managed Service for PrometheusA managed, Prometheus-compatible store with global queries. Kubernetes teams keep their exporters and rules without running Prometheus servers.

Metric type and monitored resource

A metric type, such as compute.googleapis.com/instance/cpu/utilization, says what is measured. The monitored resource says what it is measured on, for example a VM instance.

Time series

The stream of data points for one metric type on one resource with one set of label values. Each combination of labels is a separate time series.

Metrics scope

The set of projects whose metrics a monitoring project can see. It replaced the older name Workspace.

Ops Agent

The agent for Compute Engine and other virtual machines that collects metrics and logs. It replaced the older monitoring and logging agents.

Custom metric

A metric you define and write, with a type under custom.googleapis.com/ or workload.googleapis.com/ for agent and OpenTelemetry data.

Log-based metric

A metric that counts log entries, or extracts a value from them, in Cloud Logging. It’s how you graph and alert on something that exists only in logs.

Alerting policy

A set of conditions, notification channels and documentation. When a condition is met for the stated time, Cloud Monitoring opens an incident.

Notification channel

Where alerts go: email, a chat tool, a webhook, Pub/Sub, a paging service or the Google Cloud mobile app.

Uptime check

A probe from Google’s global locations to a URL or address that records availability and latency.

Service level objective (SLO)

A target for a service level indicator over a rolling or calendar window. The error budget is the amount of failure the target allows.

PromQL

The Prometheus query language, supported for Cloud Monitoring dashboards and alerts.

Managed Service for Prometheus

Google’s managed store for Prometheus metrics, billed by samples ingested.

Snooze

A time-limited pause of chosen alerting policies, for planned maintenance.

Set up alerts, an uptime check and a dashboard with gcloud

1. Choose the monitoring projectUse a dedicated project as the metrics scope for each environment, or for the whole platform team, and add the workload projects as monitored projects.
2. Install the agent where it’s neededCompute Engine instances need the Ops Agent for memory, disk and application metrics. GKE, Cloud Run and other managed services publish what you need without an agent.
3. Create a notification channelAdd the team email or the paging service. Email channels need a verification step, so test the channel before you rely on it.
4. Write an alerting policy for a symptomAlert on error rate or latency from the load balancer, or on failing uptime checks, with a duration so a single bad point doesn’t open an incident. Add a documentation note with the first three things to check.
5. Add an uptime checkProbe the public URL from several regions, and make sure your firewall or Cloud Armor policy lets Google’s probes in.
6. Make a dashboardStart with what users feel, then the graphs behind it, and use PromQL for new charts.
7. Define an SLOFor a service that has users, define an SLI (for example good requests over all requests) and a target, and alert on burn rate instead of only on raw errors; the alert’s lookback window has to be shorter than 24 hours, as the docs we read say.
8. Control custom-metric costKeep label values to a small set, write metrics at a sensible interval and avoid identifiers as labels.
9. Review monthlyLook at the metrics bill by metric type, remove metrics and policies that nobody uses, and check that every policy has an owner.

• Write custom metrics at a sensible interval, not more often than the data changes, and batch points in one request where you can.
• Use PromQL with a time range and label filters, so dashboards don’t scan every series.
• Keep dashboards small: many charts with long time ranges load slowly.
• Use the Ops Agent’s defaults, and add only the receivers you need.
• Let managed services publish their own metrics rather than scraping them yourself.
• For Prometheus, use scrape intervals and relabelling to drop series you never query.
• Use log-based metrics for numbers that live in logs, and alert on the metric rather than querying logs on a timer.
• Place uptime checks in regions where your users are, and keep the checked page light.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Cloud Monitoring.

• Remember that Google Cloud system metrics are free, and the bill is mostly custom, agent, log-based and Prometheus data.
• Watch cardinality: each unique label combination is a separate time series that is ingested and billed.
• Write fewer samples: lengthen the scrape or write interval where a minute is plenty.
• Drop metrics you never use in the Ops Agent configuration and with Prometheus relabelling.
• Count your alert conditions and remove duplicates, since conditions are billed.
• Cache API reads from external dashboards, because reads above the free allowance are billed per 1,000 calls.
• Check Cloud Logging separately, because log ingestion and retention beyond the included period are billed on their own.
• Use the free allowance for small projects, and note that it applies per billing account.
• Break down the bill by metric type and project with the billing export, and look at the top five.
• Label resources by owner and add a budget alert on monitoring spend.

• Give people IAM roles such as Monitoring Viewer or Editor at the narrowest project, and workloads only the Metric Writer role.
• Keep the metrics scope narrow, and review who can view the monitoring project.
• Use VPC Service Controls around projects that hold sensitive metrics and logs.
• Don’t put personal data or secrets in labels, metric names or alert documentation.
• Protect webhook notification channels with a secret and keep tokens out of the URL.
• Turn on audit logs for Cloud Monitoring and review changes to policies and channels.
• Restrict who can edit or delete alerting policies, channels and uptime checks.
• Use private uptime checks for internal endpoints, instead of exposing them to the internet.
• Keep policies and dashboards in code so that changes are reviewed.
• Alert on failures of notification delivery and on a sudden stop of metric writes.

Cloud Audit Logs record who changed alerting policies, channels and dashboards, Cloud Asset Inventory lists what exists, Security Command Center reports findings, and the Compliance Resource Center holds audit reports. Google looks after the platform and the storage. You decide what is measured, who can write and read it, how alerts are written and who responds.

• Collect fewer series: drop metrics and labels you never use.
• Lengthen write and scrape intervals where a finer view adds nothing.
• Delete unused dashboards, policies and custom metrics.
• Use log-based metrics sparingly and exclude noisy logs before they are processed.
• Log buckets sit in a region you pick; choose one with lower grid emissions when residency and latency permit.
• Google’s Carbon Footprint report splits emissions by project and service. Cloud Monitoring may not be itemised, so confirm before publishing a number.

Purchase options

What you actually pay for

• Custom, agent, log-based and external metric data, by volume
• Prometheus samples, by the million
• Alert conditions and the queries they run
• Monitoring API reads beyond the free allowance
• Logs in Cloud Logging, and traces in Cloud Trace, which are billed on their own

Monitoring for an orders API behind a load balancer: an email notification channel, an alerting policy on the 5xx ratio, an uptime check on the public URL, a log-based metric that counts payment errors and a dashboard. The gcloud tab sets up the channel, policy and uptime check; Terraform describes the same resources. The Python tab writes a custom metric and lists alerting policies that have no notification channel, and the C# tab audits the policies in a project for missing channels and disabled policies. Swap in your own project, host and address, and try it in a scratch project first.

# Placeholders: replace the project, host and e-mail address with your own.
PROJECT=my-monitoring-project
HOST=api.example.com

gcloud services enable monitoring.googleapis.com --project=$PROJECT

# 1. A notification channel. The channels commands are still in the alpha group (gcloud components install alpha).
#    Email channels need verifying in the console before they deliver.
CHANNEL=$(gcloud alpha monitoring channels create --project=$PROJECT --display-name="orders on-call" --type=email \
  --channel-labels=email_address=oncall@example.com --format="value(name)")

# 2. An alerting policy: the share of 5xx responses stays above 2 percent for 5 minutes.
cat > policy.json <<EOF
{
  "displayName": "orders-api 5xx ratio",
  "combiner": "OR",
  "conditions": [{
    "displayName": "5xx ratio above 2 percent",
    "conditionPrometheusQueryLanguage": {
      "query": "sum(rate(loadbalancing_googleapis_com:https_request_count{response_code_class=\"500\"}[5m])) / sum(rate(loadbalancing_googleapis_com:https_request_count[5m])) > 0.02",
      "duration": "300s",
      "evaluationInterval": "60s"
    }
  }],
  "alertStrategy": {"autoClose": "1800s"},
  "documentation": {"content": "Check the last deployment, the backend health and the database first.", "mimeType": "text/markdown"},
  "notificationChannels": ["$CHANNEL"]
}
EOF
gcloud monitoring policies create --project=$PROJECT --policy-from-file=policy.json

# 3. An uptime check on the public URL, from Google's global locations.
gcloud monitoring uptime create orders-api-health --project=$PROJECT --resource-type=uptime-url \
  --resource-labels=host=$HOST,project_id=$PROJECT --protocol=https --path=/health --period=1 --timeout=10

# 4. A log-based metric that counts payment errors in Cloud Logging.
gcloud logging metrics create payment_errors --project=$PROJECT \
  --description="Payment errors logged by the orders API" \
  --log-filter='resource.type="cloud_run_revision" AND severity>=ERROR AND textPayload:"payment failed"'

# 5. A dashboard from a JSON file: two charts.
cat > dashboard.json <<EOF
{
  "displayName": "orders-api",
  "mosaicLayout": {"columns": 12, "tiles": [
    {"width": 6, "height": 4, "widget": {"title": "Payment errors per minute", "xyChart": {"dataSets": [{"timeSeriesQuery": {
      "prometheusQuery": "sum(rate(logging_googleapis_com:user_payment_errors[1m]))"}}]}}},
    {"xPos": 6, "width": 6, "height": 4, "widget": {"title": "Request count", "xyChart": {"dataSets": [{"timeSeriesQuery": {
      "prometheusQuery": "sum(rate(loadbalancing_googleapis_com:https_request_count[1m]))"}}]}}}
  ]}
}
EOF
gcloud monitoring dashboards create --project=$PROJECT --config-from-file=dashboard.json

# 6. What is configured right now?
gcloud monitoring policies list --project=$PROJECT --format="table(displayName,enabled,notificationChannels.len())"

# Placeholders: pass in your own project, host and address.
variable "project" {
  type = string
}

variable "host" {
  type    = string
  default = "api.example.com"
}

variable "alert_email" {
  type = string
}

provider "google" {
  project = var.project
}

resource "google_monitoring_notification_channel" "oncall" {
  display_name = "orders on-call"
  type         = "email"

  labels = {
    email_address = var.alert_email
  }
}

resource "google_monitoring_alert_policy" "five_xx" {
  display_name = "orders-api 5xx ratio"
  combiner     = "OR"

  conditions {
    display_name = "5xx ratio above 2 percent"

    condition_prometheus_query_language {
      query               = "sum(rate(loadbalancing_googleapis_com:https_request_count{response_code_class=\"500\"}[5m])) / sum(rate(loadbalancing_googleapis_com:https_request_count[5m])) > 0.02"
      duration            = "300s"
      evaluation_interval = "60s"
    }
  }

  alert_strategy {
    auto_close = "1800s"
  }

  documentation {
    content   = "Check the last deployment, the backend health and the database first."
    mime_type = "text/markdown"
  }

  notification_channels = [google_monitoring_notification_channel.oncall.id]
}

resource "google_monitoring_uptime_check_config" "health" {
  display_name = "orders-api-health"
  timeout      = "10s"
  period       = "60s"

  http_check {
    path         = "/health"
    port         = 443
    use_ssl      = true
    validate_ssl = true
  }

  monitored_resource {
    type = "uptime_url"
    labels = {
      project_id = var.project
      host       = var.host
    }
  }
}

resource "google_monitoring_alert_policy" "uptime" {
  display_name = "orders-api uptime check failing"
  combiner     = "OR"

  conditions {
    display_name = "health check fails"

    condition_threshold {
      filter          = "metric.type=\"monitoring.googleapis.com/uptime_check/check_passed\" AND metric.label.check_id=\"${google_monitoring_uptime_check_config.health.uptime_check_id}\" AND resource.type=\"uptime_url\""
      comparison      = "COMPARISON_GT"
      threshold_value = 1
      duration        = "300s"

      aggregations {
        alignment_period     = "1200s"
        per_series_aligner   = "ALIGN_NEXT_OLDER"
        cross_series_reducer = "REDUCE_COUNT_FALSE"
        group_by_fields      = ["resource.label.*"]
      }

      trigger {
        count = 1
      }
    }
  }

  notification_channels = [google_monitoring_notification_channel.oncall.id]
}

resource "google_logging_metric" "payment_errors" {
  name        = "payment_errors"
  description = "Payment errors logged by the orders API"
  filter      = "resource.type=\"cloud_run_revision\" AND severity>=ERROR AND textPayload:\"payment failed\""

  metric_descriptor {
    metric_kind = "DELTA"
    value_type  = "INT64"
  }
}

resource "google_monitoring_dashboard" "orders" {
  dashboard_json = jsonencode({
    displayName = "orders-api"
    mosaicLayout = {
      columns = 12
      tiles = [
        {
          width = 6, height = 4
          widget = {
            title = "Payment errors per minute"
            xyChart = { dataSets = [{ timeSeriesQuery = { prometheusQuery = "sum(rate(logging_googleapis_com:user_payment_errors[1m]))" } }] }
          }
        },
        {
          xPos = 6, width = 6, height = 4
          widget = {
            title = "Request count"
            xyChart = { dataSets = [{ timeSeriesQuery = { prometheusQuery = "sum(rate(loadbalancing_googleapis_com:https_request_count[1m]))" } }] }
          }
        }
      ]
    }
  })
}

# pip install google-cloud-monitoring
# Writes one custom metric point and lists alerting policies that have no notification channel.
import time

from google.cloud import monitoring_v3

PROJECT = "my-monitoring-project"
client = monitoring_v3.MetricServiceClient()
policies = monitoring_v3.AlertPolicyServiceClient()


def write_queue_depth(depth, queue="orders"):
    """One point for one time series. Write a given series every few seconds at most, not on every request."""
    series = monitoring_v3.TimeSeries()
    series.metric.type = "custom.googleapis.com/orders/queue_depth"
    series.metric.labels["queue"] = queue                      # a small, fixed set of values: never an ID
    series.resource.type = "global"
    series.resource.labels["project_id"] = PROJECT
    now = time.time()
    interval = monitoring_v3.TimeInterval({"end_time": {"seconds": int(now), "nanos": int((now % 1) * 1e9)}})
    series.points = [monitoring_v3.Point({"interval": interval, "value": {"int64_value": int(depth)}})]
    client.create_time_series(name="projects/%s" % PROJECT, time_series=[series])


def policies_without_channels():
    found = []
    for p in policies.list_alert_policies(name="projects/%s" % PROJECT):
        if not p.notification_channels:
            found.append((p.display_name, "enabled" if p.enabled else "disabled"))
    return found


if __name__ == "__main__":
    write_queue_depth(42)
    for name, state in policies_without_channels():
        print("%-40s %-9s no notification channel" % (name, state))

// dotnet add package Google.Cloud.Monitoring.V3
// Audits the alerting policies of a project: disabled ones, ones without a notification channel, and ones without documentation.
using Google.Cloud.Monitoring.V3;

string project = args.Length > 0 ? args[0] : "my-monitoring-project";
var client = AlertPolicyServiceClient.Create();
int problems = 0;

foreach (AlertPolicy policy in client.ListAlertPolicies($"projects/{project}"))
{
    var notes = new List<string>();
    if (policy.Enabled == false) notes.Add("policy is disabled");
    if (policy.NotificationChannels.Count == 0) notes.Add("no notification channel");
    if (policy.Documentation is null || policy.Documentation.Content.Length == 0) notes.Add("no documentation for the person who is paged");

    foreach (string n in notes) { Console.WriteLine($"{policy.DisplayName,-42} {n}"); problems++; }
}

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

Services that publish metrics here include Compute Engine, Google Kubernetes Engine, Cloud Run and Cloud SQL. Encrypting the logs you keep alongside uses Cloud KMS.