The approach below could work if VM instances have been accessed via HTTP.
Back in the 2014, Gary Ling, a GCP Product Manager, explained at Google Groups how public addresses are being handled:
"We are aware of this issue that (almost) all Google IP addresses are
SWIP'ed to be Mountain View, CA. And at Google, it's not uncommon to
remap a block of IPs from one location to another, especially given
the elasticity of IP addresses for the Cloud. Too bad that many of
external Geo IP services solely depend on SWIP database. While we are
evaluating what we can do to help our customers, your best bet in my
opinion is contacting your API provider and explore options they may
That means that till an External IP is configured as the Standard (regional) type, it is impossible to obtain the VM instance location based on the address.
In this situation the fact that VM instance itself is bound to a Zone can help to restore lost bindings retrospectively.
Unfortunately GCP Logging does not save information about External IP address binding, in contrast with the Internal IP. In addition, when a VM instance is stopped, this information gets lost in the Compute Engine configuration.
Fortunately this information can be obtained from the web server access log. In case you stopped and then started VM instance, it would lose its Ephemeral External IP and get a new one. Hence you would need to request information about both addresses the VM instance has had.
Go to the Logs Viewer and switch it to the new version view:
GCP Navigation Menu => Stackdriver => Logging => Logs Viewer => Classic => Preview the new Logs Viewer
Enter and run a query like this:
"220.127.116.11" OR "18.104.22.168"
gcloud command line in CloudShell (preparation steps are provided for your convenience):
$ gcloud config list
$ gcloud config set account 'account'
$ gcloud config set core/project 'project_id'
$ gcloud logging read 'timestamp>="2019-12-19" AND "GET" AND "22.214.171.124" OR "126.96.36.199"'
You will see log entries from the web server access log (Apache in this example) that contain the External IP of the VM instance, its ID, zone and name as the values
compute.googleapis.com/resource_name respectively. In the example below the information is retrospectively restored from logs that mentions the ephemeral External IP
188.8.131.52 was bound to the VM instance
ssh2 in the region
"textPayload": "184.108.40.206 - - [19/Dec/2019:12:36:34 +0100] "GET /icons/openlogo-75.png HTTP/1.1" 200 6040 "http://220.127.116.11/" "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0"",
This works both for the Ephemeral and Static External IP, and, what's important, it remains in the Stackdriver logs even after the VM has been deleted.
The output of the query could be huge. It is up-to-you to process the output with the
--flatten command line parameters or any parsing script as needed.
$ gcloud logging read 'timestamp>="2019-12-19" AND "GET" AND "18.104.22.168" OR "22.214.171.124"' --format="table(labels.'compute.googleapis.com/resource_name',resource.labels.instance_id,resource.labels.zone,textPayload)"
COMPUTE.GOOGLEAPIS.COM/RESOURCE_NAME INSTANCE_ID ZONE TEXT_PAYLOAD
ssh2 8445465273187245258 europe-west3-c 126.96.36.199 - - [19/Dec/2019:12:56:56 +0100] "GET /icons/openlogo-75.png HTTP/1.1" 200 6040 "http://188.8.131.52/" "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0"
ssh2 8445465273187245258 europe-west3-c 184.108.40.206 - - [19/Dec/2019:12:36:34 +0100] "GET /icons/openlogo-75.png HTTP/1.1" 200 6040 "http://220.127.116.11/" "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0"
Please see the following links for more advanced query examples:
Advanced logs queries
Filtering and formatting fun with gcloud, GCP’s command line interface