googleapis / googleapis/google-cloud-python
list_entries: a filter containing the substring "timestamp" silently disables the default 24-hour window
- Dominant language
- Python
- Stars
- 5.4k
- Forks
- 1.8k
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 122
Description
- [x] I determined this is the correct repository in which to report this bug.
## Summary of the issue
**Context**
I called `Client.list_entries(filter_=...)` / `Logger.list_entries(filter_=...)` with a filter that happens to mention `timestamp` somewhere other than a top-level time constraint — e.g. a JSON field named `timestamp_ms`, a label, or a text search.
**Expected Behavior:**
Per the docs ("By default, a 24 hour filter is applied"), the default `timestamp>="<24h ago>"` constraint should be appended whenever the user did not provide their own time bound.
**Actual Behavior:**
The default 24-hour window is silently dropped whenever the substring `timestamp` appears anywhere in the filter, even when it is not a time constraint. The query then scans the entire log history instead of the last 24 hours (much higher latency/cost and potentially huge result sets).
## API client name and version
google-cloud-logging v3.15.0 (also present on current `main`)
## Reproduction steps: code
```python
from google.cloud.logging_v2._helpers import _add_defaults_to_filter
for f in [
'severity>=ERROR', # normal -> default added
'jsonPayload.timestamp_ms>0', # field named *timestamp* -> default dropped
'textPayload:"timestamp"', # text search -> default dropped
'labels.event_timestamp="x"', # label -> default dropped
]:
out = _add_defaults_to_filter(f)
print('default_added =', 'timestamp>=' in out.replace(' ', ''), '|', repr(out))
```
## Reproduction steps: actual results
```
default_added = True | 'severity>=ERROR AND timestamp>="...."'
default_added = False | 'jsonPayload.timestamp_ms>0'
default_added = False | 'textPayload:"timestamp"'
default_added = False | 'labels.event_timestamp="x"'
```
## Reproduction steps: expected results
The default 24-hour bound should still be added in the last three cases, since none of them is a top-level `timestamp` time constraint.
## OS & version + platform
Any (logic bug, platform-independent)
## Python environment
Python 3.12
## Additional context
Root cause in `google/cloud/logging_v2/_helpers.py`:
```python
elif "timestamp" not in filter_.lower():
filter_ = f"{filter_} AND {time_filter}"
```
The "does the user already filter on time?" check is a naive substring match, so any incidental occurrence of `timestamp` suppresses the default. A more precise detection (e.g. matching a top-level `timestamp` comparison rather than the bare substring) would avoid silently widening the query window.
Contributor guide
Assessment
This issue has not been assessed yet.