googleapis / googleapis/google-cloud-python

list_entries: a filter containing the substring "timestamp" silently disables the default 24-hour window

Offen
#17,338 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
priority: p2 type: bug
Vorherrschende Sprache
Python
Sterne
5.4k
Forks
1.8k
Ø Merge
3 T. 4 Std.
Gemergte PRs (30 T.)
122

Beschreibung

- [x] I determined this is the correct repository in which to report this bug.

## Summary of the issue

**Context**
I called `Client.list_entries(filter_=...)` / `Logger.list_entries(filter_=...)` with a filter that happens to mention `timestamp` somewhere other than a top-level time constraint — e.g. a JSON field named `timestamp_ms`, a label, or a text search.

**Expected Behavior:**
Per the docs ("By default, a 24 hour filter is applied"), the default `timestamp>="<24h ago>"` constraint should be appended whenever the user did not provide their own time bound.

**Actual Behavior:**
The default 24-hour window is silently dropped whenever the substring `timestamp` appears anywhere in the filter, even when it is not a time constraint. The query then scans the entire log history instead of the last 24 hours (much higher latency/cost and potentially huge result sets).

## API client name and version

google-cloud-logging v3.15.0 (also present on current `main`)

## Reproduction steps: code

```python
from google.cloud.logging_v2._helpers import _add_defaults_to_filter

for f in [
'severity>=ERROR', # normal -> default added
'jsonPayload.timestamp_ms>0', # field named *timestamp* -> default dropped
'textPayload:"timestamp"', # text search -> default dropped
'labels.event_timestamp="x"', # label -> default dropped
]:
out = _add_defaults_to_filter(f)
print('default_added =', 'timestamp>=' in out.replace(' ', ''), '|', repr(out))
```

## Reproduction steps: actual results

```
default_added = True | 'severity>=ERROR AND timestamp>="...."'
default_added = False | 'jsonPayload.timestamp_ms>0'
default_added = False | 'textPayload:"timestamp"'
default_added = False | 'labels.event_timestamp="x"'
```

## Reproduction steps: expected results

The default 24-hour bound should still be added in the last three cases, since none of them is a top-level `timestamp` time constraint.

## OS & version + platform

Any (logic bug, platform-independent)

## Python environment

Python 3.12

## Additional context

Root cause in `google/cloud/logging_v2/_helpers.py`:

```python
elif "timestamp" not in filter_.lower():
filter_ = f"{filter_} AND {time_filter}"
```

The "does the user already filter on time?" check is a naive substring match, so any incidental occurrence of `timestamp` suppresses the default. A more precise detection (e.g. matching a top-level `timestamp` comparison rather than the bare substring) would avoid silently widening the query window.

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.