googleapis / googleapis/google-cloud-python

list_entries: a filter containing the substring "timestamp" silently disables the default 24-hour window

Abierto
#17,338 0 comentarios 0 reacciones 0 asignados Ver en GitHub
priority: p2 type: bug
Lenguaje dominante
Python
Estrellas
5.4k
Forks
1.8k
Merge medio
3 d 4 h
PR fusionados (30 d)
122

Descripción

- [x] I determined this is the correct repository in which to report this bug.

## Summary of the issue

**Context**
I called `Client.list_entries(filter_=...)` / `Logger.list_entries(filter_=...)` with a filter that happens to mention `timestamp` somewhere other than a top-level time constraint — e.g. a JSON field named `timestamp_ms`, a label, or a text search.

**Expected Behavior:**
Per the docs ("By default, a 24 hour filter is applied"), the default `timestamp>="<24h ago>"` constraint should be appended whenever the user did not provide their own time bound.

**Actual Behavior:**
The default 24-hour window is silently dropped whenever the substring `timestamp` appears anywhere in the filter, even when it is not a time constraint. The query then scans the entire log history instead of the last 24 hours (much higher latency/cost and potentially huge result sets).

## API client name and version

google-cloud-logging v3.15.0 (also present on current `main`)

## Reproduction steps: code

```python
from google.cloud.logging_v2._helpers import _add_defaults_to_filter

for f in [
'severity>=ERROR', # normal -> default added
'jsonPayload.timestamp_ms>0', # field named *timestamp* -> default dropped
'textPayload:"timestamp"', # text search -> default dropped
'labels.event_timestamp="x"', # label -> default dropped
]:
out = _add_defaults_to_filter(f)
print('default_added =', 'timestamp>=' in out.replace(' ', ''), '|', repr(out))
```

## Reproduction steps: actual results

```
default_added = True | 'severity>=ERROR AND timestamp>="...."'
default_added = False | 'jsonPayload.timestamp_ms>0'
default_added = False | 'textPayload:"timestamp"'
default_added = False | 'labels.event_timestamp="x"'
```

## Reproduction steps: expected results

The default 24-hour bound should still be added in the last three cases, since none of them is a top-level `timestamp` time constraint.

## OS & version + platform

Any (logic bug, platform-independent)

## Python environment

Python 3.12

## Additional context

Root cause in `google/cloud/logging_v2/_helpers.py`:

```python
elif "timestamp" not in filter_.lower():
filter_ = f"{filter_} AND {time_filter}"
```

The "does the user already filter on time?" check is a naive substring match, so any incidental occurrence of `timestamp` suppresses the default. A more precise detection (e.g. matching a top-level `timestamp` comparison rather than the bare substring) would avoid silently widening the query window.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.