Cloud logging router default sink not work

[sonpn8]

Hi, I am currently using Cloud logging with the _Default sink Exclusion filter to reduce the number of logs. However, it seems that the Exclusion filter may not be working properly. I have noticed that my billing for the Cloud Logging service has increased compared to the previous month.

The Exclusion filter rule that I have set is:

resource.type="k8s_cluster" AND protoPayload.methodName="io.k8s.coordination.v1.leases.update"

Despite this rule, the log entries that should be excluded based on this filter are still appearing in my log queries.

[JuatonCJ]

Hi @sonpn8,

Welcome to Google Cloud Community!

It is recommended to add this Log query to the Exclusion filter:

NOT resource.type="k8s_cluster" AND NOT protoPayload.methodName="io.k8s.coordination.v1.leases.update"

Click Done and after updating the sink, click on "See logging bucket."

In the Log Explorer, select the project logs.

Change Current project into log view and make sure to check  _Default to filter the excluded logs under the _Default sink and click Apply.

Note: Please wait a few minutes, it will take some time to  minimize the number of logs.

The log shows that the "io.k8s.coordination.v1.leases.update" was not included.

For more reference regarding sink and exclusion filters, review the following documentations:

• Route logs to supported destinations 
• Routing and storage overview
• _Default sink cloud logging
• Logging query language

For further assistance feel free to file a ticket to Google cloud support team.

I hope the above information is helpful.