Logging Query Language Nested Regex Timestamp Filter

What the Logging Query Language Solution Is

In Google Cloud Observability, the Logging query language is the native expression syntax used within the Logs Explorer to evaluate, filter, and extract log entries from Cloud Logging buckets based on structured and unstructured attributes.

How it meets the requirements

• Resource type restriction: Evaluates the monitored resource using exact field comparison resource.type="k8s_container".
• Severity filtering: Cloud Logging treats log severities as ordered enumerations (DEFAULT, DEBUG, INFO, NOTICE, WARNING, ERROR, CRITICAL, ALERT, EMERGENCY). The comparison severity >= ERROR correctly matches all logs at ERROR level and above without having to enumerate each higher severity.
• Historical time range: Compares the timestamp field directly against RFC 3339 / ISO 8601 formatted string literals using comparison operators (>= and <=) joined by the AND operator.
• Nested payload & Regular Expression matching: Accesses the nested JSON property using dot notation (jsonPayload.errorMessage) and uses the regex comparison operator (=~) with the (?i) case-insensitive flag and regex pattern "(?i)connection (refused|timeout)".

Key Advantages

• Employs indexed attributes (resource.type, severity, timestamp) to narrow scan volume rapidly before evaluating payload expressions.
• Directly leverages RE2 regular expression syntax supported natively by Google Cloud Logging.
• Allows exact targeting of nested fields within structured payloads without parsing overhead.

Why this is optimal

This expression correctly uses standard Logging query language syntax, avoiding SQL-specific constructs or invalid comparison operators that would fail validation in the standard Logs Explorer query pane.