Cloud Logging datasource appends time range without grouping OR queries

[NicoKJarvinen]

Bug

In v1.7.0, the datasource appends the dashboard time range to the user query without wrapping the user expression:

%s AND timestamp >= "<from>" AND timestamp <= "<to>"

For a query with a top-level OR, Cloud Logging parses AND before OR. For example:

jsonPayload.event_type="app.error" OR (jsonPayload.event_type="app.request" AND jsonPayload.metadata.status>=500)

becomes effectively:

jsonPayload.event_type="app.error" OR (jsonPayload.event_type="app.request" AND jsonPayload.metadata.status>=500 AND timestamp >= "<from>" AND timestamp <= "<to>")

The time range therefore applies only to the final branch.

The datasource should group the user expression before appending the time range, for example:

(<user query>) AND timestamp >= "<from>" AND timestamp <= "<to>"

This was observed in a Grafana dashboard using GoogleCloudPlatform/cloud-logging-data-source-plugin v1.7.0. A local workaround is to parenthesize any dashboard query containing OR.

Related Kaamos issue: https://github.com/Kaamos-AI/kaamos/issues/2949

[xiangshen-dk]

Thanks for the detailed report. I dug into this and I don't believe there is a bug here. The Cloud Logging query language gives OR higher precedence than AND, so the appended time range already applies to the whole user expression.

Operator precedence

From the Logging query language docs:

The NOT operator has the highest precedence, followed by OR and AND in that order.

The docs give this equivalence as an example:

"a" OR NOT "b" AND NOT "c" OR "d"
("a" OR (NOT "b")) AND ((NOT "c") OR "d")

So when the plugin builds

<user query> AND timestamp >= "<from>" AND timestamp <= "<to>"

it groups as

(<user query>) AND timestamp >= "<from>" AND timestamp <= "<to>"

and the time range constrains every branch of the user query, not just the last one.

Verified against the API

I confirmed this directly against entries.list, the same call the plugin makes, using an always-true clause, a never-true clause, and a future-only timestamp bound:

Filter	Entries returned
timestamp <= "2030-01-01T00:00:00Z"	1
timestamp >= "2030-01-01T00:00:00Z"	0
timestamp <= "2030-…" OR severity="EMERGENCY" AND timestamp >= "2030-…"	0
(timestamp <= "2030-…" OR severity="EMERGENCY") AND timestamp >= "2030-…"	0
timestamp <= "2030-…" OR (severity="EMERGENCY" AND timestamp >= "2030-…")	1

The third row is the unparenthesised shape this issue is about. It returned nothing, which is only possible if it parses as (A OR B) AND C. If it parsed as A OR (B AND C), as described in the report, it would have returned an entry like the last row does.

Your example

For the query in the report, the effective filter sent to Cloud Logging is:

(jsonPayload.event_type="app.error" OR (jsonPayload.event_type="app.request" AND jsonPayload.metadata.status>=500))
AND timestamp >= "<from>" AND timestamp <= "<to>"

Adding explicit parentheses around the query does no harm, but it does not change the result.

Next steps

If you are seeing entries outside the dashboard time range, something else is going on and I'd like to find it. Could you share:

• the exact query text as entered in the panel
• the panel's time range
• one returned entry whose timestamp falls outside that range

Otherwise I'll close this as working as intended in a few days.