I'm trying to export logs from Google Cloud through a Pub/Sub topic.
As part of the process, I have to create something called an "inclusion filter". The only documentation I can find on this filter is here: https://cloud.google.com/logging/docs/exclusions
This documentation says next to nothing about the inclusion filter query language. There is exactly one example:
NOT LOG_ID("cloudaudit.googleapis.com/activity") AND NOT \
LOG_ID("externalaudit.googleapis.com/activity") AND NOT \
LOG_ID("cloudaudit.googleapis.com/system_event") AND NOT \
LOG_ID("externalaudit.googleapis.com/system_event") AND NOT \
LOG_ID("cloudaudit.googleapis.com/access_transparency") AND NOT \
LOG_ID("externalaudit.googleapis.com/access_transparency")
This example corresponds to nothing I already know about logging in GCP. I don't know what the URLs mean, or where to get the ones that correspond to the services whose logs I want to export. I can guess that the query language supports SQL-style logical operators. I suppose that putting LOG_ID("someurl.googleapis.com/something") into the query causes it to match logs that have some relationship to that URL. I can further guess that maybe these URLs map to service names (as seen in the Legacy Logs Viewer) such as "GAE Application, my-app". But already my guesses are probably getting into questionable territory, since they're just guesses. None of this is stated in the only documentation that I could find.
Where are the docs? How can I make any use of this feature?
The inclusion filter is written in the logging query language.