list_entries: a filter containing the substring "timestamp" silently disables the default 24-hour window #17338

• I determined this is the correct repository in which to report this bug.

Summary of the issue

Context
I called Client.list_entries(filter_=...) / Logger.list_entries(filter_=...) with a filter that happens to mention timestamp somewhere other than a top-level time constraint — e.g. a JSON field named timestamp_ms, a label, or a text search.

Expected Behavior:
Per the docs ("By default, a 24 hour filter is applied"), the default timestamp>="<24h ago>" constraint should be appended whenever the user did not provide their own time bound.

Actual Behavior:
The default 24-hour window is silently dropped whenever the substring timestamp appears anywhere in the filter, even when it is not a time constraint. The query then scans the entire log history instead of the last 24 hours (much higher latency/cost and potentially huge result sets).

API client name and version

google-cloud-logging v3.15.0 (also present on current main)

Reproduction steps: code

from google.cloud.logging_v2._helpers import _add_defaults_to_filter

for f in [
    'severity>=ERROR',                 # normal -> default added
    'jsonPayload.timestamp_ms>0',      # field named *timestamp* -> default dropped
    'textPayload:"timestamp"',         # text search -> default dropped
    'labels.event_timestamp="x"',      # label -> default dropped
]:
    out = _add_defaults_to_filter(f)
    print('default_added =', 'timestamp>=' in out.replace(' ', ''), '|', repr(out))

Reproduction steps: actual results

default_added = True  | 'severity>=ERROR AND timestamp>="...."'
default_added = False | 'jsonPayload.timestamp_ms>0'
default_added = False | 'textPayload:"timestamp"'
default_added = False | 'labels.event_timestamp="x"'

Reproduction steps: expected results

The default 24-hour bound should still be added in the last three cases, since none of them is a top-level timestamp time constraint.

OS & version + platform

Any (logic bug, platform-independent)

Python environment

Python 3.12

Additional context

Root cause in google/cloud/logging_v2/_helpers.py:

elif "timestamp" not in filter_.lower():
    filter_ = f"{filter_} AND {time_filter}"

The "does the user already filter on time?" check is a naive substring match, so any incidental occurrence of timestamp suppresses the default. A more precise detection (e.g. matching a top-level timestamp comparison rather than the bare substring) would avoid silently widening the query window.