Deprecated. Use /api/projects/{project_id}/ instead.

A UUID string identifying this logs exclusion rule.

Unique identifier for this sampling rule.

User-visible label for this rule.

When false, the rule is ignored by ingestion and listing UIs that show active rules only.

Lower numbers are evaluated first; the first matching rule wins. Omit to append after existing rules.

Rule kind: severity_sampling, path_drop, or rate_limit (caps matching log volume at ingestion). * `severity_sampling` - Severity-based reduction * `path_drop` - Path exclusion * `rate_limit` - Rate limit

Optional legacy service-name scope; new rules use `config.filter_group` for matching instead.

Optional regex matched against a path-like log attribute when present.

Optional list of predicates over string attributes, e.g. [{"key":"http.route","op":"eq","value":"/api"}].

Type-specific JSON. For path_drop: object with optional `filter_group` (PropertyGroupFilter shape — AND/OR tree of property predicates evaluated per record) and/or legacy `patterns` (list of regex strings) + `match_attribute_key` (string). When both are present a record is dropped if EITHER matches. Filter group example: `{"type":"AND","values":[{"type":"AND","values":[{"key":"service.name","operator":"exact","value":"api"}]}]}`. Every group in `filter_group` must contain at least one filter — empty groups never match, so the rule would never apply. For severity_sampling: object with `actions` per severity level and optional `always_keep`. For rate_limit: object with EITHER `logs_per_second` (integer 1–1000000, optional `burst_logs` integer ≥ logs_per_second, max 10000000) OR `kb_per_second` (integer 1–1000000 = 1 GB/s, optional `burst_kb` integer ≥ kb_per_second, max 10000000) — not both. Plus optional `filter_group` to narrow which logs the cap applies to. KB-mode charges each log its own uncompressed byte size, matching how billing measures ingested bytes.

Incremented on each update for worker cache coherency.