("data.protoPayload.resource.type":k8s_cluster ("data.protoPayload.logName":cloudaudit.googleapis.com\/activity OR "data.protoPayload.logName":cloudaudit.googleapis.com%2Factivity) "data.protoPayload.methodName":io.k8s.core.v1.pods.create) "image\-policy.k8s.io\/break\-glass"