<p>How to create a notification filter in pub/sub subscription to select a particular message section in a JSON log.</p>
<p>For example:</p>
<ul>
<li>You have a JSON log:</li>
</ul>
<pre><code>
{ 
 &quot;incident_type&quot;: Bla bla&quot;,
 &quot;incident_state&quot;: &quot;Open&quot;,
 &quot;message&quot;: GKE Cluster upgradinging, Can't perform update operation&quot;,
 &quot;run&quot;: &quot;Unsuccessful&quot;

}
</code></pre>
<hr />
<p>Tried this <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-notifications" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-notifications</a></p>
<hr />

<p>Maybe you can use the subscription <strong>filter</strong></p>
<blockquote>
<p>If a filter syntax is provided, subscribers will only receive messages
that match the filter.</p>
</blockquote>
<p>With <strong>Golang</strong></p>
<pre><code>import (
        &quot;context&quot;
        &quot;fmt&quot;
        &quot;io&quot;

        &quot;cloud.google.com/go/pubsub&quot;
)

func createWithFilter(w io.Writer, projectID, subID, filter string, topic *pubsub.Topic) error {
        filter := &quot;attributes.author=\&quot;unknown\&quot;&quot;
        client, err := pubsub.NewClient(ctx, projectID)
        if err != nil {
                return fmt.Errorf(&quot;pubsub.NewClient: %v&quot;, err)
        }
        defer client.Close()

        sub, err := client.CreateSubscription(ctx, subID, pubsub.SubscriptionConfig{
                Topic:  topic,
                Filter: filter,
        })
        if err != nil {
                return fmt.Errorf(&quot;CreateSubscription: %v&quot;, err)
        }
        fmt.Fprintf(w, &quot;Created subscription with filter: %v\n&quot;, sub)
        return nil
}
</code></pre>
<p>Ref : <a href="https://cloud.google.com/pubsub/docs/subscription-message-filter" rel="nofollow noreferrer">Google doc</a></p>
<p><a href="https://i.stack.imgur.com/LfD72.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LfD72.png" alt="enter image description here" /></a></p>
