Your company runs services by using Google Kubernetes Engine (GKE). The GKE dusters in the development environment run applications with verbose logging enabled. Developers view logs by using the kube

Running `gcloud container clusters update --logging=SYSTEM` configures the cluster to send only system logs, excluding *all* application logs, which might be too aggressive if some application logs of higher severity are still desired.

Running `gcloud container clusters update --logging=WORKLOAD` configures the cluster to send workload (application) logs to Cloud Logging, which would *increase* logging costs due to verbose logging, directly contradicting the goal of minimizing costs.

Running `gcloud logging sinks update _Default --disabled` would disable the *entire* `_Default` sink, meaning no logs whatsoever, including critical GKE operational logs, would be sent to Cloud Logging, violating the requirement to 'still collect GKE operational logs.'

Adding an exclusion filter like `severity >= DEBUG resource.type = "k8s_container"` to the `_Default` sink allows you to discard verbose, high-volume application logs (often at DEBUG level from Kubernetes containers) from being ingested into Cloud Logging. This significantly reduces logging costs while ensuring that essential GKE operational logs (which are typically not at DEBUG level or not from `k8s_container` resource type) are still collected and retained.