Cloud Armor logs aren't very clear when rule is set as "Preview only"

I'm deploying WAF with Cloud Armor and I realized that the rules can be created in a "Preview only" mode and that there are Cloud Armor entries in Cloud Logging.

The problem is that when I create a "Preview only" rule and that rule is matched by some request, I cannot differentiate, in the logs, the requests that matched some specific rule and/or the normal, ordinary requests. They look all pretty much the same.

Are there any logging attributes that only exist (or have specific values) when the request match a specific rule in these cases? Because the only way I found to explicitly check the rules matched by some request is unchecking the "Preview only" flag, and it is not nice for production when testing.

When you have rules configured in Cloud Armor set to "Preview", Cloud Logging will record what the rule would have done if enabled.

This Cloud Logging filter will show you entries that were denied by Cloud Armor:

resource.type="http_load_balancer"
jsonPayload.statusDetails="denied_by_security_policy"

This Cloud Logging filter will show you entries that would have been denied by Cloud Armor:

resource.type="http_load_balancer"
jsonPayload.previewSecurityPolicy.outcome="DENY"

In Cloud Logging, set the resource.type to "http_load_balancer" and delete the second filter line to see all entries.

Expand one of the entries:

Look for "jsonPayload.enforcedSecurityPolicy". This is the Cloud Armor Policy.

Look for "jsonPayload.previewSecurityPolicy". This provides details on the rule priority which tells you the rule and the outcome if the rule was not in preview.

Example screenshot: