[Logpush] Small updates to the Logpush documentation (#26951)

* [Logpsuh] Update Logpush filters explanation in filters.mdx

Clarify the behavior of Logpush filters in documentation.

* [Logpush] Add warning about custom headers in Logpush

Added a warning about the manual configuration of custom headers in Logpush.

* Apply suggestions from code review

* Update src/content/docs/logs/logpush/logpush-job/custom-fields.mdx

---------

Co-authored-by: angelampcosta <[email protected]>

Author: ngayerie

src/content/docs/logs/logpush/logpush-job/custom-fields.mdx

@@ -25,6 +25,11 @@ Custom fields can be enabled via API or the Cloudflare dashboard.
 Custom fields are only available for the [HTTP requests dataset](/logs/logpush/logpush-job/datasets/zone/http_requests/).
 :::
 
+:::note
+There is no way to automatically forward all custom headers in Logpush without manually specifying each one. 
+Each request or response header must be individually configured using Custom Fields.
+:::
+
 ## Enable custom rules via API
 
 Use the [Rulesets API](/ruleset-engine/rulesets-api/) to create a rule that configures custom fields. For more information on concepts like phases, rulesets, and rules, as well as the available API operations, refer to the [Ruleset Engine](/ruleset-engine/) documentation.

src/content/docs/logs/logpush/logpush-job/filters.mdx

@@ -53,6 +53,13 @@ Here are some examples of how the logical operators can be implemented. `X`, `Y`
 
 - (X AND Y) OR Z - `{"where":{"or":[{"and": [{X},{Y}]},{Z}]}}`
 
+Logpush filters act as a pass-through gate, not an exclusion list. When multiple conditions are joined with AND:
+
+- All conditions must evaluate to TRUE for the log to be pushed.
+- If any single condition is FALSE, the log is excluded.
+
+A common misconception is interpreting the filter as `exclude logs matching ALL conditions` rather than `include logs matching ALL conditions`.
+
 ## Set filters via API or dashboard
 
 Filters can be set via API or the Cloudflare dashboard. Note that using a filter is optional, but if used, it must contain the `where` key.