sum by (resource_labels_backend_service_name, jsonPayload_statusDetails) (
  rate(
  {job="promtail-gcp/gcplog-http-load-balancer-prod"}
  | json
  | resource_labels_backend_service_name="cortex-prod-09-prod-au-southeast-0"
  | httpRequest_status!="200"[$__interval])
)

OR

sum by (resource_labels_backend_service_name, jsonPayload_statusDetails) (
  rate(
  {job="cloud/gcp", resource_type="http_load_balancer"}
  | json
  | httpRequest_status!="200"[$__interval])
)