Examkin

Question

Difficulty: MediumMonitoring, Logging, and Observability Integration

An enterprise e-commerce platform hosts its core transaction services on Google Cloud Compute Engine instances and Cloud Run services. The cloud operations team notices escalating Google Cloud Logging ingestion costs driven by high-volume informational and debug logs. During a recent system outage, post-incident analysis revealed that critical error logs were missing because a broad exclusion filter was applied across all log entries. The lead cloud architect must reduce logging ingestion costs while ensuring that all high-severity error logs are retained in Cloud Logging for real-time operational alerting, and audit logs are archived to Cloud Storage for compliance. Which configuration strategy should the architect implement?

  1. Configure an exclusion filter on the _Default log bucket sink with the expression 'severity < ERROR' to exclude low-severity logs from ingestion into Cloud Logging, and create a separate log sink to export audit logs to Cloud Storage.Answer
  2. B
    Configure an exclusion filter on the _Default log bucket sink with the expression 'severity >= INFO', while assigning the Owner primitive IAM role to team leads to manually disable exclusion filters during debugging sessions.
  3. C
    Apply a broad resource exclusion filter matching resource.type="gce_instance" across the entire organization log router without severity conditions, relying solely on standard IAM permissions to restrict log visibility.
  4. D
    Create an exclusion filter on the _Default sink using the expression 'severity >= DEFAULT' to filter out all unassigned log levels, assuming application error logs will automatically bypass log routing filters.

Answer

The architect should configure an exclusion filter on the _Default log bucket sink with the filter expression 'severity < ERROR' to prevent low-severity logs from being ingested into Cloud Logging, while maintaining a dedicated sink for exporting audit logs to Cloud Storage.
Configuring an exclusion filter on the _Default sink with 'severity < ERROR' prevents low-severity logs (DEBUG, INFO, NOTICE) from being ingested into the log bucket, directly addressing high storage costs. Because the filter only excludes logs below ERROR severity, all high-severity logs (ERROR, CRITICAL, ALERT, EMERGENCY) are retained for real-time observability and incident response. Creating a separate sink for Cloud Storage ensures compliance log retention goals are met independently.

Step-by-Step Solution

1
Analyze the logging requirements and cost drivers.
Informational and debug logs (severity below ERROR) drive up Cloud Logging ingestion costs, whereas logs with severity ERROR or higher are required for operational alerting.
Cloud Logging charges based on the volume of logs ingested into log buckets.
2
Determine the correct Cloud Logging exclusion filter logic.
Using 'severity < ERROR' as an exclusion filter on the _Default sink drops DEBUG, INFO, and NOTICE logs before ingestion, while allowing ERROR, CRITICAL, ALERT, and EMERGENCY logs to be stored in the bucket.
Exclusion filters prevent matching log entries from being ingested into specific sinks/buckets, directly controlling storage and ingestion costs.
3
Configure compliance routing for audit logs.
A dedicated log sink routes audit logs directly to Cloud Storage independently of log bucket exclusion filters.
Log Router sinks evaluate incoming logs prior to bucket ingestion, allowing parallel exports to Cloud Storage targets for long-term retention.

Key Concept

Cloud Logging Log Router Exclusion Filters and Sink Routing
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic