An enterprise organization is designing an observability and log management strategy for its microservices application on Google Cloud. The operations team needs to minimize Cloud Logging storage costs for routine operational telemetry while ensuring that all high-severity application errors and security audit logs are reliably exported to BigQuery for long-term compliance analysis. Which TWO configuration steps should the Cloud Architect implement to satisfy these requirements? (Select TWO)
- Configure Log Router exclusion filters on the _Default log sink to filter out DEBUG and INFO level logs before ingestion into Log Storage.Cevap
- Create a Log Router sink with an inclusion filter for severity>=ERROR and audit logs, setting a BigQuery dataset as the destination.Cevap
- CApply an aggregate exclusion filter on the Log Router sink that drops log entries matching error log patterns to control BigQuery export volume.
- DGrant the primitive Owner role (roles/owner) to the Log Router's service account writer identity to ensure uninterrupted write access across project datasets.
- ERely exclusively on standard BigQuery IAM dataset permissions to prevent unauthorized users from exfiltrating stored log data to external Cloud Storage buckets.
Cevap
The optimal solution requires creating a Log Router sink targeting BigQuery with an inclusion filter for high-severity and audit logs, along with defining exclusion filters on the _Default sink to drop low-severity DEBUG and INFO logs.
To achieve cost optimization while satisfying compliance requirements, low-value logs (DEBUG and INFO) should be excluded from ingestion via _Default sink exclusion filters, while high-value log events (severity >= ERROR and security audit logs) must be routed to BigQuery using a dedicated Log Router sink.
Adım Adım Çözüm
Anahtar Kavram
Cloud Logging Log Router Sinks and Exclusion Filters