Question

Your compliance team requires that all audit logs from a production project be retained for 400 days and be queryable with SQL for ad-hoc investigations, while keeping operational costs low. Application debug logs should only be kept for 14 days. You want to configure Cloud Logging with the least operational overhead. What should you do?

Accepted Answer

Create a dedicated log bucket for audit logs with a 400-day retention period and enable Log Analytics (with a linked BigQuery dataset), then route audit logs to it; keep debug logs in the _Default bucket with retention lowered to 14 days.

Answer

Export all logs via a single sink to a BigQuery dataset with a 400-day table expiration, and use a log exclusion filter to drop debug logs after 14 days.

Answer

Increase the _Default log bucket retention to 400 days for the whole project and create a scheduled Cloud Function to delete debug log entries older than 14 days.

Answer

Route audit logs to Cloud Storage with a 400-day lifecycle rule and enable Object Lifecycle Management, then query them with BigQuery external tables when needed.