Question

Your team runs a high-traffic web service on GKE. Cloud Logging costs have risen sharply, and analysis shows that the majority of ingested volume comes from verbose HTTP access logs with severity INFO from the ingress load balancer. Compliance requires that all WARNING and higher logs remain searchable in Cloud Logging for 30 days, and a subset of the INFO access logs must still be retained cheaply for later ad-hoc analysis. What is the most cost-effective way to meet these requirements?

Accepted Answer

Create an exclusion filter on the _Default log bucket sink that drops the INFO access logs, and add a separate sink that exports those same INFO logs to a Cloud Storage bucket.

Answer

Reduce the retention period of the _Default log bucket to 7 days so all logs, including WARNING and higher, are purged sooner.

Answer

Disable the Cloud Logging agent on the GKE nodes so INFO access logs are never generated.

Answer

Create a log-based metric that counts the INFO access logs and delete the raw log entries once the metric is recorded.