Question

A security team must centralize audit logs from all projects in an organization into a single BigQuery dataset for long-term analysis. They want the collection to automatically include any projects created in the future, and they must exclude high-volume Data Access logs from Cloud Storage to control BigQuery ingestion costs. Which approach meets all requirements with the least ongoing maintenance?

Accepted Answer

Create an aggregated log sink at the organization level with includeChildren enabled, route it to the BigQuery dataset, and add an exclusion filter for the Cloud Storage Data Access logs.

Answer

Create a separate log sink in every existing project pointing to the BigQuery dataset and configure Cloud Scheduler to create sinks in new projects automatically.

Answer

Enable a log sink in each project that routes all logs to a Pub/Sub topic, then use a Cloud Function to filter and load logs into BigQuery.

Answer

Create an aggregated sink at the organization level routing to Cloud Storage, then schedule a BigQuery load job that skips Data Access log files.