How to Route Logs from the Default Log Bucket Efficiently?

Google Cloud Logging
Answer Correct answer: D — Edit the default log sink and change its destination to the newly created log bucket to preserve catch-all routing efficiently.

You have just created a new log bucket to replace the _Default log bucket. You want to route all log entries that are currently routed to the _Default log bucket to this new log bucket, in the most efficient manner. What should you do?

  1. Create exclusion filters for the _Default sink to prevent it from receiving new logs. Create a user-defined sink, and select the new log bucket as the sink destination.
  2. Disable the _Default sink. Create a user-defined sink and select the new log bucket as the sink destination.
  3. Create a user-defined sink with inclusion filters copied from the _Default sink. Select the new log bucket as the sink destination.
  4. Edit the _Default sink, and select the new log bucket as the sink destination. Correct Answer

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests understanding of system-managed sinks versus user-defined sinks, with the common trap being overcomplicating the process by recreating filters or disabling the default sink.

Changing the destination of the default log routing requires modifying the existing system sink rather than creating duplicates. This guide establishes why editing the default sink is the most efficient configuration method.

Option C is frequently selected because candidates assume they must manually copy filters to a new user-defined sink, overlooking that the default sink already captures all unmatched logs.

Community Discussion (6 comments)

Pime13 👍 1 Selected: D
https://cloud.google.com/logging/docs/buckets#manage_buckets
nah99 👍 2 Selected: D
D is most efficient and is possible to do. I just checked in GCP b/c people using AI as their source in this forum is a major red flag
3fd692e 👍 1 Selected: D
D is correct
koo_kai 👍 2 Selected: D
I think it's D
brpjp 👍 4
D is correct answer, you can change the log destination for existing sink without creating new sink. as per Gemini.
yokoyan 👍 1 Selected: C
I think it's C.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The _Default sink operates as a system-managed catch-all that automatically routes every log entry not matched by other sinks. By directly editing this sink and swapping its destination to your newly created bucket, you preserve the inclusive routing behavior without disrupting ingestion. This single-action update eliminates redundant configurations and aligns with Google Cloud best practices for resource management.

Why the Other Options Are Wrong

Creating exclusion filters or disabling the sink would break the automatic catch-all mechanism, causing logs to drop or require manual re-routing. Copying filters to a new user-defined sink adds unnecessary administrative overhead and increases the risk of misconfiguration. The exam prioritizes operational efficiency, making direct destination updates the only viable path.

Community Comment Notes

Learners who verified the console confirmed that sink destinations can be updated directly without recreating resources. Several users noted that AI-generated advice sometimes suggests overly complex workarounds, while practical testing shows the built-in edit function handles the transition seamlessly. As one commenter observed, "D is most efficient and is possible to do" after checking the live environment.

Official Reference

Exam Strategy

When configuring managed Google Cloud resources, always look for native edit capabilities before assuming you need to create or destroy components. Exam questions testing efficiency heavily favor modifying existing system-managed objects over building custom alternatives from scratch.

Frequently Asked Questions

Why shouldn't I disable the default sink before routing logs elsewhere?

Disabling it stops all unmatched logs from being captured, breaking automatic retention. Editing the destination maintains continuous ingestion.

Can I copy the default sink filters to a new user-defined sink instead?

Yes, but it adds unnecessary complexity since the default sink already acts as a catch-all. Direct editing saves time and reduces configuration errors.

Related Analysis

← Back to PCSE Study Guide