Datadog Log Management Fundamentals free question 1 / 10 · Domain 1: Logging Fundamentals
You need to keep security, transaction, and network logs for a long time. They are rarely queried, but during an incident they must be searched urgently. Which way of storing them does the Datadog documentation describe for this kind of log?
- Exclude them from indexes and keep the metrics generated from those logs instead
- Keep them in the Flex Logs tier, which decouples the storage cost from the compute cost
- Route them to an archive and rehydrate them each time somebody needs to query them
- Keep them in a Standard Indexing index and lengthen the retention period of that index
Show the answer and explanation
Answer: B
Why this is correct
The "When to use Flex Logs" section divides Log Management into three solutions. Standard Indexing is for logs that need to be queried frequently and retained short term, such as application logs. Flex Logs is for logs that need to be retained long term but sometimes need to be queried urgently, such as security, transaction, and network logs. Archiving is for logs that are infrequently queried and need to be stored long term, such as audit and configuration logs. Flex Logs keeps long-term retention cost-effective by decoupling storage from query compute.
Why the other options are wrong
"Keep them in a Standard Indexing index and lengthen the retention period of that index" … Standard Indexing is described for logs that are queried frequently and retained short term, such as application logs. Rarely queried logs kept for a long time are not the case it is listed for.
"Route them to an archive and rehydrate them each time somebody needs to query them" … Archiving is described for logs that are infrequently queried and stored long term, such as audit and configuration logs. Logs that must be searched urgently during an incident are not the case it is listed for.
"Exclude them from indexes and keep the metrics generated from those logs instead" … Metrics generated from logs keep counts and values over time, not the content of each log. The requirement here is to search the logs themselves when an incident happens.
Key point
Pick among the three by how often the logs are queried and how long they must be kept. Whether the logs must be queryable urgently is what separates Flex Logs from archives.