Datadog Log Management Fundamentals free question 5 / 10 · Domain 3: Log Searching & Filtering
You open Live Tail for a high-volume service, and it seems to show only part of the logs that should match your query. Which option matches how the documentation explains this behavior, and what it tells you to do to see every log?
- Logs with a high severity such as errors are kept first; remove the status condition from the query
- Logs over the daily quota of the index are dropped; raise the daily quota of the index for this service
- The most recent logs that fit on the screen are kept; pause the view and scroll back to the older ones
- The output is sampled uniformly at random for readability; add search filters to scope the query down
Show the answer and explanation
Answer: D
Why this is correct
The note in the "Live Tail view" section says that, for the sake of readability, the Live Tail output is sampled when too many logs matching the query are flowing in. The sampling applied is uniformly random, so the logs you see in Live Tail are statistically representative of your actual log throughput. The same note tells you to scope your query down with additional search filters if you need visibility on every single log flowing in. Fewer matching logs means less sampling, so narrowing the query is the way to see each log.
Why the other options are wrong
"Logs with a high severity such as errors are kept first; remove the status condition from the query" … The sampling is uniformly random, so each status keeps its share of the output. Removing a condition makes more logs match the query, which pushes Live Tail toward more sampling, not less.
"The most recent logs that fit on the screen are kept; pause the view and scroll back to the older ones" … The note describes a uniformly random sample of the matching logs, not a cut that keeps the newest ones. The remedy it gives is to scope the query down with more filters.
"Logs over the daily quota of the index are dropped; raise the daily quota of the index for this service" … The note ties the sampling to readability when too many matching logs are flowing in. The fix it gives is on the query side, with additional search filters, not on the index settings.
Key point
Because the sample is statistically representative, a sampled Live Tail is still good for reading trends, such as which service or status is producing the most logs right now. Add conditions such as a host or a service only when you must not miss a single specific log, so that the flow of matching logs becomes small enough to show in full.