You have just created a new log bucket to replace the _Default log bucket. You want to route all log entries that are currently routed to the _Default log bucket to this new log bucket, in the most…

Question

Options

• ACreate exclusion filters for the _Default sink to prevent it from receiving new logs. Create a user-
• BDisable the _Default sink. Create a user-defined sink and select the new log bucket as the sink
• CCreate a user-defined sink with inclusion filters copied from the _Default sink. Select the new log
• DEdit the _Default sink, and select the new log bucket as the sink destination.

• A
  4% (1)
• B
  8% (2)
• C
  4% (1)
• D
  83% (20)

Explanation

Editing the _Default sink directly (option D) is the most efficient approach because the _Default sink already captures all log entries you want - you simply redirect its destination to the new bucket with a single configuration change, requiring no filter duplication or extra steps.

Why the distractors fail:

• A is wrong because creating exclusion filters on _Default only blocks logs from reaching it; you'd still need a separate sink, and exclusion filters don't route logs anywhere.
• B is wrong because you cannot disable the _Default sink - it's a system sink that can only be modified, not disabled. You'd also lose logs during any gap.
• C works technically, but copying inclusion filters and creating a new sink is redundant extra work when you can simply edit the existing _Default sink in place.

Memory tip: Think of the _Default sink like a mail forwarding rule - when you move, you don't cancel your old rule and write a new one from scratch; you just update the delivery address. "Edit, don't recreate" is the most efficient path.

No community discussion yet for this question.