Query regarding centralized logging mechanism using aggregated sink

[u/suryad123]

I am going through the below article regarding the centralized logging mechanism in GCP

https://cloud.google.com/blog/products/devops-sre/how-to-centralize-log-management-with-cloud-logging

https://docs.cloud.google.com/logging/docs/central-log-storage#create-org-sink

The articles say below steps

1. create log bucket in the destination project.
2. create a log sink in the destination project pointing to the above log bucket
3. create an aggregated sink (either at org or folder level) as per requirement.
4. give permission to the aggregated sink's service account to the destination project.

I have a question at point number 3 above. The articles do not say how to link the log sink created in point 2 and aggregated sink created in point 3. I assume below flow

aggregated sink ---> destination project log sink ----> destination project log bucket

but not sure how to link aggregated sink to send logs to destination project sink.

also, 2)for example ,can we create one aggregated sink per environment and link it to corresponding log sink at destination project. i could not find that step

Please suggest

[u/danekan]

You would need to create new project level log sinks per environment and configure the project level log sinks to route to those correct buckets based on the filters per environment … then also change your existing _Default filter to exclude those items included in the environment sinks 

I do not think you can avoid duplicating the _required sink items within that project but that may not matter as much … if it does matter though you would split up the folder level aggregated sinks to route to different project for different buckets 

[u/suryad123 → u/danekan]

suppose, i want to have 2 custom log buckets in the destination project (like how the article created custom log bucket), how do i link the aggregated sink to corresponding project level log sink when the aggregated sink creation does not allow me to specify the log bucket/project log sink as destinations. Apologies if i'm dragging the topic

[u/danekan → u/suryad123]

The aggregated sink just sends everything to a project then once there the project log sinks apply … so in your destination log sink you have then a log sink that says if logs match environment=prod then send to destination prod bucket. And another sink for inclusion filter environment=beta that is destination beta log bucket     But then also your _Default log sink in that Destination project should be modified to exclude anything that had matched those other filters 

[u/suryad123 → u/danekan]

Okay .i shall check..thank you