Glossary term
Log sink
A Cloud Logging routing rule sending matching entries to a log bucket, Cloud Storage, BigQuery, Pub/Sub or another project. Deleting one blinds defenders.
A log sink is a Cloud Logging router rule: a filter plus a destination (a log bucket, a Cloud Storage bucket, a BigQuery dataset, a Pub/Sub topic or another project). Every project has two system sinks, _Required (cannot be modified or deleted) and _Default; administrators add their own, for example to feed a SIEM or keep audit logs for years.
Sinks do not backfill: they only export entries written after their creation. For investigators, a sink bucket copied from Cloud Storage is often the best evidence available. For attackers, deleting or redirecting a sink (DeleteSink, UpdateSink) is a way to blind defenders, which is why organization-level aggregated sinks to a locked bucket are recommended.