Log volume bursts, ingestion quota throttling, network bottlenecks, slow transformation rules, or custom-format entries that fail to parse may delay the ingestion pipeline or overflow agent and sink buffers. Log entries arrive late or are dropped, so log-based metrics under-count, detections fire after the fact and the audit trail has gaps, reducing the availability and integrity of log data.
Log Entries are Delayed or Dropped During Ingestion
CCC.Logging.TH01
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Logging.CP03 | Real-Time Log Ingestion | The service automatically makes ingested log entries available for search and alerting in near real time, so that detection and response are not delayed. |
| CCC.Logging.CP04 | Centralised Log Collection | The service may be configured to aggregate logs from resources in multiple accounts or projects into a single central logging destination. |
| CCC.Logging.CP05 | Custom Log Format Support | The service can be configured to ingest custom log formats, including logs from on-premises systems or other cloud environments, through its collection agents. |
| CCC.Logging.CP06 | Log Filtering and Transformation | The service may be configured to filter, normalise, and transform raw log data at ingestion to reduce storage volume and improve usability. |
| CCC.Logging.CP11 | Log-based Metrics | The service may be configured to derive numeric metrics from log entries that match a query or filter, for performance monitoring and alerting. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Logging.CN09 | Alert on Log Ingestion Failure | Ensure that throttled, rejected, or silently missing log data is detected promptly, so that gaps in the audit trail are visible before they hinder detection or forensics. |