Which notification method is suitable to detect missing data from forwarders within five minutes?

• A. Create a notification in Cloud Monitoring using a metric-absence condition (sample policy) per collector_id.
• B. Create a SecOps SIEM dashboard showing ingestion metrics for log_type and collector_id.
• C. Create an ingestion notification for health metrics in Cloud Monitoring based on total ingested log count per collector_id.
• D. Create a Looker dashboard querying BigQuery ingestion metrics schema.

Answer: (A)

The key idea is to detect when data stops arriving within a short window for each forwarder. A metric-absence alert in Cloud Monitoring fits this need perfectly: it triggers when no samples for a given metric are received over a specified duration, and by filtering for each collector_id you get per-forwarder visibility. Setting the duration to five minutes means you’ll be notified as soon as a forwarder stops sending data for that window, which is exactly the scenario you want to catch.

Why the other approaches aren’t as suitable: using a SIEM dashboard to visualize ingestion metrics doesn’t inherently alert you in real time about gaps, so you’d still rely on manual checks or separate alerting. An alert based on total ingested log count per collector_id can indicate drops, but it’s less precise for detecting a lack of data within a strict five-minute window and can be influenced by delays or batch processing. A Looker dashboard tied to BigQuery is great for analysis, but it isn’t a real-time notification mechanism.