Compliance requires retaining searchable, queryable network logs for seven years and running SQL queries for investigations. Which design is the best fit?

The best solution is to create a Cloud Logging sink exporting network logs to a BigQuery dataset. BigQuery is a fully managed, petabyte-scale data warehouse that supports SQL queries, making it ideal for long-term storage and complex analytical investigations over seven years of data. Cloud Logging's default retention is insufficient, and while it can be increased, BigQuery offers superior query performance and cost-effectiveness for such large datasets. Exporting to Cloud Storage only would require additional tools for SQL querying, as Logs Explorer cannot directly run SQL queries against objects in Cloud Storage. Pub/Sub is a messaging service, not a long-term data store, and retaining messages indefinitely is not its intended use case for archival and SQL analysis.