Full logs vs sampled logs
A managed log intake bills each line. Keeping every line costs 20,824 USD/mo in this test. A sampler keeps the error lines and a share of the info lines, and costs 3,264 USD/mo. It stays under the 4,600 USD/mo limit, keeps 99 percent of errors and passes at least 400 info lines/s.
One CPU graph · CPU 40% · disk no graph · the fault is hidden
1,500 req/s · Node API · 3 hosts · 18 USD/mo
Case 1
A fleet sends 20,000 info lines/s and 200 error lines/s. For 30 s, errors reach 3,000 lines/s. Keep 99 percent of errors and 400 info lines/s, and stay under 4,600 USD/mo.
| Measure | Goal | Keep every line | Sample info lines |
|---|---|---|---|
| Error rate (Errors) | under 1% | 0% Pass | 0% Pass |
| Throughput (Info) | at least 400 req/s | 8,560 req/s Pass | 819 req/s Pass |
| Monthly cost | under 4,600 USD/mo | 20,824 USD/mo Fail | 3,264 USD/mo Pass |
| Monthly cost | 20,824 USD/mo | 3,264 USD/mo | |
| p99 latency | 15 ms | 15 ms |