Most teams we talk to have already cut logs once. Usually it happened in a hurry before a renewal: whole sources turned off, retention shortened. Those are reasonable decisions. But they worked for a quarter or two, and then the remaining sources grew into the gap.
The pressure isn't easing. Dynatrace's log management survey this year covered 450 large enterprises. Log and telemetry volume rose 93% over twelve months, and one in five saw growth above 150%. Most of that growth was attributed to AI workloads. Log tooling now takes 45% of the observability budget, about $2.5M a year on average. Roughly half of respondents already exclude 86% of their logs from ingestion or analysis to hold cost down, and the bill is still growing.
Two approaches that do not hold up
Cutting whole sources. Log platforms charge by volume, and a gigabyte costs the same whether anyone reads it or not. Datadog, for example, charges $0.10 per GB to ingest plus $1.70 per million events to keep them searchable. The same gigabyte in S3 Glacier Deep Archive costs about a tenth of a cent a month. The searchable tier costs roughly a thousand times more than cold storage, yet most teams decide what goes there one whole source at a time. When you turn off a source, you lose its few useful records along with its many useless ones.
Shortening retention. This lowers the storage line, but it doesn't touch ingest, which is where volume growth shows up first. Compliance also sets a floor. PCI DSS requirement 10.5.1 asks for twelve months of audit log history.
Most of the volume inside a source is not signal
Inside a single source, much of the volume is formatting: whitespace, repeated key names, redundant timestamps. Much of the rest is records that never match a rule, such as allowed connections and heartbeats, plus fields nothing downstream reads. A firewall record can carry dozens of fields, and the rules that consume it use a handful.
These are the ranges we see when we run record- and field-level reduction:
|
Source |
Reduction |
|---|---|
|
Firewall traffic |
60–85% |
|
VPC flow logs |
60–80% |
|
Windows Security |
60–70% |
|
Application / APM |
50–75% |
|
CloudTrail |
40–60% |
Windows Security at default audit settings is mostly low-value event IDs. Firewall traffic is mostly allowed connections. Application logs are mostly debug. None of that is needed for detection, and none of it needs to reach the SIEM.
These ranges are not a promise for your environment. They depend on your audit settings and on which fields your rules actually read.
How Fleak does it
Fleak is a log pipeline. It sits between your sources and your destinations and decides, per record and per field, what to keep or drop.
- Formatting comes out first. Whitespace, tabs, padding, repeated key names and structural overhead are removed before the byte counter sees anything. No information is lost.
- Records are classified. Fleak checks whether each event changes state, records a decision, or matches your detection logic. Each event is then kept, summarized, or dropped from the analytics stream.
- Fields are trimmed per source. Fleak keeps the fields your rules and dashboards reference and drops or hashes the rest.
Every rule is readable and editable by your team. No model sits in the middle deciding what's important. Fleak doesn't decide which detections you need, either; it follows the rules you already have.
Common questions
Will we lose anything we need for an investigation?
Not if you keep a full copy. Fleak can land the full-fidelity stream in object storage before reduction, and the reduced stream goes to the SIEM.
Does deep archive satisfy PCI DSS 10.5.1?
For the older nine months, yes, and at deep-archive rates a year of retention costs about a cent per gigabyte. The most recent three months must be immediately available, and Deep Archive restores take up to 12 hours. Keep those three months in a tier you can query right away.
Does an AI model choose what gets dropped?
No. Every keep, summarize and drop rule is written in plain terms your team can read and change.
Is the pipeline free?
No. A pipeline is also a cost, so put it in the same math as the savings.
Do you need access to our systems to estimate savings?
No.
Start with one source
Pick your noisiest source, enter its daily volume in the Fleak cost calculator, and see what record- and field-level reduction would do to it. If you'd rather go through your sources with us, book thirty minutes. No system access is required.
Sources
- Dynatrace, The State of Log Management 2026: 450 leaders at $750M+ enterprises, surveyed by Coleman Parkes, vendor-commissioned. Figures cited: 93% volume growth, 45% of budget, $2.5M average, 86% excluded.
- Datadog pricing page, annual billing: $0.10/GB ingest, $1.70 per million events.
- AWS S3 Glacier Deep Archive list price, us-east-1, excluding retrieval. AWS documentation on retrieval times (standard retrieval within 12 hours).
- PCI DSS v4.0 requirement 10.5.1.