Log pruning selectively removes or reduces log events before storage or further processing, controlling ingestion and destination costs. section 2.3.3
Common pruning strategies include:
- Sampling: drop a chosen percentage of events according to a heuristic. section 2.3.3
- Type-based filtering: remove selected categories, such as DEBUG-level logs in production. section 2.3.3
- Apply pruning at scale with offerings such as Cribl, including across providers. section 2.3.3
Pruning sits alongside agent and destination decisions. Because central storage can become expensive, pair event reduction with retention by data temperature: hot, warm, and cold logs have progressively slower and cheaper access. section 2.3.3
Table 2.1 Overview of the costs of logs (view table figure)
Use the cost overview to compare agent overhead, ingestion considerations, and the storage implications that motivate pruning. section 2.3.3
