Cost Optimization Guide
Filter logs before Datadog ingestion
If log events are filtered only after they arrive in Datadog, you still pay for ingestion overhead.
Why this problem exists
Post-ingestion cleanup is simpler to adopt initially but less effective for cost control.
Teams often miss the difference between downstream enrichment and upstream suppression.
Real cost and impact
Pre-ingestion suppression reduces billable log volume immediately.
For high-throughput systems, moving one noisy class upstream can unlock substantial savings.
Solutions (including alternatives)
- Identify events with low incident value and suppress them before forwarding.
- Retain a searchable high-signal stream in Datadog and archive full streams in S3.
- Review dropped categories monthly to ensure policy still matches operations.
How LogTrim solves it
LogTrim runs before Datadog and applies deterministic rules for filtering and masking.
This enables lower ingestion without sacrificing audit retention.
Example scenario
A payments API filtered repetitive health traffic upstream and kept error, auth, and checkout traces in Datadog.
On-call coverage stayed intact while ingest dropped.