A platform's observability spend has grown to a substantial fraction of its infrastructure budget with no single team responsible. What are the drivers, and how should this be controlled without losing visibility?

The drivers

1. Cardinality growth. New labels are added to metrics for good reasons and are never removed. Because cardinality is multiplicative, adding one label with fifty values multiplies the series count by fifty. This is usually the single largest driver, and it is invisible to the person adding the label.

2. Log volume from service proliferation. Each request now produces logs at forty places instead of one.

3. Retention set to the maximum "just in case", applied uniformly to data of vastly different value.

4. Debug logging added during incidents and never removed.

5. Traces sampled at a high rate because someone needed detail once, with the setting never revisited.

6. Duplicate telemetry — the same information emitted as a metric, a log line and a trace attribute.

Controlling it without losing visibility

1. Attribution first. Telemetry cost broken down by team and by service, visible in that team's own dashboard. Nothing reduces volume faster than a team seeing its own number, and no other control works without this one.

2. Cardinality budgets per service, with alerts on approaching them. This catches the label addition at the moment it is made rather than in next quarter's bill.

3. Tiered retention by data class. Errors and audit events retained long; debug telemetry retained days; downsampled metrics retained for capacity planning. Uniform retention is the easiest large saving available.

4. Move counting out of logs. Much log volume exists so someone can count occurrences — a metric is orders of magnitude cheaper and faster to query.

5. Aggregate at the edge, in the agent, before data crosses the network. The cheapest place to drop cardinality is the earliest.

6. Tail-based sampling, keeping all errors and slow requests plus a small baseline. This improves diagnostic value while reducing volume, which is unusual — most cost controls trade visibility away.

7. Quarterly review of the highest-volume sources, asking whether each was used in the last incident. Most were not.

The framing that makes the conversation productive

Cost per unit of insight, not absolute cost. The goal is not less telemetry; it is not paying for telemetry nobody reads. A useful discipline is to ask, for each of the top ten volume sources: when was this last queried, and by whom?

Sources with no queries in ninety days are candidates for deletion regardless of how reasonable they seemed when added — and that question is answerable, because observability platforms record their own query patterns.