Log Retention Tiering
Storing log data at different resolutions, costs and access latencies according to how old it is and how likely it is to be queried.
Almost all log queries look at the last few days. Almost all log cost is driven by everything older, retained at full fidelity in a hot searchable store because nobody decided otherwise.
A workable tiering: hot for 7–14 days — fully indexed, fast queries, expensive; this is where incident response happens. Warm for 30–90 days — searchable with higher latency, cheaper storage. Cold archive for months or years — object storage, queryable only by loading it back, priced for compliance rather than convenience.
The decisions that set the boundaries are not technical: regulatory retention requirements (which often apply to audit logs specifically, not to all logs — a distinction worth establishing, because applying the strictest requirement to everything is a common and expensive default), security investigation windows, and how far back debugging realistically reaches.
Complementary reductions: sample high-volume successful-request logs while retaining errors and warnings in full, which typically removes most of the volume without losing diagnostic content; and drop verbose framework logs nobody has ever queried.
The governance that prevents regrowth is per-team cost visibility. Teams that cannot see their logging spend have no reason to manage it.