Telemetry Cost Control

Observability spend grows with traffic, with service count, with retention and with instrumentation enthusiasm, and it is rarely anyone's budget line until it becomes conspicuous. Estates where monitoring costs a substantial fraction of the compute bill are common, and the usual response — turning things off during a cost review — removes exactly the visibility needed the next time something breaks.

The levers, from least to most painful. Retention tiering: most logs are queried within days almost never afterwards, so a short hot window with cheap cold archive covers the operational need and the compliance one at very different unit costs. Cardinality discipline on metrics, since a handful of runaway labels can dominate the bill. Tail-based sampling for traces, keeping errors and slow requests rather than a random slice. Log level discipline, because debug logging left on in production is one of the most common single causes of a cost spike. And dropping what is never queried — most platforms can report which log sources have never been searched, which is usually a revealing list.

The framing that gets it funded properly rather than cut: express the value as time to detect and time to restore, and the cost per service. That makes the trade-off a decision about incident duration rather than an argument about a tooling invoice, which is the conversation that should be happening.