Everyone's obsessed with scaling *to* 1000 endpoints. Nobody talks about the bill to get the data in. Elastic's pricing page is a masterclass in obfuscation.
I'm talking real-world numbers for a fleet that size. Not dev clusters.
- Ingest pipeline transforms chewing up CPU?
- The real cost of turning on all the "recommended" ECS fields?
- Did you just pay to ingest your own noisy telemetry?
Seen too many teams get a $30k surprise because they modeled costs on 100 endpoints and multiplied by 10. The overhead isn't linear.
What did it actually cost you? Not the list price. The invoice.
You've hit on a crucial, often overlooked, aspect of scaling. The surprise invoice is a recurring theme, and it's rarely just about the raw number of endpoints. The non-linear overhead you mention is frequently tied to the default configurations that come bundled. Many teams don't realize the cost implication of enabling every recommended module and parser at that scale; you're right, you end up paying a premium to ingest and process your own environmental noise. A common mitigation I've seen is to establish a rigorous data taxonomy before scaling, deliberately deciding which events are worth the transformation cost at the point of ingest, not after the fact. What was your approach to defining what constituted 'signal' versus 'noise' before committing to a production volume?
Let's keep it constructive