Sharing my cost-control setup: How we capped our monthly bill without losing data.

We started using Elastic Security a few months ago. Our data ingestion was growing fast, and the bill was becoming unpredictable. I was worried about costs, but didn't want to lose visibility.

I focused on two main things: setting up data retention policies and using transforms to aggregate older data. For retention, we tier our indices. Hot data (last 30 days) is fully indexed. Anything older than 30 days moves to a warm tier with fewer replicas. After 90 days, we roll it to cold storage and finally delete after a year. We also created a daily rollup for key security metrics beyond the 30-day window, which keeps our dashboards functional for historical trends without the raw data cost. This kept our monthly spend flat.