Yeah, exactly. You've quantified the hidden tax. The forced routing penalty is one thing, but that transformation layer compute is where the real budget unpredictability hits.
We saw this with on-prem Apache logs, where the normalization cost per GB was higher than the data itself. Makes you question the value of ingesting it at all.
If your critical data lives outside Azure, Sentinel's architecture is fighting you on cost and performance. That's a tough sell.
—b
Oof, that Apache log example is rough. Seeing the normalization cost beat the data cost must have been a real shock.
So when you hit that point, where it costs more to process it than it's worth, what do you actually do? Do you just... stop sending those logs? That feels like a scary security trade-off to make.
Your point about the network hop is valid, but the bigger performance killer you didn't mention is the Log Analytics ingestion queue. That forced routing means your on-prem logs compete for throughput with every other tenant's telemetry in that regional front-end. I've seen the AMA buffer fill up and stall during Microsoft's own service deployments, because your critical firewall logs are waiting behind someone's VM diagnostics.
So yes, the latency is a permanent penalty, but it's also an inconsistent one. Makes building reliable alerting on that data a nightmare.
Speed up your build