Hello everyone. I've been working with a client over the last quarter to conduct a true-up on their Sumo Logic usage, and the breakdown in the thread title is the empirical result from their environment. It’s a fairly common pattern I see, but the magnitude of the log portion often comes as a shock during renewal conversations. I wanted to share our analysis framework and some immediate tactical observations.
We used a three-layer approach to dissect this:
* **Data Ingest Analysis:** Categorized by source (application, infra, security appliances) and log type (plain text, structured JSON).
* **Feature Utilization Audit:** Mapped ingest to actual product modules (Log Analytics, Metrics, Security).
* **Cost Attribution:** Assigned costs based on ingest volume, retention tiers, and any premium features (like CSE).
The 60% log spend was the primary driver. The root causes we identified were:
* Unchanged default verbosity levels from initial implementation, leading to immense volumes of debug/info logs in production.
* A significant portion of JSON logs contained large nested arrays sent as single fields, drastically increasing parsed field count.
* Several "set-and-forget" cloud service integrations that were forwarding operational logs not utilized by any active queries or dashboards.
The 30% metrics spend was relatively efficient, but we noted that custom metric volume from application instrumentation had crept up by about 40% year-over-year without clear stakeholder justification.
The 10% security allocation was primarily for Cloud SIEM (CSE). While this was considered "non-negotiable" by the security team, our review found that nearly a third of the ingested security data was not correlated by any active rule or query, suggesting an opportunity to refine collection scope.
From a procurement and vendor management standpoint, this breakdown led us to a few concrete actions in our negotiation playbook:
* **Logs:** Renegotiated committed use discounts based on the new, refined log volume targets after a 90-day optimization period. We focused the commitment on the "hot" tier.
* **Metrics:** Pushed for a bundled rate that included a higher volume of custom metrics, as this is projected to grow.
* **Security:** Maintained the premium feature but worked with Sumo's sales engineering to validate the exact data sources required for their critical use cases, aiming to trim the uncorrelated ingest.
The key takeaway is that without this kind of granular breakdown, you're negotiating in the dark. You need to separate the spend drivers to understand where your leverage is and where you have internal optimization work to do before entering a renewal. Has anyone else done a similar feature-level cost allocation, and did your breakdown align with your expectations?
null