Breaking down our actual spend: 60% logs,电视 30% metrics, 10% security

Consultant Carl · 2026-08-07T09:31:16Z

Hello everyone. I've been working with a client over the last quarter to conduct a true-up on their Sumo Logic usage, and the breakdown in the thread title is the empirical result from their environment. It’s a fairly common pattern I see, but the magnitude of the log portion often comes as a shock during renewal conversations. I wanted to share our analysis framework and some immediate tactical observations. We used a three-layer approach to dissect this: * **Data Ingest Analysis:** Categorized by source (application, infra, security appliances) and log type (plain text, structured JSON). * **Feature Utilization Audit:** Mapped ingest to actual product modules (Log Analytics, Metrics, Security). * **Cost Attribution:** Assigned costs based on ingest volume, retention tiers, and any premium features (like CSE). The 60% log spend was the primary driver. The root causes we identified were: * Unchanged default verbosity levels from initial implementation, leading to immense volumes of debug/info logs in production. * A significant portion of JSON logs contained large nested arrays sent as single fields, drastically increasing parsed field count. * Several "set-and-forget" cloud service integrations that were forwarding operational logs not utilized by any active queries or dashboards. The 30% metrics spend was relatively efficient, but we noted that custom metric volume from application instrumentation had crept up by about 40% year-over-year without clear stakeholder justification. The 10% security allocation was primarily for Cloud SIEM (CSE). While this was considered "non-negotiable" by the security team, our review found that nearly a third of the ingested security data was not correlated by any active rule or query, suggesting an opportunity to refine collection scope. From a procurement and vendor management standpoint, this breakdown led us to a few concrete actions in our negotiation playbook: * **Logs:** Renegotiated committed use discounts based on the new, refined log volume targets after a 90-day optimization period. We focused the commitment on the "hot" tier. * **Metrics:** Pushed for a bundled rate that included a higher volume of custom metrics, as this is projected to grow. * **Security:** Maintained the premium feature but worked with Sumo's sales engineering to validate the exact data sources required for their critical use cases, aiming to trim the uncorrelated ingest. The key takeaway is that without this kind of granular breakdown, you're negotiating in the dark. You need to separate the spend drivers to understand where your leverage is and where you have internal optimization work to do before entering a renewal. Has anyone else done a similar feature-level cost allocation, and did your breakdown align with your expectations?

Page 2 / 2 Prev

Sumo Logic Reviews

Last Post by Elena B. 1 hour ago

16 Posts

16 Users

0 Reactions

3 Views

RSS

Elena B.

(@elenab)

Estimable Member

Joined: 3 weeks ago

Posts: 83

08/08/2026 7:19 am

Absolutely. The FinOps code tagging is the only thing that's ever moved the needle for us. You can present all the pretty Grafana dashboards you want, but until a team sees their project code on the bill, it's just "platform's problem."

That said, tagging is a political minefield before it's a technical one. Who defines the codes? What happens when a shared service logs something? We spent three months in committee hell because infra wanted to tag the k8s control plane logs to the *cluster* team, but the cluster team's budget was purely capex, while the logging bill was opex. The actual technical implementation was trivial compared to sorting out the chargeback governance.

Your CI/CD shape check is the logical next step, but it requires that political groundwork to be solid. Otherwise, developers just complain the platform team is blocking their deployments over "accounting."

show me the tco

ReplyQuote

Page 2 / 2 Prev

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed