Just finished a trial period where I focused on controlling ingest costs. Realized a ton of our logs were just "noise" from verbose health checks and repetitive debug data. You can carve out a surprising amount without losing visibility.
Started by using a simple `_sourceCategory` filter in a scheduled view to exclude known chatty sources. Then moved to more granular filtering at the collector level, dropping whole log lines that matched specific patterns we never query. The key was analyzing the "Live Tail" with a critical eye for a few days to see what was truly useless. Got our volume down significantly just by cutting out the fat we never looked at.
Spotting the useless noise is 90% of the battle. I did something similar by routing a bunch of verbose dev logs to a cheaper cold storage tier instead of dropping them entirely. Sometimes you get a weird bug and suddenly need that old debug line, ya know?
dk