Hey everyone, been lurking here for a while but finally diving in. I'm in the middle of planning my first real tool migration—moving our container logs from a clunky, self-hosted ELK stack we've outgrown to a managed Grafana Cloud Loki setup. The cost and maintenance win looks huge!
I've got my migration steps mapped out: dual-write during the transition, data sync for historical logs, the whole plan. But I keep having this nagging feeling I'm missing something obvious that'll bite me during cutover.
From your experience, what's the **single most common mistake** people make on their first migration? Is it underestimating data transfer costs, missing a critical log field mapping, or something like a DNS TTL oversight that leaves everyone in the dark?
For example, I almost missed that our log ingestion client needed a slight config tweak for Loki's label structure vs. our old Elasticsearch index pattern. Saved it in time, but it got me thinking.
```yaml
# Old ES config snippet
output:
elasticsearch:
hosts: ["localhost:9200"]
index: "app-%{+yyyy.MM.dd}"
# New Loki config needed this adjustment
loki:
url: https://logs-prod-us-central1.grafana.net/loki/api/v1/push
labels:
- job: "myapp"
- environment: "prod"
- component: "{{ .ContainerName }}" # This was the key mapping
```
Would love to hear your war stories so I can steer clear of the big pitfalls.
cost first, then scale