Cost control

What you pay for in Logthread follows three things: how much data you send, how long you keep it, and how much your queries scan. This page lists the limits of each plan, what happens when you reach them, and the levers you have to spend less without losing what matters.

The numbers below are the plan limits in force. The Compare plans view on Administration → Usage always shows the current figures for your workspace, so check it before you plan around a limit. How a plan change is requested is in Team, usage and billing.

Plan limits#

Sizes are decimal: 1 GB is 1,000,000,000 bytes. Longer retention than your plan is available as an add-on on paid plans (180 or 365 days), described in Team, usage and billing.

What each limit does#

• Ingest rate and burst. Each workspace has a bytes-per-second rate with a burst allowance. A request over it gets 429 with a Retry-After header. Collectors and the SDKs retry, so a short spike is smoothed out rather than lost.
• Daily cap. Once the day's volume is used, new data is refused with 429 and daily_quota_exceeded until 00:00 UTC. The cap counts the uncompressed size of what arrives, for logs, traces and metrics together. Warnings appear at 80% and 100%, in the app and as one email to the workspace owners for each level.
• Retention. Data older than your retention is deleted. Owners set it under Settings → Data, up to what the plan allows. Shortening deletes older data at once.
• Query scans. Every search, chart and alert reads data, and the amount read is metered. Narrow time ranges, add a service: filter before a | json, and select fewer columns to read less.

Find what costs the most#

Open Administration → Usage.

1. The Ingested chart splits the month into logs, traces and metrics by day.
2. By service shows which service.name sent the most data, measured as it arrived (the bytes you are billed for), with its share. It lists the top 50 services and folds the rest into "Other services".
3. Scanned by queries and Queries show what your searches, dashboards and alerts read. In the SQL console, Slow queries lists the heaviest statements: see SQL console.

For a service on that list, Open in Explore shows what it is logging, and Drop or sample with a pipeline opens the pipeline library with a route for that service.

Send less, store less#

Pipelines run after Logthread has accepted the data, so a dropped record still counts toward the daily cap and the Ingested meter, and no longer toward what is stored and scanned. To stay under the cap or the ingest meter, send less at the source.

Drop and sample only what you are sure you do not need: a record that is dropped cannot be searched later. Use the Sample and preview of a pipeline on your own records first, and keep errors out of any sample.

Know before you hit a limit#

• Usage warnings. At 80% and 100% of the daily cap or of the included monthly amount, the Usage page warns you and the owners get an email, once per level and period.
• Month-end projection. The Usage page estimates your total for the month, marked Estimate.
• A service that went quiet. An absence alert opens an incident when a service or host stops sending, which also catches a daily cap that refuses its data. See Alerts.
• A source that suddenly grew. A scheduled-search alert on a noisy pattern, or the By service card, shows it. Create the alert from Explore with Create alert.
• Rejected records. The Rejected records line on Usage counts records storage refused. It should stay at zero. When storage reports why, Rejected by storage lists them by reason: Older than your retention (send newer data, or raise retention), Not valid, Too large (send smaller batches) and Not stored.

Next: add people and sign-in for the team that will use it.