What is the single biggest lever to cut an observability bill?

Log volume. Logs are billed per GB (and often per indexed event), and apps emit far more log data than metrics or traces. Tiering low-value logs into cheaper pipelines (Coralogix TCO Optimizer to $0.17/GB, Sumo Logic Flex) or dropping debug logs in production typically saves the most.

Does switching from per-host to usage-based pricing save money?

It depends on how you scale. Per-host pricing (Datadog, Splunk) is cheaper for a stable fleet of large hosts but expensive for dense Kubernetes or ephemeral hosts. Usage/per-GB pricing (Grafana, Elastic, Coralogix) is cheaper for high host density but can be expensive for verbose telemetry. Match the model to your workload.

How much does retention affect cost?

A lot. Indexing and retention are separate from ingest on most platforms (Datadog $1.27/M events at 15 days, Grafana and Elastic charge per retention block). Cutting hot retention on rarely-queried data and archiving to cheap cold storage is a fast win.

How to cut observability and log costs (2026)

Observability is often the second- or third-largest line in a cloud bill, and most of it is avoidable. Here are the levers that actually move the number, ordered by typical impact. Rates cited are a June-2026 snapshot from each vendor’s page.

1. Attack log volume first

Logs dominate observability bills because they are billed by data volume and applications emit a lot of them. Options:

Tactic	How it helps	Example
Tier low-value logs	Route cold logs to a cheap pipeline	Coralogix TCO Optimizer: $0.17/GB Compliance tier
Make ingest free, pay to query	Only pay when you search	Sumo Logic Flex: ingest free, credits for scan
Drop debug logs in prod	Cut volume at the source	Filter before ingest
Shorten hot retention	Indexing/retention is separate from ingest	Datadog indexing is $1.27/M events

See the full log management comparison and the cheapest log management ranking.

2. Control metric cardinality

On series-based platforms like Grafana Cloud ($6.50 per 1,000 active series), cost is driven by cardinality - the number of unique label combinations - not host count. A single high-cardinality label (user ID, request ID) can multiply your series. Drop or aggregate high-cardinality labels you do not alert on. Chronosphere’s Control Plane is built specifically to shape this.

3. Sample traces

Distributed tracing volume can explode. Honeycomb and Sentry bill per event/span; even bundled-APM tools have ingested-span overage. Head-based or tail-based sampling keeps the interesting traces (errors, slow requests) and drops the rest.

4. Right-size retention

Most platforms separate ingest from retention. Keep 7-15 days hot for active debugging and archive the rest cheaply. Longer retention blocks add up fast on Grafana, Elastic and Datadog indexing.

5. Match the billing model to how you scale

This is structural, not a knob. If you run a stable fleet of large hosts, per-host pricing (Datadog, Splunk) is predictable. If you run dense Kubernetes or autoscale aggressively, per-host punishes you - prefer usage/per-GB (Grafana, Elastic, Coralogix) or per-vCPU (AppDynamics). Compare Datadog vs Grafana Cloud to see the divide.

Bottom line

Tier logs, tame cardinality, sample traces, cut retention, and pick a model that matches your scaling shape. Estimate the impact in the cost calculator. Prices are a June-2026 snapshot; verify on each vendor’s pricing page.