Every observability cost-reduction conversation eventually arrives at the same fork in the road: to lower your logging bill, you are told to drop telemetry. Sample the logs. Filter the traces. Aggregate the metrics into five-minute rollups. It works, right up until the incident where the one log line you dropped was the line you needed. This post makes the case that the trade-off between choosing what to drop and saving money is a false choice, and that lossless telemetry compression is the way out of it.
Why teams drop telemetry data in the first place
Observability platforms bill on ingested volume. When you pay per gigabyte to ingest logs, metrics, and traces, the fastest way to cut the invoice is to send less data. So teams reach for the usual levers:
- Log sampling: keep 1 in N events and discard the rest.
- Trace sampling: head-based or tail-based, dropping the majority of spans.
- Metric aggregation: pre-roll high-cardinality series into coarse summaries.
- Drop filters: pattern-match “noisy” log lines and delete them at the edge.
Each of these lowers ingestion volume, and therefore cost. Each of these also permanently destroys data. The debate framed as “sampling vs. keeping everything” is really a debate about which future questions you are willing to make unanswerable.
The hidden cost of dropping logs and traces
Dropped telemetry is a bet that you have already imagined every question you will ever ask. Incident response, security investigation, and compliance audits are precisely the moments when that bet fails:
- Incident forensics: root-cause analysis needs the exact sequence of events, not a statistical sample of them. Tail-based sampling that “keeps the errors” still loses the healthy-looking precursor logs that explain how the error happened.
- Security detection: attackers live in the low-frequency long tail. A 1-in-100 sample is a 99% chance of missing the single anomalous authentication or the one exfiltration request.
- Compliance and audit: regulated industries need complete, tamper-evident audit trails. “We sampled the audit log” is not an answer an auditor accepts.
Sampling optimizes for the questions you already know how to ask. Incidents are defined by the questions you did not.
Lossless compression breaks the drop-vs-cost trade-off
The reason the trade-off feels unavoidable is that most tools couple volume to cost. Break that coupling and the whole dilemma disappears. That is the premise behind Sasquatch Labs: reduce the cost of observability and SIEM with patent-pending lossless compression, so you keep every byte and still pay dramatically less.
Lossless means exactly what it says. Nothing is sampled, nothing is dropped, nothing is summarized away. The raw events are compressed at the edge, often by an order of magnitude or more for logs, metrics, and traces (and higher still for security data), then stored in compressed form. Because the data stays complete, you can still run full-fidelity queries against it later. Our query engine, Snowman, reads the compressed chunks directly and speaks LogQL, SPL, TraceQL, and PromQL natively, so there is no re-ingestion step and no separate search-compute bill.
What changes when you stop dropping data
- Every incident is fully replayable. You investigate against complete telemetry, not a lossy summary of it.
- Detections improve. Security analytics run on the full event stream, so the long-tail anomaly is still there to find.
- Retention gets cheaper, not shorter. Compression lowers the cost per byte, so long compliance retention windows stop being a budget line you dread.
- Cardinality stops being the enemy. You keep high-cardinality dimensions instead of aggregating them away to save money.
Stop choosing what to lose
The next time an observability vendor tells you the path to lower cost runs through sampling and drop filters, remember what you are actually being sold: a smaller bill in exchange for permanent blind spots. Lossless observability cost reduction is a different model. Keep everything, compress it, query it in place, and pay for storage instead of paying to throw your own data away.
Related reading: the math of observability cost reduction and the hidden cost of observability data egress. To see how it fits your stack, visit sasquatchlabs.io.