Log ingestion reduction

Observability — Log Analytics, Application Insights, CloudWatch Logs — is routinely a top cloud cost line, and most of it is ingestion you don’t need: a broken component flooding a table, verbose traces logged at debug level in production, retention set far longer than anyone queries, or a workspace that still bills while nothing writes to it.

What we look for

• Ingestion offenders — a single role/source dominating a table (an exception storm, verbose traces), where the fix is upstream in the app.
• Cheaper plans — tables eligible for a Basic/low-cost logs tier, or a missing daily cap that lets ingestion run away.
• Retention & dead workspaces — logs retained longer than they are queried, or a workspace that bills for retention while ingesting nothing.

Each candidate names the specific offender and the one lever that addresses it, rather than a blanket “log less”.

How to act

The fixes range from a reversible table-plan flip or daily cap (you run the command) to an app-side change (raise the log level, fix the retry loop) that leancosts never touches directly. Each candidate carries the exact lever, how to confirm the ingestion drop, and the rollback. Follow Act on a cost finding.