The Logging Bill Teardown · Elastic and OpenSearch
Cut the logging bill. Don’t gamble on security coverage.
Your Elastic or OpenSearch bill keeps growing, but “keep paying” and “delete more logs” aren’t your only choices. In four weeks we find what is actually driving the cost and hand you a ranked plan to lower the monthly run rate, without blindly cutting retention, detections or investigative access.
Stop paying for what you don’t.
- Ranked by monthly cost impact
- Security impact shown for every change
- Read-only: nothing on the cluster changes
- If a change isn’t worth it, we say so
01 / The right moment
Before your Elastic service renewal, find out what’s actually making it expensive.
- 01Your Elastic renewal is coming up
- 02The bill went up again this quarter
- 03Someone proposed cutting retention
- 04You are buying more cloud credits
- 05New customers or log sources are onboarding
- 06Managed-SOC margins are under review
A budget problem with security constraints
Cutting retention is the easiest lever to pull, and often the wrong one.
The cost usually comes from somewhere else: data nobody reads, a hot tier sized for weeks when analysts search days, replicas and mappings that multiply every byte, or a licence that no longer fits. Find it first, then decide.
Start before the renewal is signed, so the plan is ready for the negotiation.
Talk about your bill02 / Where the cost comes from
Retention is a requirement. Most of the bill is a choice.
The teardown connects your spend to the workloads and operating decisions behind it, so you can see which costs are required and which are habits.
- IngestWhat arrives, from which sources, and how much of it anyone ever reads.
- IndexingMappings, fields and replicas that multiply every byte you store.
- ComputeNode sizes and counts, and the searches and rules that keep them busy.
- StorageWhat sits on fast, expensive disk and what could live on object storage.
- Data lifecycleHow long data stays in each tier, and whether that matches how it is searched.
- LicensingWhat your licence or subscription unlocks, and whether a different one pays for itself.
The same 365 days, laid out two ways
Illustrative A typical security curve, where most analyst searches read data under three days old. The teardown replaces it with your measured curve. The axis is linear, so each hot window is drawn at its true share of the year.
What hot is for
Fast search on the data people actually open, plus ingest. Its size is the window you choose × daily ingest × replicas.
What frozen is for
Everything older, still searchable from the same Kibana. One copy sits in object storage, with a local cache of what was searched recently. A cache miss costs seconds, not a restore.
What sets the window
How far back analysts actually search. Not detection rules, which read minutes, and not the retention policy. The floor is the time to roll over and merge, about one to two days.
03 / How we measure it
Evidence from your cluster, not a sizing calculator.
The hot-tier measurement shows how we work: capture real searches with their time ranges and measure how far back each one reaches. Nothing on the cluster changes: your operator switches logging on, and the sampler only reads. Today this runs on Elasticsearch.
- 01
Capture
- Query log (newer 9.x)
- Slow log at 0 ms (7.x, 8.x)
- Live tasks, no change
- 02
Extract time range
- DSL ranges and date math
- ISO dates and epoch
- ES|QL NOW() − n units
- 03
Classify the source
- Kibana app or analyst
- Detection rule (API key)
- Direct API client
- 04
Verdict
- Lookback curve
- Hot window and layout
- Cost for your licence
Cross-checked against exact per-index search counts by age and tier, so even searches too fast to sample are counted. Kibana rule definitions explain the scheduled load.
On Elastic, your licence decides the route.
Searchable snapshots, which make cold and frozen possible, need an Enterprise licence. On other licences you still get a shorter hot window; the history goes somewhere cheaper but less convenient. We price both routes and the upgrade between them.
-
Enterprise · Hosted, self-managed, ECE, ECK
Hot-frozen
- Hot sized to the analyst lookback, often 3–7 days
- Frozen for the rest of retention, searchable from Kibana
- A cold band only where searches justify it
- LogsDB with synthetic _source, up to 65% smaller
- Searches past the hot window pay cache-miss latency
-
Platinum · Gold
Hot-warm plus archive
- The same short hot window
- Warm on dense, force-merged storage nodes
- History past the 99th-percentile lookback kept as snapshots
- Tested: does an Enterprise upgrade pay for itself?
- Archived data is not searchable until restored
-
Basic · Standard
Hot-warm plus archive
- Data tiers, lifecycle policies and snapshots all available
- The same layout as Platinum
- Detection rules still run
- No support contract for restores, so the archive runbook matters more
Also checked: the risks a smaller hot tier has less room for.
Captured queries are tested against the shapes in Elastic’s own heap-pressure test suite.
Wildcard and regexp queries
Each clause holds a compiled automaton for the whole request.
Huge terms filters in msearch
Copied into every queued shard request; seen in production at about 62,000 IDs.
top_hits under large terms aggregations
About 5 KB per bucket that the circuit breakers do not count.
04 / What you get
A ranked plan, with the cost and the consequences.
Every candidate change gets one of three verdicts, with its estimated monthly impact and what it means for security. Take it to finance, security and your vendor with the evidence attached.
Make the change
The saving is real and coverage holds.
You get the estimated monthly impact and exactly what changes for detections, investigations and retention.
Leave it
The saving is too small to be worth it.
You stop debating it, and put the effort where the money is.
Protect it
Cutting here would cost you coverage.
You see what an investigation or detection would lose, so nobody cuts it to hit a budget line.
What you get
$20,000 · four weeks · agreed workloads
- 01
Where the money goes
Your spend connected to the workloads and decisions behind it: ingest, indexing, compute, storage, lifecycle and licensing.
- 02
A ranked plan of changes
Each change worth making, ordered by its estimated monthly cost impact.
- 03
The security impact of each change
What it means for detections, investigations and retention, before anyone approves it.
- 04
Your hot-window number
How much data actually needs to stay on your fastest tier, measured from real searches.
- 05
The workloads that cost you most
The sources, indices and searches driving the bill, and what to change so they stop.
- 06
A validation plan
What to change, the risks to watch, and a second measurement that proves the saving.
- Step 1
Baseline
Spend, cluster stats and real searches, sampled across a week.
- Step 2
Rank
Every candidate change, ranked by monthly cost impact and security impact.
- Step 3
Change
You choose what to do. Implementation is scoped separately.
- Step 4
Verify
The same measurement again shows what the change actually saved.
If the numbers don’t justify a change, we’ll tell you that too. No forced downsizing, and no production migration included.
Request a teardownDouglas Miller
Elastic expert and founder of SmartSearch AI
05 / Who does the work
Lower spend, not lower coverage.
The recommendation starts from your detection, investigation and retention requirements, not from a target number. Weblink Technologies has built and tuned Elasticsearch and OpenSearch for enterprise and security teams for more than 13 years, across 75+ engagements, as an Elastic partner.
06 / Start here
Find out what’s driving your logging bill.
Start with fit, timing and scope. Not a migration, and not a guess.
- 01Tell us about your platform and timing.
- 02We agree the workloads and access.
- 03The four-week engagement begins.
Renewal close? We check the real cutoff and access first. Completion before a near-term deadline is not guaranteed.
Good to know
Clear scope. No surprises.
What does it cost?
$20,000 for the four-week teardown, covering the workloads we agree on before it starts. Submitting the form does not commit you to anything.
Will you tell us to cut retention?
Only if the numbers and your requirements support it. The plan shows what each change means for detections, investigations and retention. If a change is not worth it, we say so.
Do you guarantee a saving?
No. You get estimated monthly impact for each change and the evidence behind it. Sometimes the right answer is to keep what you have, or to spend more in one place.
Do you work with OpenSearch?
Yes. The teardown covers Elastic and OpenSearch. The automated hot-tier measurement shown on this page runs on Elasticsearch today; for OpenSearch we agree how that part is measured before the engagement starts.
Do we have to change or move anything during the teardown?
No. The measurement is read-only and no production migration is included. You leave with a plan before anything moves; implementation is scoped separately.
What happens after I submit the form?
Your request is stored privately and sent to Douglas Miller. He reviews your timing and replies to discuss fit and scope. Nothing is booked and no work starts on submission.