FAQ
Datadog cost and log filtering questions, answered
Direct answers for teams evaluating pre-ingestion filtering, archival, sampling, deduplication, log-to-metric conversion, and routing strategies.
Core feature scope
LogTrim focuses on six controls that reduce Datadog ingest cost while preserving signal.
Filter before Datadog
Drop low-value events upstream so they never become billable Datadog ingestion volume.
Route archives to S3
Send raw logs to cheaper long-term storage while forwarding only high-signal data to Datadog.
Convert logs into metrics
Turn high-volume success patterns into request counts, rates, and latency metrics instead of raw indexed logs.
Sample normal traffic
Keep representative logs for noisy success traffic while preserving complete errors, warnings, and anomalies.
Deduplicate repeated logs
Collapse repeated events into one representative log with a count, first-seen time, and last-seen time.
Trim verbose payloads
Remove unused fields and oversized attributes before forwarding logs to expensive indexed storage.
Why is Datadog so expensive?
Datadog log billing is mostly ingestion-driven. If you forward every event, low-value traffic like repetitive 200 responses increases costs quickly.
Can I drop logs before Datadog?
Yes. LogTrim applies filtering rules before ingestion so you only send high-signal logs to Datadog.
What logs are safe to drop?
Most teams safely drop repetitive success logs, health checks, and known noise once they confirm those events are not used in alerts or incident workflows.
How much can I save?
Savings depend on your noise ratio. Teams that remove low-signal traffic commonly reduce Datadog ingestion spend by 30-60%. LogTrim has even seen teams reduce their Datadog bill by more than 70%.
Is log filtering safe?
Filtering is safe when rules are explicit, tested, and paired with low-cost archival. LogTrim supports dual routing so full logs can still be retained in S3.
Can I convert logs into metrics before Datadog?
Yes. LogTrim can derive metric signals from log streams so you keep high-value trends without indexing every raw event.
Does LogTrim support sampling and deduplication?
Yes. You can sample repetitive traffic intentionally and suppress duplicate events before they become Datadog ingest cost.
Need implementation details?
Read practical guides for filtering, sampling, and routing before Datadog ingestion.