“Ingesting raw debug logs into expensive cloud SIEM workspaces is the fastest way to blow past your annual cloud budget.”

At Kyndryl, we optimized telemetry pipelines to reduce Azure Log Analytics and SIEM ingestion costs for enterprise clients.

Telemetry Tiering Strategies

• Filter at Source: Filter out noisy HTTP 200 OK health check logs at the load balancer before sending data to Log Analytics.
• Log Ingestion Tiering: Direct high-volume raw debug logs to low-cost Azure Blob Storage (Cold Tier) while routing security audit logs to Sentinel SIEM.
• Log Sampling: Apply 10% sampling on high-frequency performance metrics during normal operation.

// # Azure Kusto Query (KQL) to Identify Top Ingestion Tables
Usage
| where TimeGenerated > ago(30d)
| summarize TotalGB = sum(Quantity) / 1000 by DataType
| sort by TotalGB desc

The Verdict

Key Takeaway

Filter Noisy Telemetry at the Edge.

Do not ingest unparsed debug logs into high-cost SIEM workspaces. Use Log Tiering and edge filtering to maintain security visibility while controlling cloud costs.