Optimizing Ingestion

If you want to get the most out of your LogScale SaaS license, you can remove data that you're confident you will not need, so it doesn't count towards your license usage. In this example we are filtering the data using the Removing Fields functionality in Parser settings.

Usage Page

Figure 2. Usage Page

This will remove fields with the name kubernetes.image from the incoming events. The usage calculation will then disregard these fields, as you can see in the following example:

Table: Fields

Events Before Fields Removed Formula for Calculations Resulting Calculations

2025-10-17T12:24:51.823Z Food message

and not fields" "host""someHost"

"kubernetes.image" "2323-adssadf-4f4f4"

Event length total - removed field length

"2025-10-17T12:24:51.823Z Food message

and not fieldshostsomeHost".length (64)

+ "kubernetes.image2323-adssadf-4f4f4".length (34)

minus the deleted fields:

"kubernetes.image2323-adssadf-4f4f4".length (34)

Total 64 (plus LogScale's timestamp 14 bytes)


If you use the dropEvent() function during parsing to optimize usage, the amount of data saved in LogScale will be reduced.

However, the original data before being dropped will be included in the calculation for your license, and therefore dropping events will not affect your license usage according to the ingestAfterFieldRemoval metric.

Unless your order form specifies that your volume is calculated as "raw (uncompressed) data ingested by the product" (segment_save metric), we recommend that you switch to either dropping events at source or using the Removing Fields functionality.