Optimizing Ingestion

If you want to get the most out of your LogScale SaaS license, you can remove data that you're confident you will not need, so it doesn't count towards your license usage. In this example we are filtering the data using the Removing Fields functionality in Parser settings.


Figure 2. Usage Page

This will remove fields with the name kubernetes.image from the incoming events. The usage calculation will then disregard these fields, as you can see in the following example:

Table: Fields

Events Before Fields Removed Formula for Calculations Resulting Calculations

2025-10-17T12:24:51.823Z Food message

and not fields" "host""someHost"

"kubernetes.image" "2323-adssadf-4f4f4"

Event length total - removed field length

"2025-10-17T12:24:51.823Z Food message

and not fieldshostsomeHost".length (64)

+ "kubernetes.image2323-adssadf-4f4f4".length (34)

minus the deleted fields:

"kubernetes.image2323-adssadf-4f4f4".length (34)

Total 64 (plus LogScale's timestamp 14 bytes)

Note that if you use the dropEvent() function during parsing to optimize usage, you will also decrease the amount of data saved to LogScale. However, as we now calculate your usage based on the volume of data before parsing, this will not affect your license usage according to the ingestAfterFieldRemoval metric.

Unless your order form specifies that your volume is calculated as "raw (uncompressed) data ingested by the product" (segment_save metric), we recommend that you switch to either dropping events at source or using the Removing Fields functionality.