Optimize Ingestion

To get the most out of your LogScale SaaS license, you can remove data that you're confident you will not need, so it doesn't count towards your license usage. This example filters the data using the Removing Fields functionality in Parser settings.

Important

This can be used to filter information from ingested structured data. The remove fields feature cannot be used to modify the @rawstring, or fields created when parsing the @rawstring. For more information, see Removing Fields.

Screenshot of the LogScale Parser settings interface showing the 'Fields to remove' configuration, with an example of removing the 'kubernetes.image' field from incoming events. This interface demonstrates how administrators can optimize license usage by excluding specific structured data fields from usage calculations, reducing costs without losing essential log information.

Figure 16. Usage Page


The remove fields feature with the name kubernetes.image from the incoming events. The usage calculation will then disregard these fields in the calculation.

Important

If you use the dropEvent() function during parsing to optimize usage, the amount of data saved in LogScale will be reduced.

However, the original data before being dropped will be included in the calculation for your license, and therefore dropping events will not affect your license usage according to the ingestAfterFieldRemoval metric.

Unless your order form specifies that your volume is calculated as "raw (uncompressed) data ingested by the product" (segment_save metric), we recommend that you switch to either dropping events at source or using the Removing Fields functionality.