Tags are the organizing principle behind data sources. Every unique combination of tag values creates its own data source. This means your tagging strategy directly shapes your storage structure. Tags are not just metadata — they are the foundation of how your data is physically organized and how efficiently it can be retrieved.

The organizing power of data sources depends on balance. Too few tags and your buckets are too broad to be useful. Too many unique tag values and the system fractures into an unmanageable sprawl.

This balance hinges on cardinality. If you tag on a field with a high number of unique values — such as a user ID or session ID — LogScale creates a separate data source for every single value. Instead of a small number of well-populated buckets that queries can efficiently navigate, you end up with thousands or millions of nearly empty ones.

At that point, the organizational system works against you. More data sources means more overhead, more memory pressure, and ultimately slower queries — the opposite of what tags are meant to achieve.

Data sources are largely invisible during normal operation — they are an internal mechanism, not something you interact with directly. However, they are the reason why decisions made early in your implementation, such as parser design and tag selection, have a lasting impact on how well LogScale performs at scale.

Configure your tagging strategy before ingesting data. Changing your tagging strategy after data ingestion requires reingesting data.