Reduce Elastic ingest cost
On Elastic, the meter that surprises people is not ingest. Search capacity scales with how much data is searchable and does not fall to zero when nobody is querying, so data you keep open costs compute every hour it stays there. Decide what to index, and for how long, at the OpenTelemetry Collector. Self-hosted, priced per collector.
25 Collectors free after a no-card registration · 5 without one How the free tier works
Elastic’s value is real. The catch is that what you pay for is mostly capacity, not records: indexing compute while data arrives, storage while it sits, and search capacity that scales with the size of what remains searchable.
Indexing is only the entry fee. A document that lands also occupies storage, and enlarges the searchable set that search capacity is sized against — so the cost of keeping it is paid continuously rather than once.
Readiness probes, polling chatter, retry storms, and duplicated fields make up a large share of most log pipelines — ingested, retained, and rarely read.
A backend’s own agent ships what it’s pointed at. Meaningful reduction means transforming telemetry upstream at the collector, not at Elastic.
Sensitive fields slip into logs and get indexed in Elastic, where they’re retained and queryable long after they should have been dropped.
Security-relevant logs and low-value debug output go to the same expensive index, because there’s no layer deciding what belongs where.
Nobody drops data in production without a way to see exactly what a filter removes first. So the volume — and the bill — keeps growing.
Most reduction projects that end with an unchanged invoice picked the wrong line. Elastic meters several things separately, and only some of them respond to sending less.
Compute consumed while documents are indexed, scaling with the rate and amount arriving. On Serverless this is billed as Ingest VCUs and falls to zero when nothing is arriving; on a provisioned deployment it is part of what the cluster is sized for.
What moves it: Filter and aggregate before the exporter. This is the meter that behaves the way most people expect telemetry cost to behave.
Search capacity is sized against how much data is searchable, the search load, and the latency you require. Elastic documents that, unlike ingest, it does NOT scale to zero during idle periods. Data you keep searchable therefore costs compute whether or not anybody queries it.
What moves it: The lever here is what stays searchable, not what arrives. Data that is never indexed never enlarges the set this capacity is sized against — which is why edge-side filtering pays back continuously on Elastic rather than once.
Retained data is charged per GB held. Index design decides how far a gigabyte of raw telemetry expands or compresses on the way in, so the billed figure is rarely the figure you sent.
What moves it: Volume and retention both. Dropping fields nobody queries shrinks the stored document as well as the payload — a reduction that a raw-volume estimate will understate.
Mechanics as Elastic documents them, not as we would like them to be — check them against your own contract, which may differ. Elasticsearch billing dimensions Telemetry reaches Elastic through the collector's elasticsearch exporter, so every change below happens before that exporter runs.
The reduction happens in the collector’s processor chain, before the elasticsearch exporter runs: drop what will never be searched, aggregate what only needs counting, and strip fields that add index size without adding answers. LinkMesh authors those processors once and rolls them out to a group of collectors; your telemetry never passes through LinkMesh.
This calculator models volume, which maps cleanly onto ingest and storage. It does not model search capacity, which on Elastic is sized against how much data stays searchable — so on this backend, treat the result as part of the picture. Every figure is an estimate for planning; LinkMesh does not set or represent Elastic pricing.
Estimated annual impact
Estimates only, for planning. Actual savings depend on your data, contract, and how aggressively you filter. LinkMesh does not set or represent Elastic pricing.
01
Problem
Health checks, readiness probes, and polling noise are ingested and indexed at full price, then almost never queried.
LinkMesh
Write filter rules that read plainly — drop where service.name = "health-check" — and apply them at the Collector, before anything reaches Elastic. LinkMesh renders the rule to OTTL and pushes it across the fleet.
The noise never reaches a billed index. Same signals, a fraction of the volume.
How-to: drop noisy logs →
02
Problem
Debug output and high-cardinality, high-volume events multiply your ingest without a matching increase in value.
LinkMesh
Keep debug locally or route it to cheap storage; statistically sample repetitive events; trim duplicated and unused attributes that inflate every record. All at the source, as managed processors on the collector.
Send Elastic the events worth indexing — not every retry and every field.
How processors transform telemetry →
03
Problem
When one pipeline sends everything to Elastic, low-value telemetry pays the same premium as your security-critical logs.
LinkMesh
Define routes by label, source, or environment: send security-relevant logs to Elastic and fan the rest to object storage, a cheaper backend, or an OTLP destination — from the same collector, with a different processing chain per route.
Elastic keeps the data that belongs there; everything else stops paying Elastic prices.
How routes fan telemetry to backends →
04
Problem
Credit cards, emails, tokens, and IDs slip into logs and get indexed in Elastic, where they’re retained and queryable by people who shouldn’t see them.
LinkMesh
Apply masking processors on the host, before telemetry leaves your network. Built-in templates for common patterns plus custom OTTL rules for your fields — so sensitive values never reach the index.
Sensitive data is gone before egress — not something to scrub from Elastic later.
How-to: mask PII before egress →05
Problem
Nobody drops data in production on faith. Without a way to see what a rule removes, the safe choice is to ingest everything — and keep paying.
LinkMesh
LinkMesh previews each processor against real captured records: input on one side, the rule and generated OTTL in the middle, the output on the other. You see exactly what a filter keeps and drops before it reaches a single collector.
Cut with confidence, because you saw what the rule does before it ran.
How-to: filter records on a route →06
Problem
A cost project shouldn’t become a rip-and-replace migration — and coupling every collector directly to Elastic makes any future change a fleet-wide rewrite.
LinkMesh
LinkMesh sits in front of Elastic as a vendor-neutral collection and processing layer built on standard OpenTelemetry Collectors and Grafana Alloy. Elastic stays your backend; LinkMesh manages what reaches it — and the same layer can route elsewhere the day you want to.
Lower the bill now without locking yourself to any one backend later.
How-to: route to another backend →Reduce cost for another backend
The product
Left alone, none of this gets cheaper: the volume grows on its own, the data that already left cannot be recalled, and each agent added is one more to remove later.
By filtering, dropping, sampling, and routing telemetry at the OpenTelemetry Collector layer — before the data reaches Elastic. Elastic bills by volume, so removing low-value data at the source directly reduces what you pay to ingest, retain, and query.
No. LinkMesh sits in front of Elastic as a collection and processing layer. Elastic stays your backend; LinkMesh manages the collectors and controls what telemetry reaches it. The same layer can also route telemetry to other backends if you choose.
You decide what is dropped. Every filter is previewed against real records — input, rule, and output side by side — before it reaches a collector, so you see exactly what is kept and removed. You can route lower-value data to cheaper storage instead of dropping it.
No. LinkMesh is self-hosted and carries only configuration and health. Filtering runs in your own collectors, and your telemetry flows straight from them to Elastic or your other backends — it never transits LinkMesh.
Not answerable from the outside, and on Elastic it depends as much on retention and index design as on volume. What is knowable: a document never indexed costs no indexing compute, no storage, and never enlarges the searchable set that search capacity is sized against. Because that last meter does not idle, removing data at the edge keeps paying back for as long as the data would have been kept. LinkMesh does not set or represent Elastic pricing.
By managed collector, never by data volume. The first 25 collectors are free after a no-card registration in the OpenSight Customer Portal (5 without one); beyond that it is a flat USD 12.50 · CHF 12.00 · EUR 12.50 per collector per month, billed annually, and the bill stops growing at 200 collectors. Your savings scale with volume; your LinkMesh cost does not.
Self-hosted, vendor-neutral, priced per collector. Stand LinkMesh up, preview your filters against real records, and cut ingest with confidence. The first 25 Collectors are free after a no-card registration in the OpenSight Customer Portal (5 without one).
Install the control plane on any Linux VM — Ubuntu / Debian
curl -fsSL https://artifacts.saas.opensight.ch/binaries/linkmesh-server/latest/linkmesh-server_latest_amd64.deb -o linkmesh-server.deb && sudo apt install -y ./linkmesh-server.debRHEL / Rocky / AlmaLinux, collector enrollment, and the full walkthrough: Install guide →
Use these maintained guides to move from product evaluation to a working configuration.
Check versions and limitations first