Self-hosted ELK at 5TB/day
A self-hosted ELK stack ingesting more than 5TB of logs a day at roughly half the previous cost, on fixed spend instead of volume-based pricing.
Our observability spend was tied to DataDog's volume-based pricing while log volume climbed past 5TB a day.
Every new service made the bill worse, and dropping logs to save money would have gutted visibility.
I led the migration to a self-hosted ELK stack, designed and built in reproducible Terraform and Ansible so the cluster could scale to usage instead of being hand-grown.
The platform ingested over 5TB of logs per day at roughly half the previous cost, trading volume-based pricing for a fixed, predictable spend.
// provisioned by Terraform + Ansible — rebuildable from zero
// fixed cost replaced volume-based pricing
// select a component to see what it does
Producers — Every service, host and network device shipping structured logs — the volume that made per-GB vendor pricing untenable.
Ingest pipeline — Parses, enriches and routes each line before indexing, so retention and field mapping are controlled in one place.
Elasticsearch — Self-hosted storage and query. Owning the cluster is what turned a usage-priced bill into a fixed capacity decision.
Kibana — Dashboards and alerting for the teams that previously depended on the vendor UI.
- Producers
- Every service, host and network device shipping structured logs — the volume that made per-GB vendor pricing untenable.
- Ingest pipeline
- Parses, enriches and routes each line before indexing, so retention and field mapping are controlled in one place.
- Elasticsearch
- Self-hosted storage and query. Owning the cluster is what turned a usage-priced bill into a fixed capacity decision.
- Kibana
- Dashboards and alerting for the teams that previously depended on the vendor UI.
- — Self-hosting means owning upgrades, scaling, and cluster health — the price of leaving volume-based pricing.
- — Everything went through Terraform and Ansible, even when a one-off manual fix would have been faster that day.
- — Fixed cost cuts both ways: the cluster had to be deliberately scaled to usage rather than absorbing spikes on a vendor's balance sheet.
Want something like this built, or want to talk about the work?