Skip to content
Logmetry
What you run
SplunkMicrosoft SentinelDatadogDynatraceSolarWindsCriblOpenTelemetryA Data Lake
The Logmetry Blueprint
The whole methodPhase 01 · FoundationPhase 02 · FootprintPhase 03 · AI triageEverything as codeAI native
CompareJournalAboutBook the review

Phase 02 · Footprint

Footprint reduction

Every alert and every rule is rebuilt and proven to behave exactly as it does today, tier by tier and in writing, before a single host comes off per-node pricing.

01The parity bar

Proven in writing, before anything moves

The phase gate is alert parity: rebuilt, compared, and signed off tier by tier, so footprint reduction never trades away coverage.

The Phase 03 agent that follows is a second path on top, not a replacement: the alert still fires as it always did, and now also reaches something that investigates it. Coverage goes up, because the alerts nobody ever reached get worked too.

What you own after: platforms replaced where they can be and cut back to a small core where they cannot, with everything else running on collection, alerts and dashboards you own.

02The meter

The meter you are already on

The per-node meter is what that pricing model charges at each estate size every year, and it is never a quote for what comes off your bill.

Collected once, routed four waysEvery host runs one open collector, and everything is collected once. A collection and control layer enriches, cleans, aggregates, partitions, deduplicates, and routes it in flight, then routes it four ways: the whole of it, enriched and correlated, to a full-fidelity Lake your agent reads, most of what you watch to a metric store you own with rules and alerts as code, a fraction of the volume to the SIEM, and a fraction of the hosts to the APM, which stay for the critical apps they are genuinely great at. You decide what reaches each one before anyone bills you for it.YOUR ESTATEEvery host, oneopen collectorAll of it,onceCOLLECTION + CONTROL LAYEREvery source, shaped in flightENRICHCLEANAGGREGATEPARTITIONDEDUPLICATEROUTEALL OF IT, ENRICHEDSTANDARD MONITORINGA FRACTION OF VOLUMEA FRACTION OF HOSTSTHE LAKEEnriched, read by your agentYOUR METRIC STOREYour rules as code, no per-node billTHE SIEMOnly what detection needsTHE APMCrown-jewel apps, deliberately small
The machine complete. Everything is collected once and shaped in flight. The Lake takes all of it, enriched, cleaned, and correlated for your Agent to read. The metric store takes standard infrastructure monitoring for most of the estate, and the expensive tools, genuinely great on your most critical apps, take a governed fraction. This is the future of agentic observability.

Crown-jewel tracing stays where it earns its price, and so does synthetic monitoring. What that leaves is the bulk of most estates: ordinary nodes running ordinary processes, watched by basic checks collected just as well another way. The stack that replaces them costs a fraction of that, and the subtraction is yours to do on your own node count.

03The ladder steepens

Why per-node renewals only move one way

Per-node pricing grows with the estate whether or not those nodes produce anything anyone reads, and the tier that drives the count is almost never the tier anyone is looking at.

It is ordinary infrastructure, and that is exactly the tier that does not need to be rented. Even tracing is changing. Traces and logs collected by the open collector land in the Lake carrying the same trace ID, which is how OpenTelemetry ties the span, the log line and the metric together, so an agent can follow a trace ID your APM raised into everything the collector kept around it, for the cost of a query. The deepest tracing stays on the few hosts that earn it. The rest of the investigation is moving to the Lake.

04Questions

Asked about footprint reduction

Do we lose alerts when hosts come off per-node pricing?

No, and this is the phase gate: every alert and every rule is rebuilt and proven to behave exactly as it does today, tier by tier and in writing, before a single host moves. Coverage goes up afterwards, because the alerts nobody ever reached get worked too once the Phase 03 agent arrives.

Does deep tracing go away?

No. Crown-jewel paths keep real APM, deliberately scoped small, where per-host pricing genuinely earns its place. The tier that moves is ordinary nodes running ordinary processes, watched by basic checks that collect just as well on the open layer. That tier is almost the whole of most estates.

Is the per-node meter a quote?

Never. The meter is what the per-node model charges at each estate size, every year, before anyone has read a dashboard. It is not a quote for what we take off the bill. The subtraction is yours to do on your own node count, and the review is where it gets read honestly.

Who operates what remains?

Your choice. The rules are plain YAML files, changing one means describing the change to a coding agent in plain English, and who operates what is left, us or your team, is a decision you make rather than a dependency you inherit.

Start with the review

You share your diagrams, we review them with you, and you leave with your version of the Logmetry Blueprint drawn on your stack. No system access, no obligation.

Book the reviewOr take the Logmetry Blueprint as a PDF →