The Logmetry BlueprintPhase 04
Footprint reduction. Collect once. Nothing moves before parity.
One open collector on every host replaces the vendor agents, under a fleet console you own. Then each alert and each rule is rebuilt and proven to behave exactly as it does today, tier by tier and in writing, before a single host comes off per-node pricing.
What gets built
- OpenTelemetry collectors on every host, nobody licenses them
- A fleet console under OpAMP, running in your account
- Each alert and each rule rebuilt in code
- Infrastructure monitoring on an open source time series database you own
- Crown-jewel tracing kept where it earns its price
The gate
Alert parity, proven tier by tier and in writing, before a single host comes off per-node pricing.
01Collect once
Collected once, on an open standard
Every host runs one collector and it is the open one, reading host metrics, event logs, syslog, application logs, Kubernetes, and the metrics endpoints your services already expose, with nothing changed in any application.
The OpenTelemetry Collector replaces the two or three per-vendor agents most hosts carry today, and it carries no per-host or per-agent license. Traces are the one thing it cannot see from outside a process, and for most runtimes that is a flag or a wrapper on the service rather than a development project.
A collector is not the hard part. Running five thousand of them is. Each collector runs under a small supervisor that dials out to a control plane in your account over the Open Agent Management Protocol, the OpenTelemetry standard for managing fleets of collectors. The host opens the connection, so no credential to your network sits anywhere else.
02The fleet console
The pane of glass, in your repository
The fleet console is the same pane every platform vendor rents you for their agent, built for you instead: every host, its health, what it is running, and the rollout in progress, running in your account.
Configuration rolls out in rings from a repository your team reviews, through CI/CD: a few test hosts first, the estate after. Drift between what was sent and what runs is reported host by host. The console holds no state of its own to lose, because the repository is the state.
That is what vendor agnostic means in practice: not a promise about the future, but a fleet you could hand to the next engineer, or the next vendor, tomorrow.
03The parity bar
Proven in writing, before anything moves
The phase gate is alert parity: rebuilt, compared, and signed off tier by tier, so footprint reduction never trades away coverage.
| Tier | Rebuilt | Compared | Signed off | Moves |
|---|---|---|---|---|
| Ordinary hostsBasic checks, collected as well on the open layer | Done | Done | Done | Moves, after sign-off |
| Shared servicesQueues, caches, internal APIs | Done | Done | Not yet | Waits for sign-off |
| Crown-jewel appsDeep tracing earns its price here | Not needed | Not needed | Not needed | Stays on real APM |
| Synthetic checksJourneys your customers take | Not needed | Not needed | Not needed | Stays where it is |
The gateAlert parity, proven tier by tier and in writing, before a single host comes off per-node pricing.
The Phase 02 agent already on your alerts is a second path on top, not a replacement: each rebuilt alert still fires as it always did, and still reaches something that investigates it. Coverage goes up, because the alerts nobody ever reached get worked too.
What you own after: platforms replaced where they can be and cut back to a small core where they cannot, with everything else running on collection, alerts and dashboards you own.
04The meter
The meter you are already on
The per-node meter is what that pricing model charges at each estate size every year, and it is never a quote for what comes off your bill.
Crown-jewel tracing stays where it earns its price, and so does synthetic monitoring. What that leaves is the bulk of most estates: ordinary nodes running ordinary processes, watched by basic checks collected just as well another way.
The stack that replaces them costs a fraction of that, and the subtraction is yours to do on your own node count.
05The ladder steepens
Why per-node renewals only move one way
Per-node pricing grows with the estate whether or not those nodes produce anything anyone reads, and the tier that drives the count is almost never the tier anyone is looking at.
It is ordinary infrastructure, and that is exactly the tier that does not need to be rented. Even tracing is changing. Traces and logs collected by the open collector land in the Lake carrying the same trace ID, which is how OpenTelemetry ties the span, the log line and the metric together.
So an agent can follow a trace ID your APM raised into everything the collector kept around it, for the cost of a query. The deepest tracing stays on the few hosts that earn it. The rest of the investigation is moving to the Lake.
06Questions
Asked about footprint reduction
Does the collector require changing our applications?
No. The OpenTelemetry Collector reads host metrics, the Windows event log, syslog, any log file any application writes, Kubernetes, and anything exposing a metrics endpoint, with nothing changed in any application. Traces are the one exception, and for most runtimes that is a flag or a wrapper, not a development project.
What does the fleet console cost to license?
There is no per-node or per-agent license anywhere in the collection layer. The collectors are open source, the supervisor and control plane speak OpAMP, the open standard for managing collector fleets, and the console is built for you, running in your account, reading your repository.
Do we lose alerts when hosts come off per-node pricing?
No, and this is the phase gate: each alert and each rule is rebuilt and proven to behave exactly as it does today, tier by tier and in writing, before a single host moves. Coverage goes up afterwards, because the Phase 02 agents already work the alerts nobody used to reach.
Does deep tracing go away?
No. Crown-jewel paths keep real APM, deliberately scoped small, where per-host pricing genuinely earns its place. The tier that moves is ordinary nodes running ordinary processes, watched by basic checks that collect just as well on the open layer. That tier is almost the whole of most estates.
Is the per-node meter a quote?
Never. The meter is what the per-node model charges at each estate size, every year, before anyone has read a dashboard. It is not a quote for what we take off the bill. The subtraction is yours to do on your own node count, and the review is where it gets read honestly.
Who operates what remains?
Your choice. The rules are plain YAML files, changing one means describing the change to a coding agent in plain English, and who operates what is left, us or your team, is a decision you make rather than a dependency you inherit.
See your architecture drawn, with the costs, before you spend anything.
Our lead architects draw your SIEM feed from your diagrams: where the cost sits, what step one would change, and where it would not pay. If it pays, the next step is a two-week proof on your noisiest source.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing