Sumo Logic Flex Licensing - What will it cost you?

In their recent press release, Sumo Logic states this new offering is "a first-of-its-kind log analytics pricing plan that uniquely offers free, unlimited log data ingest so developer, security and operations teams can capture and analyze critical data across their enterprise." Interesting. First-of-its-kind might be a stretch, but let's go with it.

The first thought that pops into my head of a similar model is Splunk SVC pricing. Splunk states: "Workload Pricing gives you the flexibility to bring more data into Splunk Cloud Platform without worrying about incurring high costs driven by high volumes of data with low requirements on reporting. For example, if you expect that a large chunk of your data will be searched infrequently, but you still want the ability to correlate it across other data in your platform, Workload Pricing is the right option."

The second thought that pops into my head of another similar model is Datadog Ingest/Index nuance within Logging without Limits™ offering or even their Flex Logs offering. Datadog states: "Cloud-based applications can generate logs at a rate of millions per minute. But because your logs are not all and equally valuable at any moment, Datadog Logging without Limits™ provides flexibility by decoupling log ingestion and indexing."

We all know the cliche that data volumes are growing at exponential rates. So if the data is ever increasing, and therefore their own costs are increasing, how can these traditional observability providers offer free or extremely inexpensive data ingest for their customers without affecting their margins?

Easy... they are shifting the costs to charge you based on compute (analytics) and storage. Unfortunately this means that until you see your bill at the end of the month, the first few might be quite a surprise. This might be a nice surprise if you're not searching or doing much with your data, or it might be a terrible surprise if you're doing a lot of real-time analytics. So let's dive in.

Unlimited... Unlimited... Unlimited... Customer defined... 1000/500, ok bingo.

Let's take the first number, 1,000 monitors for logs. Although it may not sound like a lot, that can be quite a bit when they're continuously looking for conditions within your log data. Assume 25 users in an average account, that means each user could create on average 40 analytics monitors/alert conditions. The reality is that usually it's a small handful of power users that create most of these. So let's say it's a few power users that create 20-30 conditions each, with a much larger number of other users creating a lot less. That assumption would swag us at around 250 (or just a quarter of the limit) alert conditions.

Now that brings us to real-time continuous queries. Not a lot of people quite realize that when you want the observability platform to check for a certain condition every 5 minutes, that query runs 288 times a day. Even if the average alert condition only analyzes the last 1 hour of data, that means that one monitor is scanning more than 10X your data volume. You see where I'm going with this? Let's assume most, so 200, are 5 minute scheduled queries that look at a 60 minute window, and the last 50 are every hour, looking at 12 hour windows. 72,000 hours per day for monitors.

Then let's say you have some engineers that have simple search use cases. Let's say on average in any given day you'll have engineers searching around on your log data. Usually most DevOps or SREs will be searching on the most recent data sets, so those will be 15 minute queries. But, we all know that every once in a while a few of the users will start 24 hour, or 7 day, or 30 day or... 366 day queries. Let's assume the ad hoc querying is minimal, so let's go with 500 day total aggregate query range. It feels quite low, but leaves us at 12,000 hours ad hoc search per day.

Then come the dashboards. Since you've probably stopped reading by now, let's just go with 2 dashboards per user on average, 25 users, 50 dashboards. Let's say 6 panels each, so 300 panels. A lot will look at the last 60 minutes, some will also look at the last 24 hours, so let's use just use 60 minutes to be conservative. Dashboards need to refresh if active, let's take a 1 minute refresh. Let's also assume it caches results with views on the backend which let's say reduces scanning by a swag of 10X. That leaves us at 43,200 hours dashboards per day.

So where does that leave us?

Sumo Logic's pricing page mentions that the cost will be $2.57 per TB scanned. What is scanned data? They state: "scanning occurs when a Sumo Logic query is executed across log data (e.g. Log Search, Dashboards, Monitors). A data scan facilitates the query and retrieval process of a log search by traversing table items from beginning to end" which seems reasonable enough.

At Edge Delta we have customers and work with many observability teams at the hundreds of TBs/day to even PBs/day log volumes, but that's certainly not the average volume for a startup, SMB, or a Mid Size company. Though I would argue a lot of enterprises we talk to are much higher than 5 TB/day, let's use that nice easy round approximate number for this example, which comes to ~200GB/hour. So just for this logs example:

0.200 TB/hour (log throughput) * [72,000 hours/day (log monitors) + 12,000 hours/day (ad hoc search) + 43,200 hours/day (dashboards)] * $2.57 / TB scanned = $65,381 PER DAY        

We haven't even started on the data storage or retention costs, or one minute queries, or 30s dashboard refreshes, or any sort of correlation or machine learning compute costs... and we still get to an observability cost of $65,381 per day.

If that sounds insane, it might shed light on why people were surprised with a $65M Datadog overage/bill about a year ago.

What's the good news? The good news is maybe you don't have 5TB/day, or maybe you don't have 25 users, or maybe you don't have 250 monitors running (you definitely won't have 250 monitors running at the beginning of your observability journey). Who really knows what your costs will be? A lot of people we talk to have no idea until they get the bill.

If you have high usage on your observability platform, this new pricing won't help you. In this example it's more expensive than simply paying $3/GB all in.

If you have low usage and don't do much with your logs, I'd ask why you're putting them anywhere other than an archive tier.