Platform and SRE teams managing centralized log aggregation pipelines using Elasticsearch/OpenSearch, Loki, or Splunk face runaway ingestion costs as services scale. They need to identify high-volume low-value log sources, right-size index retention tiers, and implement sampling or filtering at the collector level to reduce costs without losing security-relevant log data.