You can't really make an informed decision without knowing how much data they were moving. For it to be that expensive, you'd need to be moving a ludicrous amount of data, and you can always parse data down to the required fields before indexing, which saves on licensing costs.

in 20 years of doing SIEM and SIEMlike solutions, I've yet to find an engagement that said 'Oh, yes...our volumes are XX and YY'...mostly it's a /shrug and a less than educated guess.

There's even reluctance to turning things on and _watching_ it for 10 minutes. An activity that would immediately give you a much better idea of volume. Folks just don't like doing it.

Then you get the things were setting up a redundant logsource is just unwise. DNS logging was 2 orders of magnitude greater than everything else a SIEM was doing. And Email was about the same size.

What are the required fields in an incident with a new bug pray tell?

It obviously depends. It's not a one size fits all answer.

The joke used to be 'splunk is amazing until the first invoice comes in', it's funny because it's true. Note Datadog is very similar in that regard.

Yes ... it's very possible for DataDog costs to exceed the cost of the infrastructure that it's monitoring (e.g. AWS). I've seen it happen.

(If you aren't careful and aren't managing your costs, but I suppose that's true of almost anything =)

Sounds like a double whammy. Misconfigure one AWS service, and you get hit with a giant bill from both.