Cost optimisation options Q&A (22 Aug 2025)

The following questions were raised by users during the StackOps Elastic Cost Optimisation Options session held on 22 August 2025.

Costs and deployments

Does the 7% discount apply only to the first invoice? Does that mean in the second month I will have a 7% increase?

For the first year of pricing, from 1 Sep ‘25 to 31 Aug ’26, you will receive a 7% discount on your Elastic usage monthly charges.

What is the cost for synthetic ping monitor per run?

Browser monitor: USD 0.0123 per test run (charged based on the frequency you configure)
Lightweight monitor (HTTPS, TCP, etc.): USD 28 per month flat rate, regardless of the number of monitors you create

Note: These charges apply when using public locations.

How do I calculate traffic cost and snapshot cost for expenditure approvals?

Egress traffic costs $0.032 per GB, and snapshot storage costs $0.033 per GB per month.

For a detailed breakdown and examples, refer to Elastic documentation:
Elastic Cloud Billing Dimensions

If I have many URLs to monitor (e.g., 100), what is the most cost-efficient way to set up synthetic monitoring using the assert text function?

The assert text function falls under Browser Tests, which incurs a charge of USD 0.0123 per test in addition to USD 28 per location per month.

For example, monitoring 100 URLs at 1-minute intervals would result in a daily cost of approximately USD 1,771.20, excluding the location charge of USD 28.

Cost optimisation tip: Consider using Private Locations, which allow you to run Browser Tests without incurring the per-test and location charges.

Can we refer to any documentation for private location synthetic monitor setup?

Yes, documentation is available here: Private Location Synthetic Monitoring Setup

Should we use the default workspace or create our own?

If there is no use case for creating your own workspace, the default is fine.

Will StackOps Elastic be rolling out v8.19 soon? Would this affect cluster pricing?

StackOps Elastic will be rolling out v8.19 soon, which has long-term Elastic support. There is no change in pricing.

Does storage reduction only help in cost savings if we can drop a node tier, or does reducing storage within a tier help?

Reducing storage helps reduce cost in terms of backup and traffic costs, but the main cost savings come via the node tier as it contributes to over 80% of overall cost.

If storage is below 40%, can we consider the usage safe?

If storage is at 40%, downsizing by one tier halves the resource, meaning usage will be 80% after downsizing. CPU and memory usage must also be considered when scaling down.

If I use StackOps Elastic only for active DevOps (e.g., 7 days max) and rely on CloudWatch afterwards, can I skip the cold and frozen tiers? My current cost estimate is over $150k/year for my log size.

Yes. If you have no compliance or retention requirements to keep logs in StackOps Elastic beyond 7 days, you can safely skip the cold and frozen tiers.

How can we prevent auto-scaling from exceeding our budget?

It is possible to configure a maximum configuration on a single AZ basis to prevent auto-scaling beyond the specified configuration.

We used the Lambda serverless forwarder previously, which resulted in very high CloudTrail costs. What should we do?

Consider switching to Elastic Agent, which can help reduce ingestion costs.

What happens if our logs exceed the storage we provision? Will old records be evicted and will we still see new log data?

No. Elastic has a disk watermark threshold to prevent data corruption. When storage reaches this threshold, affected indices become read-only. You can still search and analyse existing data, but new logs cannot be ingested. To resume writing, either scale up your deployment or delete old/unneeded data.

Do you have a reference architecture for cost-optimised log ingestion from Azure, AWS, or GCP?

Yes. A comparison table of ingestion methods for StackOps Elastic tenants is available here: Data Ingestion Methods

For the Elastic pricing calculator online—if we select the Singapore region, is the price in USD or SGD?

The price shown will be in USD.

Can we get the estimated cost of current deployments?

You can view your Elastic consumption trends via your Dashboard. Steps are documented here: Monitor Your Usage

If my AWS account incurs a total monthly cost of USD $5,000, what can I expect the cost to be if StackOps Elastic is implemented, assuming I follow the recommended cost optimisation settings?

Assuming StackOps Elastic is right-sized, costs are estimated based on the volume of ingested logs and the Elastic features used. They do not correspond directly to your AWS costs.

Storage and retention

For frozen tier, is it better to have 2 AZs with lower configuration or 1 AZ with higher configuration?

In general, there is no difference. However, there is a 3000 shard/node limit. Tenants with many shards can consider 2 AZs with lower configuration.

Can clusters be backed up if we need to pause the subscription or for later use?

Yes. There are two approaches:

Back up to another cluster in Elastic – tested method for pausing or migrating: Data Migration Guide
Self-managed snapshot repository – allows restoring snapshots later: Snapshot & Restore
- Note: From the UI, you can only restore snapshots to another active deployment, not a deleted one.

Can we delete logs ingested by a specific agent?

Yes, but you need the Elastic Agent ID to filter the index and delete the data.

How many Elastic Agents are recommended for a typical host environment that ships all logs, metrics, and traces in compliance with IM?

One or more agents can be used for ingesting data, and a separate agent for APM traces.

Will there be a session to teach agencies how to configure rollup jobs to summarise data to achieve more cost savings?

The only processes that help compress data are transform jobs and downsampling.

Refer to Elastic Documentation: Rollup Job API

WARNING: From 8.15.0, calling this API in a cluster with no rollup usage will fail with a message about deprecation and planned removal of rollup features. A cluster needs to contain either a rollup job or a rollup index for this API to be allowed to run.

If the deployment is created but no configuration is made, will there be any charges?

Yes, it will still be charged.

What is the appropriate value we should use for scan frequency?

It depends on how quickly the data needs to be ingested. Each API call incurs a cost, so frequency and volume of ingestion will impact overall expenses.

In Integration, if I give start position as "beginning", will it pull from day 1 of the log group?

It is use-case specific. If tenants want to pull day 1 of the log group, they should use “beginning.” If there is no use case for day 1 logs, starting from “end” is recommended.

Configuration and usage

How do we manually scale up or down the node instance specification?

Deployment scale up/down is handled by the StackOps support team. You can raise a service request for this.

How can we debug if there are log ingestion issues? Can we check Elasticsearch or Kibana server.logs?

Check the Elastic Agent metrics dashboard. If you notice a queue building up, this indicates an ingestion problem. There isn’t a separate Elasticsearch or Kibana server.logs for this purpose.

Can we provision a single StackOps Elastic for prod and non-prod?

It is possible to pipe both production and non-production logs to the same deployment.

Can multiple workflows be used in a project?

Yes. A project can have multiple workflows. Usage reporting may be complex if multiple workflows exist.

For AWS CloudWatch metric ingestion, should we add latency (e.g., 1m or 5m)? What is the purpose of this latency?

It depends on your metrics. Some metrics in CloudWatch arrive slightly slower. This latency tells the Elastic Agent to check these metrics with a delay. Without this latency, the Elastic Agent might assume the metrics do not exist.

In AWS integration, there are many "retrieve metrics from xxx" options (e.g., EC2, EBS, Kinesis, generic CloudWatch). Are all these options using the GetMetrics API from AWS CloudWatch?

Most of them do. The integration has hardcoded specific CloudWatch metric namespaces, but a few integrations do not use this approach.

Is there a way to add metric ingestion for non-built-in connectors, such as AWS WAF or custom metrics?

Yes. The default CloudWatch integration can pull custom metrics in addition to the built-in ones. Alternatively, you can use a custom AWS integration for more specialised metric ingestion.

Will there be a single agent from Elastic for RUM/APM and infrastructure, similar to Dynatrace's OneAgent?

Elastic provides lightweight, purpose-built agents for each system being observed. There isn’t a single universal agent like Dynatrace OneAgent, so some configuration per system may be required.

Can Automatic Import be applied to custom pipelines beyond Security SIEM?

The Automatic Import feature is currently designed for the Elastic Security solution. Additional AI-driven import capabilities for other pipelines are planned in the roadmap.

Is there a way to have an overview for all log sources and know if a log source stops ingesting?

If you know which logs are important and they usually arrive consistently, you can create alerts that trigger when no documents are ingested for a specified period.