A Prague-based FinTech startup was burning €18k/month on a managed Elasticsearch cluster. We restructured their ILM, introduced tiered storage, and cut the bill to €7.2k.
Key Results
The startup was retaining 12 months of raw logs on hot-tier nodes — the most expensive node type — with no compression, no rollover policy, and no cold storage. Their 400 GB/day ingest rate made this unsustainable.
All data on hot-tier nodes regardless of query frequency
No index rollover — single indices growing beyond 200 GB
No compression enabled on older indices
6-month retention goal never implemented — logs kept indefinitely
Compliance team requesting 2-year retention, which seemed impossible at current cost
The solution was an ILM architecture that matched storage tier to access pattern. Hot for 7 days (active analysis), warm for 30 days (incident investigation), cold for 90 days (compressed, read-only), and frozen for 18 months (searchable S3-backed snapshots for compliance).
ILM policy design
Per-service policies with hot/warm/cold/frozen phases; automated shard shrink on warm promotion
Frozen tier setup
Configured searchable snapshots to S3-compatible MinIO; 93% storage cost reduction vs. hot tier
Compression tuning
Enabled best_compression codec on warm+ indices; average 45% size reduction on log data
Data stream migration
Migrated 14 legacy indices to data streams for proper rollover management
The compliance team got their 2-year retention requirement met. The engineering team got faster hot-tier performance (fewer documents, better cache hit ratio). Finance got a 60% cost reduction. The engagement paid for itself in under 3 weeks.
More implementations
A large enterprise had no centralised monitoring, no log management, and no insight into the state of its internal processes. We designed and delivered a full Elasticsearch platform on OpenShift — with 50+ Logstash pipelines, HA clustering across 4 TB of data, and alerting tunable in seconds.
View case studyA large-scale monitoring estate — 400 dashboards, 2,000 monitored objects, 700 alert rules — migrated from Splunk to New Relic incrementally and without disruption. Costs were cut in half. Alerting fatigue was eliminated.
View case studyYour environment
Let's talk about your observability challenges. Free consultation, no obligations.
Book a Free Consultation