Reduction Levers
The ways to cut log volume, and how much each one saves.
Ways to cut log volume. Each has a planning figure the calculator uses.
These are planning estimates, not guarantees. Actual results vary by source and environment.
The levers
| Lever | Saves | Applies to |
|---|---|---|
| Reserialize JSON to CSV | 50% | Any JSON source |
| Reserialize key=value to CSV | 33% | key=value sources |
| Drop session-start events | 25% | Firewalls logging session start and end |
| Trim trailing structure | 10% | Fixed-order comma-separated sources |
| Drop null and empty fields | Varies | Any structured source |
| Drop constant fields | Varies | Any structured source |
Reserialize JSON to CSV — 50%
JSON repeats every field name on every record. CSV names each field once in a header, so each record carries only the values. Half the bytes are field names.
Sources: AWS CloudTrail, Suricata, Microsoft 365 Unified Audit Log.
Reserialize key=value to CSV — 33%
Same idea as JSON, with less overhead to remove, so it saves about a third.
Sources: FortiGate, Linux auditd, F5 BIG-IP ASM.
Drop session-start events — 25%
A firewall writes one record when a session starts and one when it ends. The end record already carries the byte and packet counts, so the start record is close to a duplicate. Dropping it removes about a quarter of firewall volume.
Sources: FortiGate, Palo Alto — both log a session start and a session end.
Some searches use session-start records. Confirm with the security team before dropping them.
Trim trailing structure — 10%
Fixed-order comma-separated formats pad every record to the full field count, even when the last fields are empty. Cutting the empty tail saves bytes without touching a real field.
Sources: Palo Alto — its traffic log runs past 100 fields, many reserved and empty.
Drop null and empty fields — varies
Structured formats keep a field even when it holds no value. Dropping fields set
to null, an empty string, or - removes that waste. The saving depends on how
many empty fields a source sends.
Drop constant fields — varies
A field that holds the same value on every record — a vendor tag, a version, a facility code — carries no information. Recording it once and dropping the field saves its width on every line. The saving depends on how many constant fields a source sends.
Levers stack
Levers combine. A JSON firewall log can lose its start events, its null fields, and its constant fields, then reserialize to CSV — each cut applies to what the last one left.