Log Samples

Real sample logs, one page per source. Every line is copied from vendor or project documentation.

Measured character reduction

Each source below is stripped to a minimal encoding — epoch timestamps, no field names, single-character delimiter — and the result is compared to the original. The cut is measured on the sample, not estimated.

Format sets the ceiling. JSON, XML, and key=value carry the field name on every record, so stripping to values cuts half or more. A source that already ships positional values with a single delimiter — AWS VPC Flow, Palo Alto — sits near its floor, and reformatting alone returns little. For those, the other levers — dropping fields and events — do the work.

Juniper SRX appears twice because it writes the same event either way: 644 characters in the structured format, 227 in the traditional one. One configuration choice, a 2.8× difference on the wire.

Timestamps

A human-readable timestamp costs about 24 to 32 characters. The same instant as an epoch integer costs 10.

The saving multiplies where a record carries several. A Suricata flow event holds three ISO-8601 timestamps; FortiGate sends date and time as separate fields alongside an eventtime epoch that already encodes both.