I use Azure Kubernetes service, which is connected to Log Analytics Workspace.
Log Analytics Workspace collects too much data, what is quite expensive.
After googling the ways to reduce the costs I found a few recommendations, but most of them about reducing the ContainerLogs size. My case is different. I do need all ContainerLogs, but nothing else.
On the image you can see the result of running this query:
union withsource = tt *
| where TimeGenerated > ago(1day)
| where _IsBillable == true
| summarize BillableDataMBytes = sum(_BilledSize)/ (1000. * 1000.) by tt
| render piechart
As you can see I need only 3% of all stored data, the rest 97% I want to disable or reduce (take new values much rare). Is it possible?
Is it possible to disable/reduce at least the "Perf"?