What is changing

Sampling high-volume events, shortening hot retention, and archiving to cheap storage rather than keeping everything queryable.

What to keep at full fidelity

Errors, security events and anything with an audit obligation. Debug logging from healthy services is the first thing to sample.