What is changing
Sampling high-volume events, shortening hot retention, and archiving to cheap storage rather than keeping everything queryable.
What to keep at full fidelity
Errors, security events and anything with an audit obligation. Debug logging from healthy services is the first thing to sample.