Sumo Logic adds AI tools to cut telemetry costs upstream

Sumo Logic has introduced enhanced Data Pipelines for security and observability data, aiming to give customers more control over telemetry costs.

The new version lets teams decide what happens to data before it is ingested, stored, and analysed. That includes filtering out unwanted data, transforming telemetry, and routing it to different destinations or storage tiers from within the Sumo Logic platform.

The move addresses a growing challenge for security and operations teams as telemetry volumes rise. Companies are collecting larger amounts of machine data from cloud services, applications, infrastructure, and security tools, while wider AI adoption is adding to that growth.

Many organisations have historically chosen to ingest as much operational data as possible and determine its value later. Sumo Logic argues that this model is becoming harder to sustain as storage and ingestion costs rise and lower-quality data makes analysis more difficult.

The company currently ingests and analyses nearly seven exabytes of data a day for thousands of security and operations teams. It is now extending that data management work further upstream so customers can make cost and data decisions before telemetry reaches analytics systems.

Cost pressure

At the centre of the update is a live pipeline preview designed to show teams how data will be handled before it is sent onward. Users can use the feature to remove noise and send data either to lower-cost tiers or to external destinations before it adds to billing.

Sumo Logic is also adding AI-assisted configuration for pipeline rules, intended to reduce the manual work involved in writing rules and to identify anomalies and format changes in incoming data.

The company described the system as an assistant that recommends whether telemetry should be routed, transformed, or dropped, while leaving final decisions to human users. It said this could help customers keep access to higher-value telemetry they might otherwise avoid collecting because of cost.

The update is part of Sumo Logic's broader effort to bring together data management, detection, investigation, and response in one platform. The company argues that separate pipeline and analytics tools can add complexity for teams already dealing with fragmented data sources.

A Gartner report cited by Sumo Logic found that organisations had typically defaulted to ingesting all operational data for later analysis, but that approach had become less feasible because of ingestion and storage costs. The report also said higher volumes of poor-quality telemetry could reduce business value and hinder the use of generative AI and large language models that depend on that data.

Platform shift

Keith Kuchler, Chief Product and Technology Officer at Sumo Logic, said the company was applying its experience in large-scale telemetry management to earlier stages of the data lifecycle.

"We've spent fifteen years as experts helping customers maximize the value of their telemetry, turning exabytes of noise into actionable insights that are critical to improving enterprise security and overall performance of infrastructure and applications," said Keith Kuchler, Chief Product and Technology Officer at Sumo Logic.

"With AI exponentially increasing data volumes and costs, that expertise is even more crucial. The next generation of our AI-powered data pipeline solution moves data strategy decisions upstream, empowering teams to determine the purpose of their data so it can effectively be leveraged by responsible AI implementations and also enables them to effectively manage the economics of their data," Kuchler said.

Beyond the immediate update, Sumo Logic outlined further work on visual and AI-assisted tools for shaping telemetry before it is stored either in the company's own platform or in customers' cloud storage. It also plans to extend the service into a platform-neutral pipeline for data sent to external tools and platforms.

Another part of that work involves an OpenTelemetry-native management layer. Sumo Logic said this would give teams a single interface to group, monitor, configure, and deploy OpenTelemetry collectors and pipelines, with the aim of reducing the need to maintain additional agents.

The company said customers would be able to enrich, reduce, transform, and route telemetry across their environments with less manual effort. The update reflects a wider industry push to manage data volumes earlier in the pipeline, as security and observability teams face pressure to contain costs without losing access to useful signals.