Documentation Grafana Cloud Adaptive Telemetry Adaptive Logs Create drop rules

Create and manage drop rules

Drop rules let you control log volume by creating deterministic rules to decide which log lines to drop. You can use drop rules to reduce repetitive or low-value log lines across specific log streams, matching specific text patterns, or with specific log levels, or any combination thereof.

Drop rules are evaluated in priority order. The first rule that a log line matches is what is applied. A log line must meet each of the criteria in the rule to be considered a match.

For more information about how drop rules interact with exemptions and pattern drop rates, refer to Order of evaluation.

Why use drop rules?

Drop rules are useful when you want to enforce ingestion control across specific logs. For example, you may want to:

• Reduce debug logs across a namespace
• Temporarily reduce informational logs during cost control periods
• Apply sampling to specific clusters or jobs
• Drop logs based on level or content matching

Before you begin

• You must have access to Adaptive Logs in Grafana Cloud.

• Ensure you understand which log streams you want to affect.

Create a drop rule

To create a drop rule, complete the following steps.

1. In Grafana Cloud, navigate to Adaptive Telemetry.

2. Select Adaptive Logs.

3. Open the Drop rules tab.

4. Click Create a new drop rule.

5. Configure the rule:

   • Name (required): A descriptive name.
   • Drop rate (required): Percentage of matching logs to discard.
   • Stream selector (optional): A LogQL stream selector defining target streams (for example, {env="production"}). Regex matchers (=~, !~) must use enumerable patterns like "a|b|c". Open-ended patterns like "prod.*" are not supported. Reserved labels (prefixed with __) are not allowed.

   Note

   If you send logs using OpenTelemetry Protocol (OTLP), labels used in stream selectors must be configured as index labels (action: index_label) in your OTLP configuration. Without this configuration, the drop rule won’t match any logs. For information about configuring OTLP resource attributes, refer to Configure Loki settings or use the Grafana Cloud UI.

   • Log levels (optional): One or more levels detected from log metadata. If multiple levels are specified, a match on any one of them counts as a match (OR logic).
   • Log line contains (optional): Filter log line content containing an exact text string. Text strings are case-sensitive. A single rule can include multiple strings, and must match all of them to count as a match (AND logic).
   • Expires at (optional): Set expiration.

6. Click Create to add the rule.

Manage existing drop rules

From the Drop rules page, you can:

• Edit a rule
• Delete a rule
• Change rule order
• Filter rules by name or log level
• View the impact of a rule

Drop debug logs with the guided flow

Adaptive Logs includes a guided flow that walks you through creating a drop rule for debug logs from a single high-volume service. It recommends a starting drop rate, pre-fills the rule, and lets you preview the impact before any logs are dropped. Use the guided flow for your first drop rule, or whenever you want a quick way to trim a noisy service.

Debug logs are often the largest and least-queried part of your log volume, which makes them a low-risk starting point for reducing cost.

Start the guided flow

You can launch the guided flow from two places:

• On the Adaptive Logs Overview page, click Get started under Reduce log volume by dropping debug logs.
• On the Drop rules page, the guided flow appears inline when you have no drop rules yet. After you create your first drop rule, the inline flow no longer appears; start the flow from the Get started button on the Overview page instead.

Pick a service

Adaptive Logs ranks your services by total log volume over the last 24 hours and shows the top producers.

1. Select a service from the ranked list.
2. Click Continue.

When more services exist than are shown, Adaptive Logs displays the count of total services above the list, for example Showing the top 5 of 200+ services by volume. Actual savings from the rule depend on how much of the selected service’s log volume is at the debug level.

Choose a drop rate

Use the slider to choose how aggressively to drop debug logs from the selected service. Adaptive Logs marks 75% as the recommended starting point.

Click Continue.

Review and create the rule

Adaptive Logs pre-fills a drop rule from your choices:

• Name: Drop <RATE>% of debug logs from <SERVICE>
• Drop rate: the value you chose
• Stream selector: {service_name="<SERVICE>"}
• Log levels: debug

A preview panel shows a sample of log lines that match the rule, so you can confirm the rule targets the right traffic before you create it.

1. Review or adjust any field. For example, change the name, add label matchers, narrow the rule with Log line contains, or set an expiry under Expires at.
2. Click Create drop rule.

The new rule appears in the Drop rules list and Adaptive Logs starts dropping matching logs as soon as the rule is active. To change the rule later, refer to Manage existing drop rules.

Troubleshooting

Why are no logs being dropped by my rule?

If you are seeing no log lines dropped by your rule, check the following:

• Ensure you are sending logs that match the rule criteria.
• Check if logs are being dropped by a rule that is evaluated earlier. This is controlled by rule order.
• If you send logs using OpenTelemetry Protocol (OTLP), verify that the labels in your stream selector are configured as index labels in your OTLP configuration. By default, only certain OTLP resource attributes are promoted to stream labels. Configure any other labels with action: index_label using the self-serve API or the Grafana Cloud UI.