Documentation Grafana Cloud Observe and act Optimize data Adaptive Logs Create drop rules

Create and manage drop rules

Drop rules let you control log volume by creating deterministic rules to decide which log lines to drop. You can use drop rules to reduce repetitive or low-value log lines across specific log streams, matching specific text patterns, or with specific log levels, or any combination thereof.

Drop rules are evaluated in priority order. The first rule that a log line matches is what is applied. A log line must meet each of the criteria in the rule to be considered a match.

For more information about how drop rules interact with exemptions and pattern drop rates, refer to Order of evaluation.

Why use drop rules?

Drop rules are useful when you want to enforce ingestion control across specific logs. For example, you may want to:

• Reduce debug logs across a namespace
• Temporarily reduce informational logs during cost control periods
• Apply sampling to specific clusters or jobs
• Drop logs based on level or content matching

Before you begin

• You must have access to Adaptive Logs in Grafana Cloud.

• Ensure you understand which log streams you want to affect.

Create a drop rule

To create a drop rule, complete the following steps.

1. In Grafana Cloud, navigate to Adaptive Telemetry.

2. Select Adaptive Logs.

3. Open the Drop rules page.

4. Click Create a new drop rule.

5. Configure the rule:

   • Name (required): A descriptive name.
   • Drop rate (required): Percentage of matching logs to discard.
   • Stream selector (optional): A LogQL stream selector defining target streams (for example, {env="production"}). Regex matchers (=~, !~) must use enumerable patterns like "a|b|c". Open-ended patterns like "prod.*" are not supported. Reserved labels (prefixed with __) are not allowed.

   Note

   If you send logs using OpenTelemetry Protocol (OTLP), labels used in stream selectors must be configured as index labels (action: index_label) in your OTLP configuration. Without this configuration, the drop rule won’t match any logs. For information about configuring OTLP resource attributes, refer to Configure Loki settings or use the Grafana Cloud UI.

   • Log levels (optional): One or more levels detected from log metadata. If multiple levels are specified, a match on any one of them counts as a match (OR logic).
   • Log line contains (optional): Filter log line content containing an exact text string. Text strings are case-sensitive. A single rule can include multiple strings, and must match all of them to count as a match (AND logic).
   • Expires at (optional): Set expiration.

6. Click Create to add the rule.

Manage existing drop rules

From the Drop rules page, you can:

• Edit a rule
• Delete a rule
• Change rule order
• Filter rules by name, log level, or Managed by
• View the impact of a rule

Drop logs before they reach Grafana Cloud

When fleet-managed Adaptive Logs is on, Adaptive Logs pushes drop rules and exemptions to opted-in collectors. Those collectors filter matching logs before the logs leave your infrastructure, so you do not send that volume to Grafana Cloud only to drop it. Existing rules and exemptions are included. You do not recreate them.

To sync pipelines and add collector attributes, refer to Set up fleet-managed Adaptive Logs.

If you create or edit a 100% drop rule while fleet-managed Adaptive Logs is on, Adaptive Logs shows an information alert titled Handled by Fleet Management. The alert explains that the rule drops 100% of matching logs client-side in your fleet-managed pipelines, that Fleet Management handles those drops, and that Grafana Cloud does not report per-rule drop metrics for them.

On the Drop rules list, Adaptive Logs marks each 100% rule with an On the edge chip. Hover the chip to read the same explanation.

You only see the alert and chip when the rule drop rate is 100% and fleet-managed Adaptive Logs is on. Other drop rates still run on your collectors. The chip flags the 100% case because Grafana Cloud does not report per-rule drop metrics for those rules.

Drop debug logs with the guided flow

Adaptive Logs includes a guided flow that walks you through creating a drop rule for debug logs from a single high-volume service. It recommends a starting drop rate, pre-fills the rule, and lets you preview the impact before any logs are dropped. Use the guided flow for your first drop rule, or whenever you want a quick way to trim a noisy service.

Debug logs are often the largest and least-queried part of your log volume, which makes them a low-risk starting point for reducing cost.

Start the guided flow

You can launch the guided flow from two places:

• On the Adaptive Logs Overview page, click Get started under Reduce log volume by dropping debug logs.
• On the Drop rules page, the guided flow appears inline when you have no drop rules yet. After you create your first drop rule, the inline flow no longer appears; start the flow from the Get started button on the Overview page instead.

Pick a service

Adaptive Logs ranks your services by total log volume over the last 24 hours and shows the top producers.

1. Select a service from the ranked list.
2. Click Continue.

When more services exist than are shown, Adaptive Logs displays the count of total services above the list, for example Showing the top 5 of 200+ services by volume. Actual savings from the rule depend on how much of the selected service’s log volume is at the debug level.

Choose a drop rate

Use the slider to choose how aggressively to drop debug logs from the selected service. Adaptive Logs marks 75% as the recommended starting point.

Click Continue.

Review and create the rule

Adaptive Logs pre-fills a drop rule from your choices:

• Name: Drop <RATE>% of debug logs from <SERVICE>
• Drop rate: the value you chose
• Stream selector: {service_name="<SERVICE>"}
• Log levels: debug

A preview panel shows a sample of log lines that match the rule, so you can confirm the rule targets the right traffic before you create it.

1. Review or adjust any field. For example, change the name, add label matchers, narrow the rule with Log line contains, or set an expiry under Expires at.
2. Click Create drop rule.

The new rule appears in the Drop rules list and Adaptive Logs starts dropping matching logs as soon as the rule is active. To change the rule later, refer to Manage existing drop rules.

Troubleshooting

Why are no logs being dropped by my rule?

If you are seeing no log lines dropped by your rule, check the following:

• Ensure you are sending logs that match the rule criteria.
• Check if logs are being dropped by a rule that is evaluated earlier. This is controlled by rule order.
• If fleet-managed Adaptive Logs is on, pipelines update on an interval. After you change a rule or exemption, wait for the next update before you expect opted-in collectors to apply it.
• If the rule drop rate is 100% and fleet-managed Adaptive Logs is on, Grafana Cloud does not report per-rule drop metrics for that rule. Check the On the edge chip on the Drop rules page.
• If you send logs using OpenTelemetry Protocol (OTLP), verify that the labels in your stream selector are configured as index labels in your OTLP configuration. By default, only certain OTLP resource attributes are promoted to stream labels. Configure any other labels with action: index_label using the self-serve API or the Grafana Cloud UI.