“Most enterprises are not over-monitored. They are under-curated. The organisations that get this right decide what a piece of telemetry is worth before they pay to store it, not after the invoice arrives.”
Gartner expects IT spending in India to reach $176.3 billion in 2026, a rise of 10.6 per cent over the previous year. Within that total, data centre systems will grow faster than any other segment, at 20.5 per cent.
Those numbers describe a build-out. They do not describe the second bill that arrives behind it.
Every server, container, and cloud service added to an estate emits telemetry. Logs, metrics, traces, and events have to be collected, stored, indexed, and paid for. That cost rises with infrastructure growth, and in most organisations it has been rising quietly, without a line item of its own and without anyone holding the question of whether the spend is proportionate to the value.
Finance has started asking that question directly. One research found that more than 500 IT decision-makers, found that 54 per cent now face increased requests from leadership to justify observability expenses.
The Bill Arrives After the Decision
The structural problem is one of sequence. Most organisations decide how long to keep telemetry after it has already been ingested. Data lands in storage, sits there under a default retention policy, and only later does someone reconcile the invoice against what the business actually used.
By then the decision has been made by inertia rather than by design.
Gartner has watched this compound. Its own conference material notes that 44 per cent of its clients now spend more than a million dollars a year on observability, up from 36 per cent, and that median client spend with a single vendor exceeds $800,000 annually. Its April 2025 research on the subject carries a warning worth reading twice: by 2028, enterprises that fail to put observability cost controls in place are expected to overspend by more than half.
Overspending by half is not a procurement failure. It is an architecture failure that shows up on an invoice.
Logs Absorb the Largest Share
Ask where the money goes and the answer is consistent. Gartner’s research finds that clients spend considerably more on log analysis than on any other part of observability, and that for larger organisations this can exceed half of total spend. The same research notes that few of those clients believe log tooling delivers half the value.
That gap between cost share and value share is the whole problem in one sentence.
The reason is not hard to locate. A debug line from a service that has run without incident for eight months costs the same per gigabyte as the line that explains last quarter’s outage. Storage does not distinguish between them. Neither does most ingestion tooling. The verbose, repetitive, low-consequence output of healthy systems dominates volume precisely because those systems are healthy and keep running.
Volume Is Not the Same as Visibility
The instinct against all of this is to keep everything, because nobody wants to be the person who deleted the evidence.
That instinct deserves more scrutiny than it usually gets. A team reconstructing an incident from ninety days of undifferentiated logs works slower than a team searching a well-structured thirty. Retention without structure produces a cost problem and a search problem at the same time, and the second one is measured in minutes of downtime rather than rupees.
Keeping everything is not a strategy. It is the absence of one.
The Decision Belongs at the Front
The correction is architectural and it is straightforward to describe, if not always to implement. The decisions about what to keep, what to enrich, what to convert into a metric, and what to discard belong between the source and the storage layer, not after it.
This is no longer a fringe view. In its latest assessment of the observability market, Gartner describes pipeline management as a strategic layer becoming central to how these deployments are built, and identifies cost attribution and utilisation insight as capabilities buyers now expect. Vendors that ignore the economics are expected to lose ground to those that address them.
The shift shows up in how these systems get documented. a href=”https://docs.motadata.com/observeops-docs/”>Ingestion, parsing, enrichment, filtering, and routing to a retention bucketare increasingly written up as discrete configurable stages rather than as fixed platform behaviour. That distinction matters more than it sounds, because it turns retention into a decision an operations team owns rather than a setting it inherits.
For a CIO reviewing this before the next budget cycle, three questions surface the answer quickly.
What proportion of ingested log data was queried in the last ninety days? Most teams have never measured this, and the number is usually lower than anyone expects.
What would break if debug-level output from stable services expired after seven days instead of ninety? If nobody can name a specific consequence, the current policy is a default rather than a decision.
Can a single log line be routed to different retention depending on what it contains? If every log receives identical treatment regardless of origin or severity, the organisation is paying premium rates on data it will never open.
AI Workloads Compress the Timeline
This would be a manageable problem on its own schedule. It is not going to get one.
Gartner forecasts end-user public cloud spending in India at $17.5 billion in 2026, up 28.1 per cent, with demand for AI-ready infrastructure named as the driver. Inference endpoints, model serving, vector stores, and agent frameworks all generate telemetry, and they generate it on top of estates that were already producing more than their owners were reading.
Cost curves steepen faster than governance catches up. Teams that have not sorted out their retention discipline before AI workloads scale will be sorting it out afterwards, at a higher volume and under more pressure.
What Changes in the Next Budget Cycle
The shift I would argue for is modest in language and significant in practice. Observability stops being a line item that grows with headcount and infrastructure, and becomes a governed pipeline with owners, tiers, and an audit trail.
That means cost tracked per service rather than in aggregate. It means retention tiers matched to what each class of data is actually used for, with security and compliance data treated differently from application debug output. It means a documented answer to a simple question asked of every stream: who reads this, how often, and what happens if we stop keeping it.
None of that is austerity. An organisation that knows what its telemetry costs and what it returns will usually spend more confidently on the parts that matter, because it has stopped subsidising the parts that do not.
The teams under pressure right now are not the ones spending heavily on visibility. They are the ones spending heavily without knowing what they are buying.
