Sources

Every value is editable

Source type	Origin	Units	EPS / unit	Bytes / event	GB / day

Pipeline

What you drop before it lands

Reduction %

Dropped or trimmed in transit. Typical 20–60%.

To hot SIEM %

Remainder lands in archive or a lake.

Peak multiplier

Burst over average. Sizes links, not cost.

Destination

Where it lands, for how long

Deployment model

Collectors on site, SIEM in cloud. Bandwidth, buffering and egress all apply.

Hot retention · days

Archive · days

Hot storage factor

Indexed size vs raw.

Archive factor

Compressed, no index.

Outage buffer · hours

Local disk to survive a WAN break.

EPS per collector

Sustained, per forwarder.

Prices

EUR

Hot ingest / GB

Convert credit or SVC pricing to an effective rate first.

Hot retention / GB / mo

Zero if bundled into ingest.

Archive / GB / mo

Cloud egress / GB

Only on cloud-origin logs leaving that cloud. Sending on-prem logs up is free.

Raw at source—

Hot SIEMArchiveDropped

Average EPS

—

Peak EPS

—

Ingested

— GB/day

Run rate

—/yr

Capacity & transport

Hot tier at full retention—

Archive at full retention—

Uplink, peak—

Collector buffer disk—

Collectors at peak—

Monthly cost

Hot ingest—

Hot retention—

Archive storage—

Cloud egress—

Total per month—

If you dropped nothing—

Saved by filtering—

Planning figures, not a quote. Bytes per event decides everything downstream and swings by an order of magnitude between estates. Sample seven days of real traffic per source type before you sign anything.