Tocharian — Elastic engineering notesDetection engineering, ES|QL, Splunk migration, and Elasticsearch cluster performance and cost.https://tocharian.euMaking Elasticsearch cheaper without deleting datahttps://tocharian.eu/blog/cheaper-elasticsearch-without-deleting-datahttps://tocharian.eu/blog/cheaper-elasticsearch-without-deleting-dataMost teams cut their Elasticsearch bill by shortening retention, which trades away the reason the cluster exists. Here is the order we work through instead.Fri, 28 Aug 2026 00:00:00 GMTcluster-performancecost