<b>When sampling logs is fine — and when it lies</b>

<b>When sampling logs is fine — and when it lies</b>

High-traffic sites can't grep 40GB a day. These references cover sampling without fooling yourself.

→ The classic reservoir sampling write-up (Knuth, Vol. 2) — uniform random sample in one pass, constant memory.
Takeaway: the math behind 'pick N lines fairly'.

⭐ Pick of the week: Honeycomb's engineering posts on dynamic/head-based sampling — keep all errors, sample the boring 200s.
Takeaway: never sample your rare events away. Bot hits and 5xx are rare; keep them whole.

→ Elastic's docs on sampling in ingest pipelines — practical knobs for log volume.

→ Datadog's 'log sampling' guide — clear on retention vs cost tradeoffs.

Credit to Honeycomb, Elastic, and Datadog for documenting the failure modes most people learn the hard way.