@jacknagz it makes sense that changing which logs you ingest would improve the perf. Do you have a sense for how much this change reduced the total input? Thanks for sharing.