Every time a service fails, you debug with logs. Those logs are also a revenue stream for your observability vendor, often resold as anonymized market intelligence. The economics are simple: you pay to send data in, you pay to keep it, you pay to read it, and the vendor sells the derived insights to someone else. This is the hidden resale market in your observability bill, and it's growing.

The Hidden Resale Market in Your Observability Bill

Your telemetry is inventory. When you ship logs, traces, and metrics to a vendor, you're not just storing data; you're providing raw material for products the vendor sells to other customers. Traffic patterns reveal peak loads, error rates, and deployment cadences. For a competitor or a market researcher, that's valuable intelligence.

Vendors monetize logs twice. First, you pay for ingestion, usually per gigabyte. Then you pay for storage, per gigabyte per month. Finally, you pay for queries and alerts. But the same logs also feed the vendor's own analytics, often without your explicit consent. The margin on that resale is nearly pure profit, because the data collection is already paid for by your subscription.

You pay for ingestion, then for value. The value you get is debugging your own systems. The value the vendor gets is a broader view of the market. That asymmetry is rarely disclosed in the pricing page. It's buried in the terms of service, if it's mentioned at all.

Margin built on your debugging data is a clever business model, but it's not transparent. Engineers assume their logs are private, but the vendor's contract often grants broad rights to use aggregated data. The next time you see a benchmark report from your observability vendor, consider that your incidents might have contributed to it.

Contracts bury the resale clause. Most teams sign up for a tool without reading the data processing addendum. That's where the resale rights hide. If you're lucky, you can opt out, but the option is usually buried in settings or requires a sales conversation. Few engineers have time for that.

From OpenTelemetry to Opaque Ledger

OpenTelemetry standardized the pipeline. It gave us a common format for traces, metrics, and logs, which lowered the switching cost between vendors. That was supposed to be a win for engineers. In practice, it made the data more portable, but also more valuable to the vendor, because they can now aggregate across customers more easily.

Open source lowered switching costs, but the cloud vendors control the warehouse. Even if you export your telemetry in OpenTelemetry format, you still need a backend to store and query it. Most teams use a managed service, which means the data sits on the vendor's infrastructure, subject to their terms.

Egress fees lock your data in. Moving terabytes of logs out of a cloud provider is expensive, often more than the storage itself. So even if you want to leave, the cost of egress makes you stay. That's a classic lock-in pattern, and the observability vendor benefits because they know you're unlikely to leave.

Logs become a proprietary asset. Once your logs are in the vendor's system, they can be transformed, aggregated, and analyzed in ways that create new products. The vendor might sell anomaly detection models trained on your data, or offer a synthetic monitoring service based on your traffic patterns. You never see a share of that revenue.

The Price of a Debugging Session

Per-GB ingestion pricing scales fast. A typical service generates gigabytes of logs per day. At a rate of a few dollars per gigabyte, that adds up quickly. But the real cost is retention. Most vendors charge more for longer retention, and if you want to keep logs for compliance, you pay a premium.

Retention tiers multiply the cost. Hot storage is expensive, cold storage is cheaper, but you pay to retrieve. If you need to debug an incident from six months ago, you'll pay for the retrieval. That's on top of the ingestion and storage fees.

Queries re-bill your own data. Some vendors charge per query, or per amount of data scanned. A complex debugging session can scan terabytes, and you'll see that reflected in your bill. It's like paying for the privilege of reading your own diary.

Alerts add per-event surcharges. If you set up alerts on your logs, you might pay per alert, or per notification. That's another way to monetize the same data. The vendor gets paid for the data, and then gets paid again when you use it to detect problems.

Billing surprises hit monthly. Many engineers have stories of a bill that was 10x the estimate, usually because of a spike in log volume or a query that scanned too much. The vendor's pricing model encourages you to send less data, but that conflicts with the need to debug effectively.

Who Actually Owns Your Telemetry?

Terms define data usage broadly. Most contracts say something like "we may use your data to improve our services." That's a wide net. It can cover training models, building benchmarks, or even selling anonymized insights to third parties.

Aggregated logs feed vendor products. For example, a vendor might compare your latency percentiles with industry averages, and sell that as a benchmarking product. Your data is in there, anonymized, but still contributing to a product you don't control.

Benchmarks built from your incidents. When you have an outage, the vendor sees it. They can correlate that with other customers' outages to identify common failure patterns. That intelligence is valuable, and it's derived from your data.

Support tickets train their models. If you submit a support ticket, the content might be used to train their AI assistants. That's not just logs, but also your descriptions of problems and solutions. It's a rich dataset.

Opt-outs are buried in settings. Some vendors let you opt out of data sharing, but it's not a simple toggle. You might have to contact support, or sign a specific data processing agreement. Most teams never do it.

The Rise of the Log Data Broker

Vendors resell anonymized traffic patterns. The logs themselves are often too sensitive to sell, but aggregated patterns are not. For example, a vendor might sell a report on how often a particular type of error occurs across industries, or how response times vary by region.

Market intelligence from your outages. If you have a major incident, the vendor might use that data to inform a market report on reliability. That report could be sold to your competitors, giving them insight into your weaknesses.

Third-party data exchanges emerge. There are now data marketplaces where observability vendors can list datasets, and other companies can buy them. Your telemetry might be part of those datasets, anonymized but still valuable.

Compliance gaps in data transfer. When data crosses borders, you might have legal obligations. The vendor might not be as careful as you are. That's a risk you didn't sign up for.

Engineers unknowingly fund competitors. If your competitor buys a market report that includes your traffic patterns, they can adjust their strategy. You're paying for the data that helps them, and you're paying the vendor twice.

Paying Twice: The Real Cost of Convenience

Ingestion fee plus analysis fee. You pay to get data in, and you pay to get insights out. The vendor's margin is your data. The convenience of a managed service is real, but it comes at a hidden cost.

Storage fee plus retrieval fee. You pay to keep logs, and you pay to read them. The vendor's pricing model is designed to maximize revenue from your data, not to minimize your cost of debugging.

Your data drives their AI features. Many vendors are adding AI-powered anomaly detection or log summarization. Those features are trained on your data, and you pay for them. That's a double dip.

You buy back insights you generated. The AI might tell you something about your systems that you didn't see, but the raw data was yours. You're paying for value that was derived from your own telemetry.

Total cost of ownership skyrockets. When you add up all the fees, the cost of observability can be a significant portion of your infrastructure budget. Some estimates put it at 10-20% of cloud spend, and that's before the hidden resale.

Hidden Costs in the Fine Print: A Deeper Dive

Beyond the obvious line items, there are subtler ways your bill grows. Data volume spikes during incidents. When your service is under stress, log volume can increase dramatically, sometimes by an order of magnitude. That means your highest debugging need coincides with your highest ingestion cost. Vendors often price this as a feature, but it's a penalty for being under pressure.

Multi-region replication doubles your data. If you run in multiple regions for resilience, you might be sending the same logs to multiple regional endpoints. That multiplies your ingestion and storage fees, and gives the vendor more copies to aggregate. You might think you're paying for redundancy, but you're also paying for the vendor's broader dataset.

Metadata and labels inflate your bill. Many systems charge based on the number of unique labels or metadata fields. Every deployment tag or environment label adds to the cardinality, and that can increase costs even if the log volume stays flat. It's a hidden tax on good hygiene.

Retention policies are rarely reviewed. Teams set a retention period when they first sign up, and then forget about it. By the time you realize you're paying for two years of logs you never query, you've already spent thousands. A quarterly review of retention can save a surprising amount.

Counterarguments: Is the Resale Actually a Problem?

Some argue that the resale of anonymized data is harmless. If the data is truly anonymized and aggregated, it might not reveal anything specific about your systems. The vendor could argue that they're providing a public good by helping the industry understand reliability patterns.

There's also a case that the resale revenue subsidizes your subscription. If the vendor makes money from data resale, they might be able to offer lower prices on the core product. In a competitive market, that could be a win for you, as long as the data is used responsibly.

But the problem is the lack of transparency. You don't know what data is being resold, to whom, or for what purpose. Even if the resale is benign, the asymmetry of information means you can't make an informed decision. You might be comfortable with your data being used to train a model, but not with it being sold to a competitor. Without disclosure, you can't choose.

There's also the question of re-identification risk. Anonymization is not a guarantee. With enough auxiliary data, even anonymized logs can sometimes be traced back to a specific customer. The more data is aggregated, the higher the risk of accidental exposure. That's a liability you didn't sign up for.

Practical Moves to Reclaim Your Data

Negotiate data use clauses upfront. When you sign a contract, ask for explicit limits on how your data can be used. Many vendors will agree to restrict resale if you ask, because they don't want to lose a large customer.

Self-host storage for sensitive logs. If you have logs that are particularly sensitive, consider storing them in your own object storage, and only send a subset to the vendor. That reduces the data they can resell.

Use egress-friendly providers. Some cloud providers have low or no egress fees, which makes it easier to move data out. That gives you more leverage in negotiations, because you can threaten to leave.

Sample aggressively at the edge. Instead of sending every log, sample at the source. You can keep full logs locally for debugging, and send a representative sample to the vendor. That reduces your cost and the vendor's inventory.

Audit vendor logs for resale terms. Read the data processing addendum. Look for phrases like "aggregated data", "de-identified data", or "service improvement". If you see them, ask for clarification.

Push for transparent data policies. The industry needs more transparency. Ask your vendor to publish a clear policy on how they use customer data. If they don't, that's a red flag.

Consider a hybrid approach. You might keep a small, high-value subset of logs in-house and send the rest to the vendor. That way, you have full control over the most sensitive data, while still getting the benefits of a managed service for the bulk.

None of these moves are free. Self-hosting requires engineering time, and sampling can miss important context. But the alternative is to keep paying twice for data you generated. The trade-off is real, and it's worth having the conversation.