How a rule works
Each project can have up to 100 rules. Squasher checks them in order for each row. The first enabled rule whose signal and conditions match the row decides what happens to it. A row that no rule matches is kept.
AI observations, agent scores, and product events are never changed by ingest rules.
Conditions
Squasher looks up an attribute key in the resource attributes first, then in the attributes of the
log record, span, or metric point. A row without the key does not match. Numbers and booleans are
compared as text.
Attribute patterns use RE2 syntax and can have up to 256 characters. Lookahead, lookbehind,
backreferences, and possessive quantifiers are not supported, so a pattern always runs in linear
time.
Sampling
Asample rule keeps about the sample percent of the rows it matches. The choice is
deterministic:
- Traces: by trace ID, so Squasher keeps or drops a whole trace.
- Logs: by trace ID when the log has one, so logs stay with their trace.
- Metrics: by series, so a series is kept or dropped as a whole.
Error protection
When include errors is off (the default), a rule never drops an error span (statusERROR) or
an error log (severity error or fatal). Squasher counts these rows as matched and kept. Turn on
include errors only when you also want to drop the errors that the rule matches.
When a change applies
Ingest reads the rules of a project with its other ingest settings. A new rule, a change, or a deleted rule applies within about 60 seconds. Rules change only data that arrives after that. Data that Squasher already stored stays.See the saving before you save
The preview shows what a rule would do, and writes nothing:- the rows and bytes that the rule matches over the last 7 days,
- the share of those bytes that it would drop (after sampling and error protection),
- the monthly saving: the telemetry charge it removes, plus an estimate of the storage it saves.
Manage rules from the API, CLI, or MCP
Next steps
Usage and budgets
See the telemetry you use and set a budget.
Ingest rules API
Create, change, order, and preview rules.