Helix bills primarily on ingest volume. A handful of self-service queries turn a surprising invoice into a predictable, service-attributable line item.

The first time a Helix invoice jumps noticeably, the natural question is which team caused it, and the natural answer, guessing from memory which service shipped a big feature that month, is almost always wrong. The platform meters its own ingest volume, and that metering is queryable the same way any other signal is.

1. Break ingest volume down by service

Every signal carries its own byte-size metadata internally. Summing it grouped by service turns a vague monthly total into an attributable list.

from usage
| where signal_type == "traces"
| summarize sum(bytes_ingested) by service.name
| sort by sum(bytes_ingested) desc
| limit 10

2. Break it down again by signal type

A service can be expensive for very different reasons, a chatty logging habit versus an unusually high trace volume versus a wide, high-cardinality metric set. The fix differs completely depending on which one it is, so do not stop at the service-level total.

from usage
| where service.name == "checkout-api"
| summarize sum(bytes_ingested) by signal_type
| sort by sum(bytes_ingested) desc

3. Track the trend, not just the current snapshot

A single point-in-time cost query answers "who is expensive right now" but misses a slow, steady climb that will matter far more by the end of the quarter than any single day's number.

from usage
| summarize sum(bytes_ingested) by bin(timestamp, 1d), service.name
| where service.name == "checkout-api"
| sort by timestamp asc

4. Set a budget alert the same way you would for latency

Cost is a metric like any other in Helix, and it takes the same alerting mechanics as a latency SLO does, a threshold and a burn rate, just measured in bytes instead of milliseconds.

ALERT checkout_api_ingest_budget
WHEN sum(bytes_ingested) by service.name == "checkout-api" over 1d > 50GB
NOTIFY slack:payments-team
  • Query ingest volume by service before assuming which team caused an invoice jump.
  • Break it down further by signal type, the fix differs between logs, traces, and metrics.
  • Track the trend over weeks, not just a single snapshot, to catch a slow climb early.
  • Set a cost budget alert with the same mechanics as any latency or error-rate alert.