Navigate to Logs > Configuration > Indexes in the Datadog UI and select the index you want to manage
Click Add Exclusion Filter, give it a descriptive name, and write a log query using the same syntax as the Log Explorer search bar (e.g., service:nginx status:info) to target the log pattern to suppress
Set an exclusion percentage (0–100%) for the filter; logs matching the filter are excluded from indexing at that rate while still flowing through Livetail and archives
Set a temporary exclusion percentage of 100% to completely stop indexing a noisy log source immediately; reduce the percentage once the source is fixed or better filtered upstream
Evaluate the estimated volume impact of each filter in the Estimated Daily Indexed Logs panel before enabling, to forecast cost savings
For cost reduction at ingestion (not just indexing), configure the Datadog Observability Pipelines agent or your log shipper to drop or sample logs before they reach Datadog entirely
Known gotchas
Exclusion filters reduce indexing costs but not ingestion costs; logs still count toward ingested bytes and can be archived — to reduce ingestion cost, filter at the log shipper level before sending to Datadog
Excluded logs are not searchable in Log Explorer but can still be rehydrated from archives if an archive is configured; the archive and exclusion filter pipelines are independent
Filter order matters: Datadog evaluates exclusion filters from top to bottom and stops at the first match; place more specific filters above broader ones to avoid unintended exclusion
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp