Log routing is the practice of sending different data streams to different destinations based on value, retention need, or processing urgency. Security teams use it to balance cost and speed, such as sending high-value logs to hot storage and lower-value logs to cheaper storage for later analysis.
Expanded Definition
Log routing is the policy-driven distribution of security and operational logs to different destinations so each stream receives the right balance of speed, retention, and cost. In practice, this means separating high-value telemetry, such as authentication events, privilege use, and detection alerts, from lower-priority data that can tolerate slower retrieval or cheaper storage. For security teams, the concept sits at the intersection of logging architecture, data governance, and incident response readiness.
Definitions are usually consistent across practice, but implementation guidance varies by platform and by retention obligations. Some environments route logs directly into a SIEM, while others send them first to a queue, data lake, or archival store before selective forwarding. NIST’s NIST Cybersecurity Framework 2.0 is useful here because it frames logging as part of broader governance, monitoring, and recovery outcomes rather than a single tool choice.
The most common misapplication is treating log routing as a pure storage optimisation, which occurs when teams move security-critical logs away from searchable destinations before defining detection, investigation, and retention requirements.
Examples and Use Cases
Implementing log routing rigorously often introduces routing complexity and operational overhead, requiring organisations to weigh faster investigations against storage cost and pipeline maintenance.
- Authentication and privilege logs are routed to high-speed searchable storage so analysts can investigate account misuse quickly, while routine application logs are retained in lower-cost archives.
- Cloud control plane events are forwarded to a central SIEM for correlation, then duplicated to immutable storage for longer retention and audit support.
- Endpoint and EDR telemetry is routed differently from business application logs because detection workflows need rapid access to alert-enriched data, not every event at equal priority.
- In regulated environments, payment or identity events may be split so that operational monitoring, compliance retention, and forensic reconstruction each receive the format and retention window they require.
- For high-volume platforms, logs from ephemeral services are filtered, enriched, and routed through a queue before landing in a data lake, reducing ingestion spikes and preventing downstream overload.
When teams are designing routing rules for cloud telemetry, the distinction between collection and destination matters. Guidance from the NIST Cybersecurity Framework 2.0 helps teams connect these choices to monitoring outcomes instead of treating every log stream identically.
Why It Matters for Security Teams
Log routing affects what defenders can see, how fast they can see it, and how long evidence remains usable. Poorly designed routing can create blind spots, hide signal in low-value noise, or push critical events into storage tiers that are too slow for incident response. Overly aggressive filtering can also break investigations by discarding context that would have linked an alert to a broader attack path. For identity-heavy environments, routing is especially important because authentication, privilege elevation, and service-account activity often provide the earliest indicators of compromise.
For NHI and agentic AI environments, the issue becomes more pronounced because service tokens, workload identities, and tool-use logs may be distributed across multiple systems. If those records are not routed consistently, security teams lose the ability to reconstruct which identity acted, which system granted access, and which action was executed. The practical challenge is not just retention, but preserving evidence in a form that supports correlation across identity, cloud, and application layers.
Organisations typically encounter the consequences only after an incident review reveals missing or delayed telemetry, at which point log routing becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 | CSF monitoring outcomes depend on logs being routed to usable detection destinations. |
Route high-value telemetry to destinations that support continuous monitoring and timely alerting.
