qryn is solid and very affordable because you self-host. it supports DD vectors out of the box. /dev/null is always a strong contender too.
Note: in qryn s3/r2 are as close to /dev/null as it gets!
The notion that every single log or metric across your entire technical architecture is worth keeping is one implanted by SaaS providers with a financial interest in naive engineers doing just that.
We have concepts of debug, info, warn and error… but I think we need apps to be developed with the concept of log concern.
For example take sshd. For infosec they are interested in IP of failed attempts, operations might want to know connection failures, etc.