---
title: Sample Processor
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Observability Pipelines > Processors > Sample Processor
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Sample Processor

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}
Available for:
{% icon name="icon-logs" /%}
 Logs | 
{% icon name="icon-apm" /%}
 Traces 
## Overview{% #overview %}

This processor samples your logs or traces (Contact your account manager to request access.) for a representative subset at the rate that you define, dropping the remaining events. As an example, you can use this processor to sample 20% of events from a noisy non-critical service.

The sampling only applies to events that match your filter query and does not impact other events. If an event is dropped at this processor, the event is not sent to subsequent processors.

## Setup{% #setup %}

To set up the sample processor:

1. Define a filter query. See [Logs Search Syntax](https://docs.datadoghq.com/observability_pipelines/search_syntax/logs.md) or [APM Query Syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax.md) for more information.
   - Only events that match the specified filter query are sampled at the specified retention rate.
   - The sampled events and the events that do not match the filter query are sent to the next step in the pipeline.
1. Enter your desired sampling rate in the Retain field. For example, entering `2` means 2% of events are retained out of all events that match the filter query.
1. Optionally, enter a Group By field to create separate sampling groups for each unique value for that field. For example, `status:error` and `status:info` are two unique field values. Each bucket of events with the same field is sampled independently. Click Add Field if you want to add more fields to partition by. See the group-by example.

### Group-by example{% #group-by-example %}

If you have the following setup for the sample processor:

- Filter query: `env:staging`
- Retain: `40%` of matching events
- Group by: `status` and `service`

{% image
   source="https://docs.dd-static.net/images/observability_pipelines/processors/group-by-example-service.30d747b8f176f71d95e79d9b8cb16958.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/observability_pipelines/processors/group-by-example-service.30d747b8f176f71d95e79d9b8cb16958.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="The sample processor with example values" /%}

Then, 40% of events for each unique combination of `status` and `service` from `env:staging` is retained. For example:

- 40% of events with `status:info` and `service:networks` are retained.
- 40% of events with `status:info` and `service:core-web` are retained.
- 40% of events with `status:error` and `service:networks` are retained.
- 40% of events with `status:error` and `service:core-web` are retained.