In order to avoid possibly incurring extra charges, please implement a configurable data limit (with alerts) that any one server or group of servers can intake for AppLogs. This will prevent sudden log explosions from incurring extra charges (or being unexpectedly cut off) when they get pulled into AppLogs.
Thank you.