Less noise, more signal: How Elastic Defend slashed event volume