What is the difference between raw logs and aggregated reports?

Think of raw logs as the unedited footage and aggregated reports as the highlight reel. Both come from the same source. They tell very different stories.

Raw logs contain every event exactly as it happened. Subscriber A opened message 1234 at 10:14:03 UTC, from IP 72.14.205.99, using iPhone Mail. One row, one event. These logs can run to millions of rows for active senders, and they're where debugging actually happens. If you're trying to figure out why bounces spiked on Tuesday or why click data looks wrong, raw logs are what you reach for.

Aggregated reports summarize those events into totals: 22% open rate, 3.1% click rate, 0.04% complaint rate. Most ESP dashboards show you this view. It's easier to scan and compare across campaigns, but the detail is gone. You can't answer "which subscribers clicked but didn't convert?" from an aggregated report alone.

The key limitation of aggregated data is that it hides distribution. A 22% open rate could mean 22% of your list opened once, or 5% opened multiple times and 17% opened once. Very different health signals. Cohort analysis requires going back to the raw events.

Another practical difference: data retention. Most ESPs keep raw logs for 30 to 90 days and aggregated metrics much longer. If you need raw data for analysis or compliance, you need to capture it via webhook event feeds or API export before it ages out.

For day-to-day campaign monitoring, aggregated reports are enough. For debugging, segmentation, and anything compliance-related, get the raw logs while you still can.