CloudWatch Logs Cost Calculator

CloudWatch-specific gotchas

• Subscription filters / exports: forwarding logs to another system can create a second ingestion bill.
• Dashboards and alerts: frequent refresh + wide windows can multiply Insights scan volume.
• Retention drift: log groups often default to "never expire" unless explicitly set.

CloudWatch Logs is one AWS bill with three moving parts

This page should be read as a CloudWatch-specific logging model: ingestion, retention, and Logs Insights scan behavior. Teams often notice the first line and miss the other two, which is why CloudWatch log cost can feel unpredictable even when ingestion is stable.

• Log groups: the real unit of policy drift in CloudWatch, because retention often varies group by group.
• Retention: defaults and drift create silent cost growth when groups stay on long or infinite retention.
• Insights: query cadence and scan scope create a behavior-driven second bill.

Where CloudWatch log estimates usually drift

• Large log groups are inventoried, but small long-lived groups with bad retention policies are ignored.
• Insights scan activity is treated as occasional debugging even though dashboards may be querying constantly.
• One blended GB/day number hides which log groups are actually driving ingestion growth.
• Default "never expire" retention is assumed to be temporary but remains in place for months.

What to review before trusting the CloudWatch total

• List the highest-volume log groups and verify retention on each one, not only on the largest few.
• Separate ingestion, retention, and Insights scan behavior so you know which lever actually matters.
• Review dashboard refresh cadence and recurring Insights queries before assuming scans are ad hoc only.
• Treat incident-heavy months separately because CloudWatch query behavior changes materially during outages.

Baseline vs scan-heavy CloudWatch scenarios

How to review the first real CloudWatch Logs bill

• Check whether the miss came from ingestion, long-retention groups, or Insights-scanned bytes before changing assumptions.
• Validate retention per log group and review whether recurring dashboards are causing most of the scan behavior.