CloudWatch Logs Cost Calculator

CloudWatch-specific gotchas

• Subscription filters / exports: forwarding logs to another system can create a second ingestion bill.
• Dashboards and alerts: frequent refresh + wide windows can multiply Insights scan volume.
• Retention drift: log groups often default to "never expire" unless explicitly set.

How to get your inputs

• GB/day ingested: use CloudWatch usage metrics or billing exports for the top log groups.
• Retention days: read the retention policy for each log group (defaults often drift).
• Insights scan GB: estimate from query history (range length x data scanned per query).
• Billing days: use 30 or 31 days, or 730 hours if you model monthly hours elsewhere.

Result interpretation

• If ingestion dominates, reduce verbose logs or drop noisy sources at ingest.
• If retention dominates, shorten retention or move cold logs to cheaper storage.
• If scans dominate, narrow Insights queries and reduce dashboard refresh frequency.

Common mistakes

• Assuming default retention is set (many groups stay "never expire").
• Leaving dashboards to scan wide windows at high frequency.
• Mixing ingestion and scan costs into one blended GB number.

Scenario planning

Validate after changes

• Validate ingestion GB/day for your largest log groups (ingress, API, audit).
• Validate retention days per log group and ensure defaults are not "forever".
• Validate Insights scanned bytes for dashboards/alerts (query frequency matters as much as window size).