Log Cost Calculator (ingestion + retention)

1) Ingestion

Start with GB/day ingested for the logs you send to your vendor. If you have multiple log types, model them separately and add them up.

2) Retention storage

Retention is usually what makes log storage costs grow. Long retention multiplies steady-state stored GB.

3) Optional: scan/search

If your provider charges by GB scanned, estimate scan volume for typical daily query workloads.

How to get your inputs

• Volume: start from measured ingestion (GB/day) if you have it, then convert to monthly/retention where needed.
• Estimator: use events/sec x bytes/event when you only have log rates.
• Retention: decide retention days and model steady-state GB-month.
• Queries: model scan/query volume if your tool bills by GB scanned.

Result interpretation

• If retention dominates, shorten retention or move cold logs to cheaper tiers.
• If scans dominate, reduce query frequency and narrow time windows.

Common mistakes

• Modeling ingestion but forgetting retention (GB-month) and scan/query costs.
• Keeping noisy logs forever instead of setting explicit retention tiers.

Advanced inputs to capture

• Estimate GB/day from events/sec and bytes per event.
• Retention days set the storage GB-month baseline.
• Query and scan volume can dominate during incidents.
• Sampling and compression change bytes per event.

Scenario planning

Validate after changes

• Check ingestion GB/day and retention GB-month after changes.
• Check query scan GB and dashboard refresh frequency (common hidden driver).

Next steps