Log Ingestion Cost Calculator
Most log platforms charge for ingestion. This calculator estimates monthly ingestion volume and cost using either measured GB/day or an event-rate model (events/s x bytes/event). Use a baseline and peak scenario to stress-test log spikes.
Maintained by CloudCostKit Editorial Team. Last updated: 2026-01-29. Editorial policy and methodology.
Best next steps
Use this calculator for the first estimate, then validate the answer with the closest guide or companion tool.
Inputs
Ingest volume (GB / day)
If you have measured ingestion, use it directly.
Avg 4.63 Mbps ingest.
Events per second
Avg bytes per event
Tip: sample real log events to avoid guessing.
Billing days (per month)
Ingest price ($ / GB)
Scenario presets
Results
Estimated monthly ingestion cost
$760.00
Monthly ingestion
1,520 GB
Ingestion rate
50 GB/day
Assumption
0.5 $/GB x 30.4 days
Next line items (do not forget these)
- Retention storage: if you keep 30-365 days, storage can dominate. Use Log retention storage.
- Scan/search: dashboards and alerts that scan broad windows can add a second bill. Use Log scan/search.
Log ingestion starts with event rate times bytes per event
This page should stay focused on the first bill in the logging chain: how much data you emit before retention or search policy even matters. The core math is simple, but the operational failure mode is always the same: teams hide noisy producers inside one blended GB/day average and then lose track of what actually grew.
- Event rate: requests, retries, background jobs, and exporters all add events.
- Bytes per event: structured payloads, stack traces, and verbose modes can expand size quickly.
- Operational truth: incident logging usually increases both event count and payload size at once.
Where ingestion estimates usually break
- One blended GB/day hides the few sources that are actually driving most of the bill.
- Bytes per event is assumed to stay flat even when error payloads or debug fields expand during incidents.
- Retries, timeouts, or looped failures multiply event count without corresponding user traffic growth.
- Launches and migrations are folded into the normal month instead of modeled as separate peaks.
What to capture before trusting the ingestion baseline
- List the largest log sources separately instead of relying on a site-wide average.
- Sample bytes per event from real production payloads, including error paths where practical.
- Separate calm-month operations from verbose incident or deploy windows.
- Remember that reducing ingestion usually improves every downstream logging bill as well.
Baseline vs verbose-mode ingestion scenarios
| Scenario | GB/day | Bytes/event | Drivers |
|---|---|---|---|
| Baseline | Expected | Typical | Normal traffic |
| Peak | High | Verbose | Incident/launch |
How to review the first real ingestion bill
- Compare billed or measured GB/day against the top log sources instead of only the total cluster average.
- Check whether the miss came from event rate growth or bytes-per-event expansion before changing both inputs.
Example scenario
- If you know GB/day, use it directly: monthly GB ~ GB/day x billing days.
- If you only know event rate: GB/day ~ events/s x 86,400 x bytes/event / 1e9 (decimal GB).
Included
- Monthly ingestion volume from GB/day and billing days.
- Ingestion cost from $/GB pricing.
- Optional event-rate conversion to estimate GB/day.
Not included
- Retention storage (use Log Retention Storage calculator).
- Scan/search charges (use Log Search Scan calculator).
- Indexing and vendor-specific add-ons.
How we calculate
- If you have measured ingestion: monthly GB = GB/day x billing days; ingestion cost = monthly GB x $/GB.
- If you estimate from events: GB/day = events/s x 86,400 x bytes/event / 1e9.
- Keep a baseline and a peak scenario (incident traffic and retries often spike logs).
FAQ
Is 1 GB = 1e9 bytes or 1024^3 bytes?
Many vendors bill using decimal GB. This calculator uses decimal GB for the event-rate conversion; if your vendor uses GiB, adjust your bytes/event assumption.
How do I estimate bytes per event?
Sample real events (e.g., 100-1000 lines), measure payload size in bytes, and use an average plus a peak multiplier for verbose logs.
What if I have multiple log sources?
Estimate each source (ingress/access, app logs, audit/security) separately, then add the GB/day totals.
Related tools
Related guides
CloudWatch Logs pricing: ingestion, retention, and queries
A practical CloudWatch Logs pricing guide: model ingestion (GB/day), retention (GB-month), and query/scan costs (Insights/Athena). Includes pitfalls and a validation checklist.
AWS CloudWatch Metrics Pricing & Cost Guide
CloudWatch metrics cost model: custom metrics, API requests, dashboards, and retention.
Cloud cost estimation checklist: build a model Google (and finance) will trust
A practical checklist to estimate cloud cost without missing major line items: requests, compute, storage, logs/metrics, and network transfer. Includes a worksheet template, validation steps, and the most common double-counting traps.
CloudWatch dashboards pricing: what to include (dashboard-month + API)
A practical guide to CloudWatch dashboard costs: dashboard-month charges plus the hidden drivers (metrics API requests, alarms, and high-cardinality metrics).
CloudWatch Logs Insights cost optimization (reduce GB scanned)
A practical playbook to reduce CloudWatch Logs Insights costs: measure GB scanned, fix query patterns, time-bound dashboards, and avoid repeated incident scans.
CloudWatch Logs Insights pricing: what to model (GB scanned)
A practical Logs Insights pricing checklist: the core unit is GB scanned. Model scanned GB from query habits, avoid dashboard re-scan traps, and validate with a measured baseline.
Disclaimer
Educational use only. Not legal, financial, or professional advice. Results are estimates based on the inputs and assumptions shown on this page. Verify pricing and limits with your providers and documentation.
Last updated: 2026-01-29. Reviewed against CloudCostKit methodology and current provider documentation. See the Editorial Policy .