Log Retention Storage Cost Calculator

A practical retention policy (by log class)

• Access/ingress logs: 7-14 days hot retention (high volume, mostly operational value).
• Application logs: 14-30 days (enough for incident timelines).
• Audit/security logs: 90-365 days (compliance-driven; keep volume controlled).

If you need long-term retention, consider moving cold logs to cheaper storage and keeping only a small hot window indexed/searchable.

How to get your inputs

• GB/day: use ingestion metrics per log source; avoid blended averages.
• Retention days: confirm settings per log group or table; defaults often drift.
• Stored GB billing: check whether your vendor bills on ingested or stored size.
• Seasonality: if volume changes by week or month, model separate scenarios.

Result interpretation

• Retention days multiply GB/day; storage grows linearly with retention.
• High-volume sources should have shorter hot retention.

Common mistakes

• Using blended GB/day and missing the top noisy sources.
• Applying a single retention policy to all log types.
• Assuming stored GB equals ingested GB (compression varies).

Scenario planning

Validate after changes

• Validate measured ingestion (GB/day) for your top sources, not a blended average.
• Validate retention settings per table/source (defaults often drift).
• Validate what the vendor bills as stored GB (compressed size vs ingested size differs by provider).