Log Cost Guide (ingestion, retention, search)

Most log platforms charge for ingestion (GB ingested), retention (stored GB-month), and sometimes scan/search (GB scanned by queries). If your bill surprised you, it's usually because volume, retention, or query behavior drifted upward.

1) Separate ingestion from storage

  • Ingestion: GB/day x price per GB x days/month.
  • Retention storage: (GB/day x retention days) x $/GB-month (steady state).

If you want the intuition behind the storage model, read log retention storage cost.

2) Estimate your inputs (GB/day and retention)

  • If you have a provider export, use it directly (best).
  • If you don't, estimate GB/day from events/sec and bytes/event. Guide: estimate log ingestion (GB/day).
  • Pick retention intentionally: hot troubleshooting window (7-14 days) plus longer cold/archive if required.

3) Include scan/search if your platform charges for it

Some products charge by GB scanned. Scan costs often spike during incidents or when dashboards run broad queries repeatedly. If you're on a per-scan model, estimate scanned GB/day and price it.

For CloudWatch Logs Insights specifically, read Logs Insights pricing.

4) The knobs that usually matter most

  • Reduce volume: drop or sample high-volume debug logs.
  • Shorten retention: keep low-value logs for fewer days; tier hot vs cold.
  • Query smarter: narrow time ranges and filter early to reduce scanned GB.

Tools

Log cost calculator Log ingestion cost Log retention storage Log scan/search cost CloudWatch Logs pricing

More log cost guides

API Gateway access logs cost: how to estimate ingestion and retention
A practical guide to estimate API Gateway access logs cost: estimate average bytes per request, convert to GB/day, model retention (GB-month), and reduce log spend safely.
API Gateway cost optimization: reduce requests, bytes, and log spend
A practical playbook to reduce API Gateway spend: identify the dominant driver (requests, transfer, or logs), then apply high-leverage fixes with a validation checklist.
API Gateway vs ALB vs CloudFront cost: what to compare (requests, transfer, add-ons)
A practical cost comparison of API Gateway, Application Load Balancer (ALB), and CloudFront. Compare request pricing, data transfer, caching impact, WAF, logs, and the hidden line items that change the answer.
AWS CloudTrail Pricing & Cost Guide
CloudTrail cost model for management vs data events, Lake vs S3 logs, and pricing drivers with estimation steps.
AWS CloudWatch Metrics Pricing & Cost Guide
CloudWatch metrics cost model: custom metrics, API requests, dashboards, and retention.
AWS cost checklist: model the drivers that actually move the bill
A practical AWS cost checklist for planning and reviews: define scope, identify top cost drivers (requests, GB, GB-month, hours), and avoid the common blind spots (data transfer, logs, and cross-AZ).
AWS Fargate pricing (cost model + pricing calculator)
A practical Fargate pricing guide and calculator companion: what drives compute cost (vCPU-hours + GB-hours), how to estimate average running tasks, and the non-compute line items that usually matter (logs, load balancers, data transfer).
AWS Lambda cost optimization (high-leverage fixes)
A practical Lambda cost optimization checklist: reduce GB-seconds (duration × memory), control retries, right-size concurrency, and avoid hidden logging and networking costs.
AWS Lambda pricing (what to include)
A practical checklist for estimating AWS Lambda-style costs: requests, duration × memory (GB-seconds), provisioned concurrency when used, logs, and common hidden line items.
AWS WAF vs Cloudflare WAF cost: a practical comparison checklist
Compare AWS WAF vs Cloudflare WAF cost using a practical checklist: request-based charges, rule/policy baselines, logging/analytics costs, and what to model for your traffic shape.
Azure API Management pricing: model requests, transfer, and log volume
A practical API Management estimate: request volume, response transfer, and logs/observability. Includes a checklist to validate retries, payload size, and usage tiers.
Azure Application Gateway pricing: how to model L7 load balancer costs
Model Application Gateway costs using measurable drivers: hours, request volume, traffic processed, WAF, and logs - plus a validation checklist.

Related guides

Log retention storage cost: steady-state GB-month explained
How log retention turns GB/day into stored GB-month cost. Learn the steady-state model, retention tiers, and the fastest levers to reduce long-term log spend.
Azure Log Analytics pricing: ingestion, retention, and query costs
A practical model for Log Analytics-style costs: GB ingested, retention storage, and query/scan behavior. Includes a method to estimate log GB from event rate and payload size, plus a validation checklist for high-volume sources.
Estimate log ingestion volume (GB/day): fast methods + validation
How to estimate log ingestion volume in GB/day from billing exports, from events/sec × bytes/event, or from throughput. Includes common pitfalls (duplicates, verbose debug logs, multiline events) and next steps to convert volume into dollars.
API Gateway access logs cost: how to estimate ingestion and retention
A practical guide to estimate API Gateway access logs cost: estimate average bytes per request, convert to GB/day, model retention (GB-month), and reduce log spend safely.
Cloud Logging pricing (GCP): ingestion, retention, and query scans
A practical model for Cloud Logging costs: GB ingested, retention storage (GB-month), and query/scan behavior. Includes a fast method to estimate GB/day from events/sec × bytes/event and a checklist to find dominant sources.
CloudWatch Logs pricing: ingestion, retention, and queries
A practical CloudWatch Logs pricing guide: model ingestion (GB/day), retention (GB-month), and query/scan costs (Insights/Athena). Includes pitfalls and a validation checklist.

Related calculators

Log Cost Calculator
Estimate total log costs: ingestion, storage, and scan/search.
Log Ingestion Cost Calculator
Estimate monthly log ingestion cost from GB/day or from event rate and $/GB pricing.
Log Retention Storage Cost Calculator
Estimate retained log storage cost from GB/day, retention days, and $/GB-month pricing.
Log Search Scan Cost Calculator
Estimate monthly scan charges from GB scanned per day and $/GB pricing.

FAQ

What are the main drivers of log cost?
Most platforms bill for ingestion volume (GB ingested) and retention/storage (GB-month). Some also charge for query scan/search (GB scanned).
Why does retention cost grow even if ingestion is flat?
Because storage is billed per GB-month. In steady state, retained dataset size is roughly GB/day times retention days.
What's the fastest way to reduce log spend?
Reduce noisy logs at source (drop/sampling), shorten hot retention for low-value logs, and avoid expensive broad scans by narrowing queries and time ranges.
Last updated: 2026-02-23