CloudWatch Logs pricing and cost calculator

A log group is billed on three things. Ingestion: every GB of log data sent in, at $0.50 per GB for custom logs in the Standard class in US East (N. Virginia). Storage: the logs you keep, per GB-month of compressed data, at $0.03. Queries: each Logs Insights query, per GB of data it scans, at $0.005. Data transfer into CloudWatch is not charged; the ingestion price is the charge for sending logs.

Vended logs are logs that AWS services deliver for you, such as VPC Flow Logs. They are priced in volume tiers that reset at the start of every month: $0.50 per GB for the first 10 TB into a Standard log group in US East (N. Virginia), falling to $0.05 over 50 TB. Tiers are counted per destination. Custom logs have one flat rate.

Storage is billed on compressed size. AWS's pricing page quotes a 0.15 compression ratio, which is the calculator's default (15% of the raw size). Logs that compress poorly, such as already-compressed or random data, cost more to store. To check your own ratio, compare a log group's stored bytes with the IncomingBytes metric summed over its retention period.

Why ingestion usually dominates. In US East (N. Virginia), a GB of custom logs costs $0.50 to ingest into a Standard log group. At the 15% ratio it then costs $0.0045 a month to store, so storage only catches up with the ingestion charge after about 111 months. Even with no compression at all, a year of storage ($0.36 per GB) costs less than ingesting that GB.

Retention. By default CloudWatch Logs keeps log data indefinitely, shown as "Never expire". You can set each log group to keep logs from 1 day to 10 years. Log events past the retention setting stop adding to storage charges, even before they are deleted. A log group that has run longer than its retention holds about one retention period of logs, and that is what the calculator prices. A never-expiring group is shown after 36 months; it keeps growing after that.

The two log classes differ in ingestion price only. Infrequent Access costs $0.25 per GB of custom logs in US East (N. Virginia), 50% less than Standard in every region listed here. Storage and Logs Insights are charged the same in both.

In return, Infrequent Access gives up Live Tail, metric filters, subscription filters, anomaly detection, field indexing, Container Insights and Lambda Insights log ingestion, the embedded metric format, and the GetLogEvents and FilterLogEvents APIs. You read its logs with Logs Insights, which supports most query commands, and you can still export them to Amazon S3. It suits logs you query after the fact, such as audit or debug logs, rather than logs that drive alarms.

A log group's class is chosen when the group is created and can't be changed afterwards, so moving existing logs means creating a new group and sending logs there.

The free tier (5 GB of log data a month, worth $2.65 in US East (N. Virginia) as AWS's examples apply it); CloudWatch metrics, alarms and dashboards; Live Tail; data protection; Contributor Insights; extra copies made by log centralization; data transfer out, which is priced like EC2 data transfer out; exports and deliveries to Amazon S3 or Data Firehose and what those services charge; and the services a subscription filter sends logs to. CloudFront, AWS WAF and Elemental MediaTailor logs are priced on those services' own pages. Vended-log tiers are applied to the volume you enter only.

300 GB of application logs and 1,000 GB of VPC Flow Logs a month, kept for 90 days in a Standard log group in US East (N. Virginia), with 200 GB scanned by Logs Insights queries and the 15% compression ratio.

Custom ingestion = 300 GB × $0.50 = $150.00
Vended ingestion = 1,000 GB × $0.50 (first-tier rate) = $500.00
Stored = 1,300 GB × 12 ÷ 365 × 90 days × 15% = 577 GB
Storage = 577 GB × $0.03 = $17.31
Logs Insights = 200 GB × $0.005 = $1.00
Total = $668.31 a month in Standard, $343.31 in Infrequent Access

Ingestion is 97% of this bill. Keeping the same logs for a year instead of 90 days raises storage to $70.20 a month; with Intelligent Tiering on, and old logs left unread, it would be $23.27. With no retention set, storage reaches $210.60 a month after 36 months and keeps rising by $5.85 a month.

• Set a retention policy on every log group. New groups keep logs forever unless told otherwise. Pick the shortest period your audit and debugging needs allow.
• Log less. Ingestion is charged on every GB sent. Keep debug logging out of production, drop repeated lines, and use a compact log format.
• Filter at the source. Have the agent or logging library drop noisy lines before they are sent. Ingestion is charged on the data that reaches CloudWatch.
• Use Infrequent Access for logs you rarely query. Ingestion costs 50% less. Check first that nothing needs Live Tail, metric filters or subscription filters on those logs, because the class can't be changed later.
• Turn on Intelligent Tiering for long retention. It has no extra charge and moves logs nobody reads to storage tiers that cost $0.018 and $0.006 per GB-month in US East (N. Virginia), instead of $0.03.
• Send high-volume vended logs to S3. VPC Flow Logs and other vended logs can be delivered straight to Amazon S3 at $0.25 per GB in the first volume tier in US East (N. Virginia), against $0.50 into a Standard log group. S3 storage and any queries you run there, for example with Athena, are billed separately.
• Narrow your queries. Logs Insights charges for the data scanned, so choose the shortest time range and only the log groups you need.