Azure Log Analytics cost optimization: ingest less, not just retain less

Quick answer

Log Analytics bills mostly on ingestion (~$2.30/GB Pay-As-You-Go) plus retention beyond 31 days (~$0.10/GB-month). The bill is driven by how much you ingest, not how long you keep it. Cut it by filtering logs at the source, routing high-volume low-value tables to Basic Logs (~$0.65/GB), using commitment tiers for steady high ingestion, and tuning Container Insights on AKS.

Log Analytics is the meter behind Azure Monitor, Sentinel, and Container Insights, and its cost is almost entirely a function of one number: GB ingested. At ~$2.30/GB, the difference between thoughtful and firehose-everything logging is the difference between a modest bill and a runaway one. Optimization is mostly about ingesting less.

What you pay for

Ingestion: ~$2.30/GB Pay-As-You-Go — the dominant cost. Everything sent to the workspace counts.
Retention: first 31 days included, then ~$0.10/GB-month; an archive tier is ~$0.025/GB-month.
Commitment tiers: discounted ingestion if you commit to a daily volume.
Basic Logs: ~$0.65/GB for query-limited, high-volume tables.

Ingest less, not just retain less

Because ingestion dominates, the biggest savings come before data lands:

Filter at the source. Don't send debug-level logs and chatty diagnostic categories you'll never query. Diagnostic settings and data collection rules let you select what flows in.
Route low-value tables to Basic Logs. Verbose telemetry you rarely query interactively ingests at ~$0.65/GB instead of $2.30.
Tune Container Insights. A busy AKS cluster can push 5-20 GB/day; adjust collection settings to drop noisy namespaces and high-cardinality metrics. This ties straight into AKS cost.

Then optimize the rest

Commitment tiers for steady ingestion above ~100 GB/day — up to ~30% off.
Table-level retention so cheap, low-value data isn't kept at full retention price.
Archive compliance data you must keep but rarely query.

The same logging-cost discipline applies on AWS — see CloudWatch Logs cost optimization.

FAQ

How is Azure Log Analytics priced?

Mainly by data ingestion at the Pay-As-You-Go rate of about $2.30/GB, plus retention (the first 31 days are included, then ~$0.10/GB-month, with an archive tier around $0.025/GB-month). Commitment tiers discount ingestion if you pre-commit to a daily volume, and the Basic Logs table tier ingests at a much lower rate for query-limited data.

Why is my Log Analytics bill so high?

Ingestion volume — almost always. At $2.30/GB, verbose application logs, Container Insights from busy AKS clusters, and diagnostic settings firehosing everything add up fast. A 10-node AKS cluster alone can generate 5-20 GB/day. The fix is ingesting less, not retaining less.

What are commitment tiers and do they save money?

Commitment tiers let you pre-commit to a daily ingestion volume (100 GB/day, 200 GB/day, etc.) at a discounted per-GB rate versus Pay-As-You-Go, climbing toward ~30% off at high volumes. If your ingestion is steady and above ~100 GB/day, a commitment tier is a straightforward saving.

What is the Basic Logs tier?

Basic Logs ingests at a much lower per-GB rate (around $0.65/GB) for high-volume tables you rarely query interactively — verbose telemetry, debug logs. The trade-off is limited query capabilities and shorter interactive retention. Routing chatty, low-value tables to Basic Logs cuts ingestion cost substantially.

How do I reduce Log Analytics costs?

Filter ingestion at the source (don't send debug logs you'll never read), route high-volume low-value tables to Basic Logs, use commitment tiers for steady high ingestion, set table-level retention so cheap data isn't kept at full price, archive old data, and tune Container Insights collection on AKS.

How does C3X estimate Log Analytics cost?

C3X prices an azurerm_log_analytics_workspace at the Pay-As-You-Go ingestion rate and models ingestion volume as usage, so a workspace's projected monthly cost — driven by GB ingested — is visible before deployment.

What to do next

Ingestion volume is the lever, and it's worth forecasting before a workspace goes live. C3X prices an azurerm_log_analytics_workspace at the Pay-As-You-Go rate and models ingestion as usage, so a workspace's projected cost is visible up front. The quickstart runs it in minutes.