AWSAmazon CloudWatchMonitoring

`aws_cloudwatch_log_metric_filter` cost estimation

A metric filter is free. It scans log events for a pattern and emits a CloudWatch metric, and cost sits on the log group and the metric or alarm it feeds.

An aws_cloudwatch_log_metric_filter watches a log group for a pattern (an error string, an HTTP status, a JSON field) and increments a CloudWatch metric each time it matches. The filter itself is free: AWS does not charge for defining it or for evaluating log events against it. It is a free way to turn log text into a numeric metric you can alarm on.

The cost sits around it, not in it. The log group being filtered is billed for ingestion (about $0.50/GB) and storage regardless of the filter. The metric the filter emits can be a cost: the first metrics are free, but custom metrics are billed at about $0.30 per metric per month, and a metric filter that uses a high-cardinality dimension can create many metrics and multiply that charge. Any alarm you attach to the emitted metric adds about $0.10 per alarm per month. None of that is the filter; it is the metric and alarm the filter produces.

The optimization is to keep emitted metrics low-cardinality and to alarm on what matters. A single named metric per filter is cheap; a filter that dimensions on request ID or user ID is not. c3x prices the log group ingestion, the custom metrics a filter emits, and the alarms attached to them, and treats the metric filter definition as the free rule it is.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_cloudwatch_log_metric_filter" "errors" {
  name           = "app-error-count"
  log_group_name = aws_cloudwatch_log_group.app.name
  pattern        = "ERROR"

  metric_transformation {
    name      = "AppErrorCount"
    namespace = "App/Prod"
    value     = "1"
  }
}

Pricing dimensions

What you actually pay for when you provision aws_cloudwatch_log_metric_filter.

Dimension	Unit	What's being charged
Metric filter	free	Defining a metric filter and evaluating log events against it has no charge. $0
Emitted custom metric	per metric-month	The metric the filter creates is billed as a custom CloudWatch metric beyond the free tier. ~$0.30/month per metric
Alarm on the metric	per alarm-month	Any CloudWatch alarm attached to the emitted metric carries a monthly charge. ~$0.10/month per alarm

Optimization tips

Common ways to reduce aws_cloudwatch_log_metric_filter cost without changing the workload.

Keep emitted metrics low-cardinality

Avoids metric-count multiplication

A filter that dimensions on request ID or user ID creates a separate custom metric per value, each billed monthly. Emit one named metric per filter to stay near the free tier.

Reuse one metric across environments with dimensions sparingly

Prefer a small fixed set of dimensions (environment, service) over unbounded ones. Fewer distinct metrics means less monthly custom-metric cost.

Alarm on the filter metric, do not poll logs

A metric filter plus one alarm is far cheaper than scheduled Logs Insights queries scanning the same data repeatedly, and it reacts in near real time.

FAQ

Does a CloudWatch metric filter cost money?

No. Defining a metric filter and evaluating log events against it is free. Cost comes from the log group's ingestion and from the custom metric the filter emits (about $0.30/metric/month) plus any alarm on it.

Why did my metric filter increase my CloudWatch bill?

Almost always because it emits a high-cardinality custom metric. If the metric_transformation dimensions on something unbounded like request ID, each value becomes a separate billed metric. Keep filters to one low-cardinality metric.

Is a metric filter cheaper than Logs Insights queries?

For ongoing monitoring, yes. A filter plus alarm is a fixed low monthly cost and reacts in near real time, while repeatedly running Logs Insights queries scans the same ingested data and bills per GB scanned.