aws_cloudwatch_log_metric_filter cost estimation
A metric filter is free. It scans log events for a pattern and emits a CloudWatch metric, and cost sits on the log group and the metric or alarm it feeds.
An aws_cloudwatch_log_metric_filter watches a log group for a pattern (an error string, an HTTP status, a JSON field) and increments a CloudWatch metric each time it matches. The filter itself is free: AWS does not charge for defining it or for evaluating log events against it. It is a free way to turn log text into a numeric metric you can alarm on.
The cost sits around it, not in it. The log group being filtered is billed for ingestion (about $0.50/GB) and storage regardless of the filter. The metric the filter emits can be a cost: the first metrics are free, but custom metrics are billed at about $0.30 per metric per month, and a metric filter that uses a high-cardinality dimension can create many metrics and multiply that charge. Any alarm you attach to the emitted metric adds about $0.10 per alarm per month. None of that is the filter; it is the metric and alarm the filter produces.
The optimization is to keep emitted metrics low-cardinality and to alarm on what matters. A single named metric per filter is cheap; a filter that dimensions on request ID or user ID is not. c3x prices the log group ingestion, the custom metrics a filter emits, and the alarms attached to them, and treats the metric filter definition as the free rule it is.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "aws_cloudwatch_log_metric_filter" "errors" {
name = "app-error-count"
log_group_name = aws_cloudwatch_log_group.app.name
pattern = "ERROR"
metric_transformation {
name = "AppErrorCount"
namespace = "App/Prod"
value = "1"
}
}Pricing dimensions
What you actually pay for when you provision aws_cloudwatch_log_metric_filter.
| Dimension | Unit | What's being charged |
|---|---|---|
| Metric filter | free | Defining a metric filter and evaluating log events against it has no charge. $0 |
| Emitted custom metric | per metric-month | The metric the filter creates is billed as a custom CloudWatch metric beyond the free tier. ~$0.30/month per metric |
| Alarm on the metric | per alarm-month | Any CloudWatch alarm attached to the emitted metric carries a monthly charge. ~$0.10/month per alarm |
Optimization tips
Common ways to reduce aws_cloudwatch_log_metric_filter cost without changing the workload.
Keep emitted metrics low-cardinality
Avoids metric-count multiplicationA filter that dimensions on request ID or user ID creates a separate custom metric per value, each billed monthly. Emit one named metric per filter to stay near the free tier.
Reuse one metric across environments with dimensions sparingly
Prefer a small fixed set of dimensions (environment, service) over unbounded ones. Fewer distinct metrics means less monthly custom-metric cost.
Alarm on the filter metric, do not poll logs
A metric filter plus one alarm is far cheaper than scheduled Logs Insights queries scanning the same data repeatedly, and it reacts in near real time.
FAQ
Does a CloudWatch metric filter cost money?
No. Defining a metric filter and evaluating log events against it is free. Cost comes from the log group's ingestion and from the custom metric the filter emits (about $0.30/metric/month) plus any alarm on it.
Why did my metric filter increase my CloudWatch bill?
Almost always because it emits a high-cardinality custom metric. If the metric_transformation dimensions on something unbounded like request ID, each value becomes a separate billed metric. Keep filters to one low-cardinality metric.
Is a metric filter cheaper than Logs Insights queries?
For ongoing monitoring, yes. A filter plus alarm is a fixed low monthly cost and reacts in near real time, while repeatedly running Logs Insights queries scans the same ingested data and bills per GB scanned.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including aws_cloudwatch_log_metric_filter.