AzureAzure Data ExplorerAnalytics

`azurerm_kusto_cluster` cost estimation

A managed analytics engine (Kusto) for fast queries over telemetry and logs. Priced on the underlying VM instances plus an Azure Data Explorer markup per vCPU-hour.

An azurerm_kusto_cluster runs Azure Data Explorer (ADX/Kusto), the engine behind log and time-series analytics in Azure. Its cost is the sum of two things: the compute VMs that make up the cluster, and an ADX markup charged per engine vCPU-hour on top of the VM cost.

The VM cost depends on the SKU (for example a Standard_D11_v2 or Standard_L8s_v3) and the instance count. The ADX markup is roughly $0.11/vCPU-hour across the engine vCPUs. So a 2-node cluster of an 8-vCPU SKU pays for the two VMs plus the markup on 16 vCPUs. Optimized-autoscale can vary the node count, but the estimate reflects the declared baseline.

c3x prices the markup from the engine vCPU count and the underlying instances from the SKU and count, at 730 hours/month. Storage and ingestion to the cluster's data cache are included in the compute; long-term data in attached storage bills separately. ADX clusters can be stopped to halt compute billing, the main cost lever for non-production clusters.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "azurerm_kusto_cluster" "telemetry" {
  name                = "telemetry-adx"
  resource_group_name = azurerm_resource_group.analytics.name
  location            = "eastus"

  sku {
    name     = "Standard_D13_v2"
    capacity = 2
  }
}

Pricing dimensions

What you actually pay for when you provision azurerm_kusto_cluster.

Dimension	Unit	What's being charged
ADX markup	per vCPU-hour	Azure Data Explorer engine markup across all engine vCPUs (vCPU per node x node count). c3x assumes 730 hours/month. $0.11/vCPU-hour
Underlying instances	per instance-hour	The VM SKU running the cluster, billed per node. c3x prices the SKU rate times the instance count. $0.226/hour per D13_v2-class node

Sample C3X output

Example output from c3x estimate (2-node cluster, 8 vCPU each):

azurerm_kusto_cluster.telemetry
├─ ADX markup (16 vCPU)        11,680  vCPU-hours       $1,284.80
└─ Instances (x 2)             1,460  instance-hours     $660.00

OVERALL TOTAL                                          $1,944.80

Optimization tips

Common ways to reduce azurerm_kusto_cluster cost without changing the workload.

Stop non-production clusters when idle

Up to 70%

An ADX cluster can be stopped, halting both the VM and markup charges. Dev/test clusters that only run during work hours save the majority of their cost by being stopped overnight and weekends.

Use optimized autoscale instead of a fixed large cluster

Peak headroom

Optimized autoscale grows and shrinks nodes with load. A small baseline that scales up for peaks beats provisioning peak capacity 24/7.

Pick the right SKU family for the workload

SKU-fit dependent

Compute-optimized, storage-optimized (L-series with local SSD), and isolated SKUs differ in cost and fit. Storage-optimized suits large hot caches; compute-optimized suits query-heavy small data. Matching the family avoids overpaying.

FAQ

How does c3x estimate Azure Data Explorer cost?

It prices the ADX markup per engine vCPU-hour plus the underlying VM instances by SKU and count, at 730 hours/month. The estimate reflects the declared cluster baseline; autoscale variation is runtime behavior.

Why are there two cost components?

ADX runs on Azure VMs and adds a managed-engine markup on top. You pay the VM rate for the nodes and an additional ~$0.11/vCPU-hour markup across the engine vCPUs.

Can I stop the cluster to save money?

Yes. Stopping an ADX cluster halts both VM and markup billing. This is the biggest lever for non-production clusters that don't need to run continuously.

Is data storage included?

The hot data cache is included in compute. Cold data persisted to attached storage bills separately on the storage account. c3x prices the cluster compute; storage is its own resource.

How does this compare to Log Analytics?

Log Analytics bills per GB ingested and is simpler for log collection. ADX is a provisioned cluster better for high-volume, low-latency analytical queries over large datasets. The cost models differ: per-GB versus provisioned compute.