AzureAzure Monitor LogsObservability

`azurerm_log_analytics_workspace` cost estimation

A workspace for ingesting, storing, and querying logs. Pay-As-You-Go by GB ingested, with optional Commitment Tiers for discounts.

An azurerm_log_analytics_workspace is the destination for Azure logs and metrics. Pricing dominates Azure observability bills for log-heavy workloads.

Pricing models:

Pay-As-You-Go: $2.30/GB ingested in cheaper regions. The first 31 days of retention are free; beyond that, $0.10/GB-month storage. Right for variable or unknown log volume.

Commitment Tiers: pre-commit to daily ingest volume for discounts. 100 GB/day commitment is $196/day with $2.31/GB overage; 200 GB/day is $368/day with $2.16/GB overage. Discounts climb to ~28% at very high commitment levels.

Auxiliary logs (Basic Logs tier): $0.65/GB ingested for logs that don't need real-time querying. Limited query capabilities. Right for compliance archives.

Archive tier (after retention): $0.025/GB-month for logs older than the retention setting. Querying archived logs has additional fees.

Practical cost drivers:

Container Insights (logging from AKS): can be huge. A 10-node AKS cluster generates 5-20 GB/day of logs. That's $11-46/day on Pay-As-You-Go, or $330-1,380/month.

Application Insights workspace-based: bills through Log Analytics. Application traces, exceptions, requests all count toward ingest.

Azure Activity Log: free up to default retention. Beyond default, billed.

Sentinel (security analytics on Log Analytics): adds per-GB on top of ingest rates. Significant if enabled.

c3x estimates the workspace with usage data via c3x-usage.yml's monthly_data_ingested_gb. Without usage, the workspace shows $0.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "azurerm_log_analytics_workspace" "main" {
  name                = "production-logs"
  location            = "eastus"
  resource_group_name = azurerm_resource_group.main.name
  sku                 = "PerGB2018"
  retention_in_days   = 30

  daily_quota_gb = 50

  tags = {
    Environment = "production"
  }
}

Pricing dimensions

What you actually pay for when you provision azurerm_log_analytics_workspace.

Dimension	Unit	What's being charged
Pay-As-You-Go ingest	per GB	Standard pricing. First 5 GB/month free at the workspace level. $2.30/GB
Commitment Tier 100 GB/day	per day	Pre-committed ingest with discounted rate. $196/day; $2.31/GB overage
Basic Logs (Auxiliary)	per GB	Logs that don't need real-time querying. Limited query capabilities. $0.65/GB
Retention beyond 31 days	per GB-month	Storage of logs older than free-retention window. $0.10/GB-month
Archive tier	per GB-month	Cheaper long-term storage. Querying has separate fees. $0.025/GB-month
Sentinel (when enabled)	per GB	Security analytics on top of Log Analytics ingest. Approximately doubles the per-GB cost.

Optimization tips

Common ways to reduce azurerm_log_analytics_workspace cost without changing the workload.

Set daily quota to cap accidental cost

Avoid surprise bills

Setting daily_quota_gb on the workspace prevents runaway ingest from a misconfigured app or attack. Once quota is hit, ingestion pauses until next day. Strict ceiling on cost.

Move cold logs to Basic Logs tier

Up to 72%

Logs you rarely query (audit trails, compliance archives) belong in Basic Logs at $0.65/GB vs $2.30/GB for full Log Analytics. Saves ~72% on those logs.

Commit to a tier if you have predictable volume

10-28% depending on tier

If you sustain >100 GB/day, Commitment Tier 100 cuts the effective rate. Higher commits give better discounts. Right for stable production workloads.

Filter logs at the source

Workload-dependent, often 50%+

Drop debug-level logs and verbose health checks before they hit Log Analytics. Azure Monitor agent and Application Insights both support filtering.

Set short retention for high-volume non-critical logs

Long-term storage

Default 31 days is free; beyond that costs $0.10/GB-month. For container logs, 31 days is usually enough. Don't accidentally keep them forever.

FAQ

Why is Log Analytics so expensive?

Two reasons. First, the per-GB rate ($2.30) is high compared to S3 or competitor log services. Second, container workloads generate enormous log volumes (5-20 GB/day per AKS cluster is normal). Filtering at the source and using Basic Logs tier for cold data are the main mitigations.

Does c3x estimate Log Analytics from Terraform?

The workspace is estimated as $0 (no per-workspace fee). Cost is entirely usage-driven. Specify monthly_data_ingested_gb in c3x-usage.yml.

What about Container Insights?

Container Insights for AKS sends logs to Log Analytics. Bills through this workspace. Many teams underestimate AKS log volume; budget $300-1500/month per cluster for container log ingest.

Is Sentinel included or separate?

Sentinel is a separate paid product layered on Log Analytics. It adds per-GB charges on top of ingest. If you enable Sentinel, the effective per-GB rate roughly doubles. Right for security analytics use cases.