Google CloudCloud LoggingManagement

`google_logging_project_sink` cost estimation

Routes matching log entries from a project to a destination such as BigQuery, Cloud Storage, Pub/Sub, or another log bucket. The sink is free. Cost lives in the destination and in Cloud Logging ingestion.

The google_logging_project_sink resource defines a routing rule: log entries in a project that match its filter are exported to a destination. Creating sinks is free, and routing logs through them carries no per-sink charge. Cloud Logging does not bill for the sink object or for the act of routing. The cost lands in two other places: the destination the sink writes to, and Cloud Logging ingestion for the logs in the first place.

Cloud Logging ingestion is the base charge. The first 50 GB of logs per project each month is free, then ingestion is about $0.50/GB. Logs routed to the _Default log bucket are retained 30 days at no storage charge; extended retention beyond the default is about $0.01/GB-month. A crucial and often-missed point is that a sink does not reduce ingestion cost. Routing logs to BigQuery does not stop them also being ingested into Logging unless you pair the sink with an exclusion. To actually cut ingestion cost you disable or add exclusions to the _Default sink, not just add export sinks.

The destination is the second cost. A sink to BigQuery bills BigQuery storage at about $0.02/GB-month plus query cost when you analyze the logs, and high-volume log tables can grow fast. A sink to Cloud Storage bills that bucket's storage class and operations, which is the cheap option for long-term archival (Archive class at about $0.0012/GB-month). A sink to Pub/Sub bills Pub/Sub throughput for streaming logs to an external SIEM or pipeline. Each destination has its own meter that the free sink feeds.

The cost-adjacent gotcha is exporting everything to BigQuery for analysis and leaving it there. Verbose logs (Data Access audit logs, load balancer request logs, VPC Flow Logs) routed to BigQuery accumulate storage and invite expensive full-table scans. Filter the sink tightly so only the log types you actually query are exported, partition the destination tables, and use exclusions on the _Default sink to bring down the underlying ingestion bill.

c3x flags google_logging_project_sink as free and attributes ingestion cost to Cloud Logging and export cost to the destination the sink targets.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "google_logging_project_sink" "security_to_bq" {
  name        = "security-audit-to-bq"
  destination = "bigquery.googleapis.com/projects/my-project-id/datasets/security_logs"

  filter = "logName:\"cloudaudit.googleapis.com\" AND severity >= WARNING"

  unique_writer_identity = true

  bigquery_options {
    use_partitioned_tables = true
  }
}

resource "google_logging_project_exclusion" "drop_noisy_gets" {
  name   = "drop-lb-health-checks"
  filter = "resource.type=\"http_load_balancer\" AND httpRequest.userAgent=\"GoogleHC/1.0\""
}

Pricing dimensions

What you actually pay for when you provision google_logging_project_sink.

Dimension	Unit	What's being charged
Log sink	free	Defining the sink and routing matching logs through it carries no per-resource charge. $0 (free)
Cloud Logging ingestion	per GB	Logs ingested into the project beyond the free 50 GB per month. A sink does not reduce this unless paired with an exclusion. about $0.50/GB (after 50 GB free)
BigQuery destination	per GB-month plus query	Storage for exported logs plus query cost when analyzed. Verbose logs grow tables quickly. about $0.02/GB-month storage
Cloud Storage destination (Archive)	per GB-month	Cheapest destination for long-term log archival, plus operation charges. about $0.0012/GB-month
Extended log retention	per GB-month	Retention in a log bucket beyond the free 30 days on the _Default bucket. about $0.01/GB-month

Optimization tips

Common ways to reduce google_logging_project_sink cost without changing the workload.

Add exclusions to cut ingestion, not just sinks to move logs

Directly reduces the ingestion line

A sink routes copies of logs but does not reduce ingestion. To lower the about $0.50/GB ingestion bill you must exclude noisy log types (health checks, verbose Data Access logs) from the _Default sink so they are never ingested.

Filter export sinks tightly

Export only the log types you actually query. A sink with a broad filter dumping everything into BigQuery grows storage and invites expensive scans. Narrow the filter to the security or audit logs that matter.

Archive to Cloud Storage instead of BigQuery for retention

Over 90% versus BigQuery storage for cold logs

For logs you must keep but rarely query, route to a Cloud Storage bucket in the Archive class at about $0.0012/GB-month rather than keeping them in BigQuery, which is far more expensive per GB and tempts costly scans.

Partition BigQuery destination tables

Enable use_partitioned_tables so log analysis scans only the relevant date range instead of the whole table, cutting BigQuery query cost on large log datasets.

FAQ

Does a logging sink cost anything?

No. The sink and the routing it performs are free. You pay for Cloud Logging ingestion (about $0.50/GB after the free 50 GB per project per month) and for whatever destination the sink writes to, such as BigQuery or Cloud Storage.

Will adding a sink to BigQuery reduce my Logging bill?

No, and this is the most common misconception. A sink copies logs to a destination but does not stop them being ingested into Cloud Logging. To reduce ingestion cost you must add exclusions to the _Default sink so the noisy logs are never ingested.

What is the cheapest destination for log archival?

A Cloud Storage bucket in the Archive storage class at about $0.0012/GB-month. It is far cheaper than keeping logs in BigQuery, which bills about $0.02/GB-month plus query cost. Use BigQuery only for logs you actively analyze.

Why did my BigQuery bill grow after adding a log sink?

Verbose logs (audit, load balancer, flow logs) routed to BigQuery accumulate storage and, when queried, scan large tables. Filter the sink to only the log types you need, partition the tables, and archive the rest to Cloud Storage.