What CloudWatch Logs Actually Cost: Ingestion, Storage, and Insights Queries

CloudWatch Logs has three separate charges — ingestion, storage, and Logs Insights query scanning — and they're priced two orders of magnitude apart from each other. Most teams worry about the query charge because it's the one they trigger manually, by hand, while debugging. It's usually the smallest of the three. Here's the actual per-GB pricing for each stage, verified directly against AWS's own pricing page, and a worked example showing where a typical bill actually comes from.

• How is CloudWatch Logs priced?
• What does CloudWatch Logs ingestion cost?
• What does CloudWatch Logs storage cost?
• What does a CloudWatch Logs Insights query cost?
• A worked example: where the money actually goes
• How to actually cut the bill
• Does Nuberio Audit check log costs?

How is CloudWatch Logs priced?

CloudWatch Logs bills three things independently: $0.50 per GB to ingest log data (Standard class), $0.03 per GB per month to store it (compressed, Standard class), and $0.005 per GB of data scanned by a Logs Insights query. A 5 GB/month free tier covers ingestion, storage, and query-scanning combined — not 5 GB each. Figures below are US East (Ohio/N. Virginia) rates, verified against aws.amazon.com/cloudwatch/pricing/ on 2026-08-11; other regions vary.

What does CloudWatch Logs ingestion cost?

Ingestion is billed per GB of raw log data sent to CloudWatch, at the moment it's written — $0.50/GB on the Standard log class, or $0.25/GB if the log group is set to the Infrequent Access class. This is the charge that scales directly with how much your application logs, and for almost any real workload it's the largest of the three line items by a wide margin.

What does CloudWatch Logs storage cost?

Storage is billed monthly per GB of data actually held in a log group, after compression — $0.03/GB/month Standard, $0.018/GB/month Infrequent Access, or $0.006/GB/month if archived to Archive Instant Access. AWS's own pricing page lists a 0.15 compression ratio for stored log data, meaning 1 GB of raw ingested text typically lands around 150 MB stored — so the storage line item is usually small relative to ingestion, even before retention limits are applied.

The part that actually drives storage cost up over time isn't the per-GB rate — it's retention. A CloudWatch log group's default retention setting is Never Expire. Every log group created without an explicit retention period keeps accumulating storage charges indefinitely, month after month, for data nobody is ever going to query again.

What does a CloudWatch Logs Insights query cost?

A Logs Insights query costs $0.005 per GB of data scanned across the time range and log groups selected — not per query, and not based on how much data the query returns. A query with a narrow time range scans less data and costs less; the same query run over 30 days instead of 1 day scans roughly 30x the data, whether or not the result set is any bigger.

This charge applies identically whether the query runs from the CloudWatch console, the AWS CLI, an SDK call, or an automated dashboard — there's no free-in-console exception the way there is for Metrics Insights queries run interactively. Container Insights' automated dashboards run Logs Insights queries behind the scenes on the same metered basis.

A worked example: where the money actually goes

Take a mid-size app logging 50 GB/month of raw text across ECS and Lambda, with an on-call engineer running roughly 20 Logs Insights queries a day, each scanning about 2 GB (a day's worth of logs across a few log groups):

Total: roughly $28.73/month, and ingestion alone is 78% of it — even in a scenario with unusually heavy, daily manual querying. Storage barely registers because of compression. This is the opposite of how most engineers budget for CloudWatch Logs: the charge that happens automatically, every time a line gets logged, dwarfs the charge that happens when someone deliberately goes looking for something.

How to actually cut the bill

Since ingestion is almost always the dominant cost, the highest-leverage fix is reducing what gets logged in the first place — not optimizing query patterns.

• Cut DEBUG/verbose logging in production — it's usually the single largest contributor to ingested volume and rarely gets read outside an active incident.
• Set an explicit retention period on every log group — the Never Expire default means storage cost compounds forever on data nobody will query again; 30-90 days covers most operational debugging needs.
• Move logs you keep only for compliance to the Infrequent Access class — half the ingestion cost, in exchange for giving up Logs Insights querying you weren't going to do anyway.
• Scope Logs Insights queries to the narrowest time range and log group that answers the question — a query over the exact incident window costs a fraction of the same query run over the full retention period out of habit.

Does Nuberio Audit check log costs?

No — worth being direct about this. Nuberio Audit checks alarm coverage across your AWS resources; it doesn't currently inspect CloudWatch Logs group retention settings, log class (Standard vs Infrequent Access), or ingestion volume. If a log group has been accumulating storage on Never Expire retention for two years, the Audit won't flag it. That's a real gap, not a feature the product has and this post just didn't mention — checking log group retention settings by hand (or via a script against the DescribeLogGroups API) is still necessary today.