Log volumes grow with every new service, and the bill grows with them. Enter your daily volume, how long you keep it and the prices in your own contract, and see what it costs, how much pays for logs nobody reads, and what three common levers would save.
Updated 12 October 2026
C4C is an independent observability practice. We have no platform of our own, so we design what to ingest, keep and drop around your questions, not a vendor’s volumes. Our log strategy approach.
Prices come from your own contract. None are built in, because they vary widely by platform and deal.
From your platform’s usage reports.
Leave blank to see volumes only. Use the currency of your contract.
What if you changed the design? Planning assumptions you can adjust.
Get a formatted PDF of these results by email, to keep or share with your team. We send it once and do not add you to any list.
Prefer email? Write to hello@c4cgroup.co.uk.
Monthly ingest is your daily volume times 30.4. Steady state searchable storage is daily volume times searchable retention days, and archive storage is daily volume times archive days. Cost is ingest times your price per GB ingested, plus stored volumes times your monthly storage prices.
The cost of logs never queried is the annual cost times the share of logs you do not query. The three levers are applied in turn: dropping noise reduces everything that follows, shorter searchable retention moves data to archive, and sampling reduces the remaining ingest.
There is no single model. Current log products typically charge separately for three things, and broader observability suites add a fourth:
Even the units differ. Platforms quote decimal GB or binary GiB, uncompressed or stored volume, data scanned, GiB days, or millions of log events, so two prices that both say “per GB” may not be comparable. Convert every proposal to the same basis, your own daily volume and retention, before comparing.
Gartner says observability spend is increasing rapidly, driven by explosive growth in operational telemetry (Gartner, April 2025), and describes telemetry pipelines, which filter, route and reduce data before it reaches a paid platform, as a way to manage that growth and optimise cost (Gartner, September 2025). The evidence points to doing the work at or before the point of ingest:
We found no reliable independent figure for how much log data is never queried, and no independent enterprise case study with measured savings. Claims of large percentage savings usually come from the vendors selling the tools that make them, so measure your own query usage first.
Because log volumes grow with every new service, and most log platforms charge for what is ingested and kept, not for what is used. Gartner says observability spend is increasing rapidly, driven by explosive growth in operational telemetry. Debug output, health checks and duplicates often make up a large share, and much of it is rarely queried.
Usually by data ingested, data retained and, on some platforms, data scanned by queries, with hosts, users or compute used for other parts of the suite. Units differ between GB, GiB, stored volume and event counts, so convert every proposal to your own daily volume and retention before comparing.
Decide what questions the logs need to answer, then filter noise before it is ingested, keep only recent data searchable and move the rest to a cheaper archive, and sample high volume, low value logs once you have tested it. Keep full fidelity where security, audit or compliance require it.
It can help. The OpenTelemetry Collector can filter and transform logs before they reach a paid platform, and because it is vendor neutral that work survives a change of platform. Log sampling in the Collector is still at alpha status, so filtering and retention are the safer levers today.
Only as long as your teams actually search them, with longer retention in a cheaper archive where audit, security or regulation need it. One 2026 study found 14 days of searchable retention kept more than 97 percent of operationally useful logs in simulated workloads, but check your own query patterns and obligations.
No reliable independent study measures it, so do not rely on a headline figure. Most platforms can report query usage by source or index; that report is the best place to start, and the share you enter here should come from it.
Because log pricing varies widely by platform, tier, unit and negotiated deal, and published list prices rarely match what organisations pay. Using your own contract prices gives a far more useful answer.
Not always. Security investigations, audit and regulatory rules may require full fidelity and specific retention. Treat those sources separately, and apply the levers to operational and debug logs first.