Independently operated. Not affiliated with Datadog, New Relic, Grafana Labs, Dynatrace, Splunk, or Elastic. Pricing sourced from public pages and may not reflect current rates. Verify on each vendor's pricing page before purchasing.
MonitoringCost.comRun Calculator

Logs

Log management pricing 2026: every vendor on one normalised page

Verified April 2026

Logs are the largest line item on most observability invoices. Six vendors compared on a per-GB basis, plus self-hosted options.

TL;DR

Log management costs $0.10 to $150+/GB depending on vendor, feature, and which meter applies. At 100 GB/day, expect $1K to $25K/mo on commercial platforms; self-hosted ELK or Loki sits at $1K to $4K/mo in infrastructure plus engineering time. Logs are the largest single line item on most observability invoices.

Pricing matrix

Six vendors normalised per GB

List rates as published April 2026. Workload pricing, negotiated contracts, and committed-use discounts shift these numbers materially. Verify on each vendor's pricing page.
VendorIngestIndexArchiveNotes
Datadog Logs
$0.10/GB$1.70/M eventsS3-compatible (BYO)Ingest plus indexed-event split. 4M events per GB is a common assumption. Retention multiplies indexed cost.
Splunk Cloud
$150+/GB/day listIncludedSmart Store / S3Headline list rate is one of the highest in the market. Workload pricing model softens this for negotiated contracts.
Elastic Cloud
~$0.12/GB resource-equivIncluded in deployment sizeFrozen tier (S3-backed)Resource-based; per-GB is an approximation. Self-managed Elasticsearch is free at the licence level.
Grafana Loki (Cloud)
$0.50/GBLabel-only (cheap)S3-compatibleCheapest commercial managed log service for typical workloads. Limited full-text search vs Splunk/Datadog.
Sumo Logic
$2.50/GB ingestIncludedContinuous CloudPer-GB pricing list. Cloud-native architecture, mid-market positioning.
New Relic Logs
$0.30/GB above 100 GB freeIncluded in ingestNative (8-day default)Single ingest meter. Generous free tier. Retention upgrades cost more.

Three meters

Ingestion vs indexing vs archiving

The three cost layers most teams misunderstand. Mixing them up is the most common cause of surprise log invoices.

Ingestion

The cost to accept logs and store them in their raw form. Always charged. Vendors typically price this at $0.10 to $2.50/GB.

Indexing

The cost to make logs searchable across all fields. Datadog charges separately ($1.70/M events). Splunk includes it. Loki indexes only labels.

Archiving

The cost to retain logs long-term in cheap storage. Often priced at $0.005 to $0.02/GB/mo (object storage rates). The cheapest tier; rehydrate-on-demand for queries.

Three scenarios

Same volumes, very different bills

List pricing only. Negotiated contracts, particularly for Splunk and Datadog at enterprise scale, vary by 30 percent or more.

10 GB/day startup

300 GB/mo

  • Datadog$30 ingest + $1,530 indexed = $1,560
  • Splunk Cloud~$1,500 to $3,000 (negotiated)
  • Elastic Cloud$36
  • Grafana Loki$150
  • Sumo Logic$750
  • New Relic$60 (200 GB billable)

100 GB/day mid-market

3,000 GB/mo

  • Datadog$300 ingest + $20,400 indexed = $20,700
  • Splunk Cloud$10,000 to $25,000
  • Elastic Cloud$360
  • Grafana Loki$1,500
  • Sumo Logic$7,500
  • New Relic$870 (2,900 GB billable)

1 TB/day enterprise

30,000 GB/mo

  • Datadog$3,000 ingest + $204,000 indexed = $207,000 list
  • Splunk Cloud$50,000 to $200,000+
  • Elastic Cloud$3,600
  • Grafana Loki$15,000
  • Sumo Logic$75,000
  • New Relic$8,970

The Datadog log indexing trap

For 100 GB/day at list pricing, ingestion costs roughly $300/mo and indexing costs roughly $20,000/mo. Most teams discover this after they have already turned on full indexing. The fix: selective indexing rules, drop noisy logs at source, and route high-volume access logs to S3.

Self-hosted

When self-managing wins

Self-hosted ELK (Elasticsearch + Logstash + Kibana)

$1K to $4K/mo cloud infra at 100 GB/day plus 0.25 to 0.5 FTE ongoing

Mature, full-text search. Operational overhead is real. Cold-warm-hot tiering required for cost-effectiveness at scale.

Self-hosted Loki + Grafana

$500 to $2K/mo cloud infra at 100 GB/day plus 0.1 to 0.25 FTE ongoing

Cheapest at scale. Label-based search rather than full-text. Good fit for K8s-heavy stacks already on Prometheus.

S3 + Athena (query-on-demand)

$200/mo storage at 100 GB/day; per-query Athena cost

Cheapest archive option. Not suitable for live operational queries; works well for compliance retention.

Cost reduction

Hot, warm, cold: tiered log retention

Tiering cuts log retention cost 60 to 80 percent

Most operational queries hit the most recent 24 to 48 hours of logs. Match retention tier to query pattern, not vendor default.
  • 01Hot tier (24 to 48 hours, fast searchable) on the paid platform.
  • 02Warm tier (3 to 14 days, slow search OK) on a cheaper platform or self-hosted Loki/Elasticsearch.
  • 03Cold tier (15 days to 1 year, rehydrate-on-demand) in S3, GCS, or Azure Blob.
  • 04Compliance archive (1 year+) in glacier-class storage with audit-only access.
  • 05Match retention to query patterns, not vendor defaults.

Where to go next

Run the calculator →

Model your log volume across six vendors.

Datadog log mechanics →

Ingest plus indexed-event detail.

Reduce log spend →

Sampling, drop rules, retention tiering.

Frequently asked

How much does log management cost?
Costs range from $0.10/GB to $150+/GB/day depending on vendor, model, and whether you are ingesting, indexing, or archiving. At 100 GB/day, expect $3K to $25K/mo on commercial platforms. Self-hosted Loki on the same volume runs roughly $1K to $2K/mo plus engineering time.
Why is Splunk so expensive?
Splunk's list price is anchored to ingest volume per day, with the published headline rate at $150 or more per GB/day. Workload pricing softens this in real contracts but Splunk remains the highest-priced major log platform on list. The trade-off is the most powerful query language (SPL) and the deepest enterprise security ecosystem.
What is the cheapest log management solution?
Self-hosted Loki backed by S3 for storage is the cheapest commercial-quality option at scale. Among managed services, Grafana Loki Cloud and Elastic Cloud are the lowest-priced; Datadog and Splunk anchor the higher end of the market.
What is the difference between log ingestion and indexing?
Ingestion is the cost to receive and store logs in their raw form. Indexing is the cost to make logs searchable across all fields. Some vendors (Datadog, Splunk) charge for both. Others (Loki) index only labels and store the rest in cheap object storage; full-text search costs more at query time but bulk storage is cheap.