AWS CloudWatch Support
Reducing CloudWatch Logs cost.
For many accounts CloudWatch Logs is a surprisingly large line on the bill, driven mostly by ingestion and by logs that never expire. We find which log groups drive the cost, remove the noise at the source and move the rest to cheaper retention and storage.
When You Need This
The situations where this work pays for itself.
Signs it is time
- CloudWatch appears near the top of your AWS bill
- Debug logging was left on in production
- Log groups have no retention and are years old
- Lambda, load balancer or VPC logs are very high volume
- Compliance needs long retention but you rarely read the logs
What you get
- A ranked list of log groups by ingestion cost
- Retention and log class set through infrastructure as code
- Application logging changes with measured volume reduction
- An S3 archive and query setup for long-term logs
How we do it
A clear, safe process you can follow along with.
1. Find the expensive log groups
We use Cost Explorer for the CloudWatch usage types and the IncomingBytes metric per log group to rank groups by ingestion, because cost follows data volume.
2. Reduce volume at the source
We lower log levels from DEBUG to INFO or WARN, remove per-request payload dumps, log once per event instead of per loop iteration and use sampling for verbose paths.
3. Set retention everywhere
A log group defaults to never expire. We set retention that matches need, such as days for debug logs and longer for audit, and automate it for new groups through policy or infrastructure as code.
4. Use the Infrequent Access log class
For logs that you keep but query rarely, the Infrequent Access class has lower ingestion pricing with reduced features, so we confirm features like metric filters or subscriptions are not needed first. The class is chosen at log group creation.
5. Archive instead of retaining in CloudWatch
We export or stream older logs to S3 with lifecycle rules, and query them with Athena when needed.
6. Fix service-specific sources
We review high-volume sources such as VPC Flow Logs, API Gateway access logs, ELB logs and Lambda extensions, and send them to S3 where that is cheaper.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Only setting retention
Retention reduces storage but ingestion is often the larger cost.
Choosing Infrequent Access for logs you alarm on
Check feature support first, because it does not provide every feature.
Deleting logs needed for audit
We confirm legal and security retention requirements first.
Leaving debug logs on after an incident
Make debug logging time-limited.
Frequently Asked Questions
Why is my CloudWatch Logs bill so high?
Usually ingestion volume from verbose application or service logs, plus log groups that never expire. Ranking log groups by IncomingBytes shows the source.
What is the CloudWatch Logs Infrequent Access class?
It is a lower-cost log class for logs you need to keep but query rarely, with fewer features than the Standard class.
How do I set retention on all CloudWatch log groups?
Set it per log group with the API or infrastructure as code, and apply an automated rule so new groups also get a retention value.
Want Help With Reducing CloudWatch Logs cost?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required