Log Management Cost Is About Three Things
Every vendor's pricing decomposes into ingest (per GB of logs sent), indexing (turning logs into searchable structure), and retention (per GB-month kept queryable). Loki minimizes indexing cost by indexing only labels. Elasticsearch maximizes search speed by indexing everything. Datadog charges separately for ingest and indexing.
2026 Vendor Pricing Cheat Sheet
- Self-hosted Loki on S3: ~$0.005-0.02/GB
- Grafana Cloud Loki: $0.05/GB
- Datadog Logs: $0.10/GB ingest + indexing fees
- New Relic Logs: $0.30/GB
- CloudWatch Logs: $0.50/GB ingest + $0.03/GB-month storage
- Splunk Cloud: $0.50-2.00/GB by plan
Cost Reduction Playbook
- Sample low-value logs — drop 90% of INFO/DEBUG, keep 100% of WARN+. Saves 50-80% of volume immediately.
- Tier retention — hot for 7-14 days, warm for 30, archive (S3 Glacier) for the rest.
- Drop high-cardinality fields in indexed logs (user_id, request_id) — put them in trace context instead.
- Compress aggressively — most apps still send uncompressed logs over the wire.
- Audit by source — find which service/component is producing the most bytes and trim its logger.
See the Log Management Guide for the full architecture decision tree.