Free tool
Log cost calculator
Estimate your monthly log bill and how much of it is noise, then copy the filters that drop it.
Runs in your browser. Nothing is uploaded.
The 3 usual noise sources, and filters that drop them
- Health checks and probesLoad balancer and Kubernetes probes calling /healthz, /readyz or /livez every few seconds on every pod.
- Debug logging left on in productionA log level set to debug for an investigation and never switched back.
- A line for every successful requestUseful as a sample, rarely needed one by one. Keep errors in full and sample the rest.
Fluent Bit
[FILTER]
Name grep
Match *
Exclude log /(healthz|readyz|livez)|kube-probe
[FILTER]
Name grep
Match *
Exclude level ^debug$
Fluent Bit's grep filter drops lines; sample successful requests in your backend or with Vector or the Collector.
Vector
transforms:
drop_noise:
type: filter
inputs: [app_logs]
condition: |
!match(string!(.message), r'/(healthz|readyz|livez)|kube-probe') && .level != "debug"
sample_success:
type: sample
inputs: [drop_noise]
rate: 10 # keep 1 in 10
exclude: | # never sample away errors
(to_int(.status_code) ?? 0) >= 400
OpenTelemetry Collector
processors:
filter/drop_noise:
error_mode: ignore
logs:
log_record:
- 'IsMatch(body, "/(healthz|readyz|livez)|kube-probe")'
- 'severity_number < SEVERITY_NUMBER_INFO and severity_number != SEVERITY_NUMBER_UNSPECIFIED'
# Put this in a pipeline that carries only successful-request logs:
probabilistic_sampler/success:
sampling_percentage: 10
service:
pipelines:
logs:
receivers: [otlp]
processors: [filter/drop_noise, batch]
exporters: [otlphttp]LogTrim reads an hour of your real logs, prices every log pattern, and finds the line of code that writes each expensive one.
Where log bills come from
Most log platforms charge twice: once for every GB you send (ingestion and indexing) and again for every GB you keep (retention). Both grow with volume, and volume grows quietly: more pods, more services, a debug flag left on, a new health check. Teams rarely know which lines cost the money, because the bill shows totals per day, not per log pattern.
How this estimate works
Monthly cost is the daily volume times 30 times your ingest price, plus the volume you keep (daily volume times retention days) times your storage price per GB-month. Enter your own prices: the defaults are examples, not any vendor's list price, and many platforms price indexing, archiving and rehydration separately.
The sliders estimate how much of your volume is noise. The saving assumes you drop all health-check and debug lines and keep 1 in 10 successful-request lines while keeping every error.
The three biggest sources of noise
- Health checks and probes. Every load balancer target and every Kubernetes pod is probed every few seconds. Each probe can log a line in the application and another in the ingress. In busy clusters this alone can be a large share of volume.
- Debug logging in production. Debug lines are often ten times more frequent than info lines. One service left at debug level can double a bill.
- Logging every successful request. Access logs for 200 responses are useful in aggregate. Metrics answer most questions they're used for, and a 10% sample keeps them useful for debugging.
Where to cut
Drop at the source when you can: switch off access logging for health endpoints in the web server or framework, and set the production log level to info. Where you can't change the application, filter in the collector before data leaves the cluster, so you never pay to ingest it. The snippets above do this for Fluent Bit, Vector and the OpenTelemetry Collector; adjust the field names (message, level, status_code) to your log format.
Then look at retention. Not everything needs 30 days of fast, searchable storage. Keep recent logs hot, move older logs to cheap archive storage, and keep only what policy requires. In India, the CERT-In Directions require logs of ICT systems to be kept for 180 days, so archive rather than delete.
FAQ
Questions
Are the prices accurate for my vendor?
Enter your own. The defaults are examples only, and many vendors price indexing, retention tiers and rehydration separately.
Is it safe to drop health-check logs?
Usually yes. Probe results are better watched through metrics and the probes themselves. Keep failed probes if your platform logs them separately.
Won't sampling hide problems?
Not if errors are excluded from sampling, as in the snippets. You keep every failure and a representative share of successes.
Should I filter in the app or in the collector?
In the app when you can, because it also saves CPU and network. The collector is the next best place: data dropped there is never ingested.
Do I still need to keep logs for compliance?
Yes, where rules require it. CERT-In requires 180 days of logs for ICT systems in India. Move them to cheaper archive storage rather than deleting them.
Is anything I enter sent to you?
No. The calculator runs entirely in your browser.