Cloud Logging: the quiet budget eater on GCP

Why logging cost creeps up unnoticed

Nobody decides to spend a fortune on logs. It accumulates. A service ships with debug verbosity left on in production. Data access audit logs get enabled broadly and stay on. Load balancer and VPC flow logs sample at full rate. Each is reasonable in isolation, and together they fill the _Default log bucket with millions of entries a day. Because the cost sits inside the Cloud Logging line rather than next to the service that produced it, no team sees its own contribution, and the number grows every quarter without an owner.

The tell is the ratio of ingested to queried. When you ingest tens of terabytes a month and query a tiny fraction, you are paying to store noise. That gap is the budget you can recover.

The three levers that cut the bill

First, exclude at the source. Exclusion filters on the _Default bucket stop low value entries from being ingested at all, which is where the charge lands. Good candidates are health check requests, successful routine calls, and chatty debug output in production. The data never enters the billable path, so the saving is immediate.

Second, route must keep logs to cheaper storage. Logs you have to retain for compliance but rarely read do not belong in Cloud Logging retention. Send them through a log sink to a Cloud Storage bucket on a cold class, where you keep every entry at storage prices rather than logging prices. You preserve the audit trail and drop the cost band.

Third, set retention deliberately. The default retention on a bucket is often longer than you need. Shorten it on operational buckets to the window your engineers actually investigate within, and keep long retention only where an obligation requires it, in the cheaper sink.

A worked example

Indicative figures, verified against the client's billing data, anonymized. A European SaaS company was ingesting roughly 48 terabytes a month into Cloud Logging.

The combined effect cut Cloud Logging from roughly 23,000 USD to about 8,200 USD a month, a reduction near 64 percent, and the engineers lost no log they actually investigated with. The compliance trail stayed complete in the storage sink at a fraction of the price.

Your next step

Compare ingested volume against what your teams query, then apply the three levers to the gap. For the wider method read the GCP cost optimization guide, and for neighbouring detail see monitoring and observability costs on GCP and the biggest GCP waste categories. To cut logging spend with us, our GCP cost optimization service turns the ingestion analysis into verified savings, and you can request a free trial with zero provider commissions.