Log Analytics, the data store behind Azure Monitor, charges on two axes: data ingestion, billed per gigabyte as logs arrive, and data retention, billed per gigabyte per month beyond the free retention window. A default workspace includes a free retention period and then meters every additional month, and the analytics ingestion rate is what dominates for most estates. The reason it becomes a quiet budget eater is structural. Diagnostic settings make it trivial to forward everything from every resource into one workspace, verbose application logging adds more, and nobody is billed at the moment of collection, so the volume climbs for months before anyone connects the workspace cost to the logging decisions that drove it.
This sits in the Azure observability cluster with Azure Monitor cost discipline and Application Insights sampling for cost. Read those for the monitor wide view and the sampling controls on the application telemetry side.
What exactly are you paying for?
Two meters drive almost all of it. Ingestion is charged per gigabyte as data lands in the workspace, and it is the big number because it scales with how chatty your sources are. Retention is charged per gigabyte per month for data held beyond the included period, so a workspace holding a year of verbose logs pays eleven extra months of storage on every gigabyte. A third lever, the data plan per table, decides how the ingestion rate itself is set, which we come to below.
The mental model that fixes spend is simple: you pay to bring data in, and you pay to keep it. Every gigabyte you ingest that nobody queries is pure waste, and every month you retain data past its investigative usefulness is rent on logs you will never read.
Why does the bill grow without anyone deciding it should?
Because the defaults push toward collecting more. Diagnostic settings on a resource can stream all categories of platform logs and metrics into the workspace with one toggle, and platform teams enable them broadly for safety. Application Insights, when wired without sampling, sends every request, dependency, and trace. Container insights from AKS can be the single largest contributor, because container stdout and stderr at scale is a firehose. Each addition is individually reasonable and collectively expensive, and since the cost lands on the workspace rather than the team that turned on the source, no one owns the growth.
Which levers actually cut the bill?
Four, in order of payback. First, filter at the source. Use data collection rules and transformations to drop noisy columns and uninteresting rows before they are billed, and turn off diagnostic categories nobody investigates. This attacks ingestion, the largest meter, directly. Second, move high volume, low query tables to the Basic or Auxiliary table plan. These plans charge a much lower ingestion rate for tables you keep for occasional search and incident lookup rather than rich analytics, which suits container and verbose platform logs.
Third, buy a commitment tier. If your steady ingestion sits reliably above a daily threshold, a commitment tier discounts the per gigabyte rate in exchange for a committed daily volume, much like a reservation. Size it to a defensible floor of your ingestion, not the peak. Fourth, tier retention. Keep an interactive retention window matched to how far back investigations actually reach, then move older data to archive, which stores it at a far lower rate and lets you run a search job when a rare audit needs it.
How do you size a commitment tier without overbuying?
Same discipline as any commitment: cover the floor, not the forecast peak. Pull daily ingested gigabytes for the trailing several months, find the level that your daily volume rarely drops below, and commit there. Volume above the tier is billed at the standard rate, which is fine, while volume below a tier you oversized is money you committed and did not use. The risk is asymmetric, so a slightly conservative tier with overage at standard rates beats an aggressive tier that strands commitment on quiet days.
A worked example
An indicative Fortune 500 retailer forwarded all AKS container logs, full Application Insights telemetry, and every platform diagnostic category into a single Log Analytics workspace with a long retention setting. A breakdown by table showed container logs were the dominant ingestion line and most of that data was never queried. They applied data collection rule transformations to drop verbose container noise, moved the container table to the Basic plan, enabled Application Insights sampling, sized a commitment tier to their steady daily floor, and cut interactive retention to the investigative window with archive beyond it. Workspace spend fell by a large margin with no loss of the signals their on call teams actually used. Figures are verified against billing data and anonymised.
Frequently asked questions
How does Azure Log Analytics charge?
What usually drives Log Analytics cost?
How do I reduce Log Analytics spend without losing signal?
Where this fits the cost review
Observability spend is one of the fastest growing Azure lines, and the controls are ingestion discipline and retention tiering rather than a discount, so it belongs in a full monitoring review. We run that review as an independent buyer side advisory across AWS, Azure, GCP, and OCI, with zero provider commissions and a guarantee: we reduce your cloud spend or we reimburse our service fee.
For monthly buyer side analysis delivered to your inbox, subscribe to The Cloud Spend Navigator.
Put a defensible number on your cloud spend.
No provider in the room, no published price list. Tell us your footprint and we will scope the savings against your billing data — we reduce your cloud spend or we reimburse our service fee.
The Cloud Spend Navigator: what changed in cloud pricing, commitments, and FinOps — no vendor spin.