Usage and billing
Usage and billing
One dial: gigabytes ingested, multiplied by retention.
You are billed on gigabytes ingested per month, with retention as a multiplier. Queries, dashboards, monitors, seats and egress are included — there is no second meter to model.
What counts as a gigabyte
- The uncompressed JSON size of the events you send, after any fields your shipper dropped.
- Measured at ingest, not at rest — so our compression is our problem, not your bill.
- Failed events are not counted. Rejected batches are not counted.
Seeing where it goes
Ingest by dataset over the last 30 days
read top to bottom
1['_usage']2| where _time > ago(30d)3| summarize gb = round(sum(bytes) / 1073741824.0, 2) by dataset4| order by gb descWhich service is growing
read top to bottom
1['api-gateway-prod']2| where _time > ago(14d)3| summarize events = count() by service, bin(_time, 1d)4| order by _time ascReducing it, in order of effect
| Lever | Typical saving | Cost to you |
|---|---|---|
| Shorten retention on debug datasets | Large | None, if you split datasets first |
Drop debug level in production at the shipper | Large | Lose debug logs you rarely read |
| Stop logging health checks | Medium | None |
Trim fat fields — full request bodies, stack traces on info | Medium | Some context lost |
| Sample high-volume success events | Medium | Statistical, not per-request, answers |
Retention is the biggest lever and the easiest to get wrong
Most teams need 400 days for one dataset and 14 for the rest, then pay 400 days on everything because it is one setting. Split by retention need — see datasets.