Cloud cost
Log ingest vs. index
Two separate charges that most observability platforms bill independently. Ingest is charged when a log event arrives. Index, or retention, is a recurring charge to keep it searchable.
Last updated
Definition
Sending a log line to Datadog or AWS CloudWatch triggers an ingestion charge at once. Whether that line is ever indexed and made searchable is a separate decision. It has its own ongoing charge. A log that is ingested but never indexed still bills its ingestion cost, even though nobody can query it. A log that is both ingested and indexed pays both charges every month it stays retained.
This gives you a lever: decide what needs to be searchable. Verbose debug logs are often worth ingesting in case you need them. You do not have to pay to index every line of them by default.
Where it shows up
Ingest and index appear as two separate line items on an observability vendor's invoice. Datadog and AWS CloudWatch both bill an ingestion charge when a log event arrives. They then bill a separate, ongoing charge to keep the event indexed and searchable for as long as it is retained.
What makes it expensive
Do not index every log line by default. Decide which ones need to be searchable, or you pay the index charge on volume that is rarely queried. Ingest and index are two separate lines on the invoice. When the second grows faster than the first, the default is making the decision for you.
Related
More in Cloud cost
- Committed use discount (CUD)
- Reserved instance (RI)
- Savings plan (SP)
- On-demand vs. spot instances
- Data egress
- Amortized, blended, and unblended cost
- Billed vs. effective vs. list vs. contracted cost
- Rightsizing
- Idle and orphaned resources
- Storage class
- Lifecycle policy
- Incremental snapshot
- Allocatable capacity
- Requests vs. limits
- Cluster idle
- Workload idle
- Bin packing
- Cost allocation tags
- Tag coverage
- Unallocated spend
- Showback vs. chargeback
- Unit economics
- RI/SP coverage and utilization
- Observability tax
- Metric cardinality
- High-water-mark billing
- Snowflake credit
- Auto-suspend / resume minimum
- BigQuery slot
- Bytes scanned & partition pruning
- Time Travel & Fail-safe
The invoice is a lagging signal.
A monthly invoice tells you what already happened. CostMon builds a daily baseline, so a spike stands out while you can still act on it.