Cloud cost
Log ingest vs. index
Two separate charges most observability platforms bill independently: ingest is charged the moment a log event arrives; index (or retention) is a recurring charge for keeping it searchable afterward.
Last updated
Definition
Sending a log line to Datadog or AWS CloudWatch triggers an ingestion charge immediately. Whether that log line is ever indexed and made searchable is a completely separate decision with its own separate, ongoing charge. A log that's ingested but never indexed still bills its ingestion cost even though nobody can query it, and a log that's both ingested and indexed pays both charges every month it stays retained.
The practical lever this exposes is deciding, deliberately, what actually needs to be searchable. Verbose debug logs are often worth ingesting (in case they're needed) without paying to index every line of them by default.
Where it shows up
Ingest and index appear as two separate line items on an observability vendor's invoice: Datadog and AWS CloudWatch both bill an ingestion charge the moment a log event arrives, and then a separate, ongoing charge for keeping it indexed and searchable for as long as it stays retained.
What makes it expensive
The costly mistake is indexing every log line by default without deciding which ones actually need to be searchable, paying the index charge on volume that's rarely queried. Ingest and index sit as two separate lines on the invoice. When the second grows faster than the first, the default is doing the deciding.
Related
More in Cloud cost
- Committed use discount (CUD)
- Reserved instance (RI)
- Savings plan (SP)
- On-demand vs. spot instances
- Data egress
- Amortized, blended, and unblended cost
- Billed vs. effective vs. list vs. contracted cost
- Rightsizing
- Idle and orphaned resources
- Storage class
- Lifecycle policy
- Incremental snapshot
- Allocatable capacity
- Requests vs. limits
- Cluster idle
- Workload idle
- Bin packing
- Cost allocation tags
- Tag coverage
- Unallocated spend
- Showback vs. chargeback
- Unit economics
- RI/SP coverage and utilization
- Observability tax
- Metric cardinality
- High-water-mark billing
- Snowflake credit
- Auto-suspend / resume minimum
- BigQuery slot
- Bytes scanned & partition pruning
- Time Travel & Fail-safe
The invoice is a lagging signal.
A monthly invoice tells you what already happened. CostMon builds a daily baseline, so a spike stands out while you can still act on it.