Logs

Log management pricing 2026: every vendor on one normalised page

Verified September 2026

Logs are the largest line item on most observability invoices. Seven vendors compared on a per-GB basis, plus self-hosted options.

TL;DR

Log management costs $0.10 to $150+/GB depending on vendor, feature, and which meter applies. At 100 GB/day, expect $1K to $25K/mo on commercial platforms; self-hosted ELK or Loki sits at $1K to $4K/mo in infrastructure plus engineering time. Logs are the largest single line item on most observability invoices.

Pricing matrix

Seven vendors normalised per GB

List rates re-derived from each vendor's published pricing on 23 September 2026. Workload pricing, negotiated contracts, and committed-use discounts shift these numbers materially. Two vendors below publish no list rate at all, and the table says so rather than guessing.

Vendor	Ingest	Index	Archive	Notes
Datadog Logs	$0.10/GB	$1.70/M events	S3-compatible (BYO)	Ingest plus indexed-event split. 4M events per GB is a common assumption. Retention multiplies indexed cost.
Splunk Cloud	$150+/GB/day list	Included	Smart Store / S3	Headline list rate is one of the highest in the market. Workload pricing model softens this for negotiated contracts.
Elastic Cloud	~$0.12/GB resource-equiv	Included in deployment size	Frozen tier (S3-backed)	Resource-based; per-GB is an approximation. Self-managed Elasticsearch is free at the licence level.
Grafana Loki (Cloud)	$0.45/GB ($0.05 process + $0.40 write)	Label-only (cheap)	S3-compatible	Cheapest commercial managed log service for typical workloads. Limited full-text search vs Splunk/Datadog. Grafana prices logs in three parts: process from $0.050/GB, write from $0.400/GB and retain from $0.100/GB, on top of a $19/month Pro platform fee that covers the first 50 GB. The free plan carries 50 GB a month at 14-day retention. grafana.com/pricing, read 23 September 2026.
Sumo Logic	$0 ingest (Flex)	100% indexed	Continuous Cloud	Sumo Logic no longer publishes a per-GB ingest rate. Its Flex model charges on data scanned, not data ingested, through a credit pool: unlimited ingest, and an estimated $3.14 per TB scanned for a North America US deployment at the 500-750 scans-per-GB profile. sumologic.com/pricing, read 23 September 2026.
New Relic Logs	$0.40/GB above 100 GB free	Included in ingest	Native (8-day default)	Single ingest meter. Generous free tier. Retention upgrades cost more.
Sematext Logs	$0.10/GB received	Included	Stored $0.15-$1.90/GB by plan	Plans from $5/mo (Basic, 500 MB/day, 7-day retention) to Pro from $60/mo scaling to 1,000 GB/day and 365-day retention. Every tier meters $0.10/GB received; the stored rate is what rises by plan. sematext.com/pricing, read 16 September 2026.

Rates re-derived 23 September 2026 from each vendor's own published pricing: Datadog ($0.10 per ingested or scanned GB; $1.70 per million log events on an annual commitment, $2.55 on demand), Grafana Cloud (process from $0.050/GB, write from $0.400/GB, retain from $0.100/GB, $19/month Pro platform fee covering the first 50 GB), New Relic ($0.40/GB beyond 100 GB free, $0.60/GB on Data Plus), Sumo Logic (Flex: $0 ingest, charged on data scanned) and Sematext (read 16 September 2026). Splunk publishes no list price for Splunk Cloud, so the figure shown for it is a market-observed range from buyer write-ups rather than a Splunk figure. The Elastic Cloud per-GB number is our own approximation of a resource-based deployment, not a published Elastic rate.

Three meters

Ingestion vs indexing vs archiving

The three cost layers most teams misunderstand. Mixing them up is the most common cause of surprise log invoices.

Ingestion

The cost to accept logs and store them in their raw form. Always charged. Vendors typically price this at $0.10 to $2.50/GB.

Indexing

The cost to make logs searchable across all fields. Datadog charges separately ($1.70/M events). Splunk includes it. Loki indexes only labels.

Archiving

The cost to retain logs long-term in cheap storage. Often priced at $0.005 to $0.02/GB/mo (object storage rates). The cheapest tier; rehydrate-on-demand for queries.

Three scenarios

Same volumes, very different bills

List pricing only. Negotiated contracts, particularly for Splunk and Datadog at enterprise scale, vary by 30 percent or more.

10 GB/day startup

300 GB/mo

Datadog$30 ingest + $1,530 indexed = $1,560
Splunk Cloud~$1,500 to $3,000 (negotiated)
Elastic Cloud$36
Grafana Loki$113 process + write (250 GB billable)
Sumo LogicScan-based, no published ingest rate
New Relic$80 (200 GB billable)

100 GB/day mid-market

3,000 GB/mo

Datadog$300 ingest + $20,400 indexed = $20,700
Splunk Cloud$10,000 to $25,000
Elastic Cloud$360
Grafana Loki$1,328 process + write (2,950 GB billable)
Sumo LogicScan-based, no published ingest rate
New Relic$1,160 (2,900 GB billable)

1 TB/day enterprise

30,000 GB/mo

Datadog$3,000 ingest + $204,000 indexed = $207,000 list
Splunk Cloud$50,000 to $200,000+
Elastic Cloud$3,600
Grafana Loki$13,478 process + write
Sumo LogicScan-based, no published ingest rate
New Relic$11,960

The Datadog log indexing trap

For 100 GB/day at list pricing, ingestion costs roughly $300/mo and indexing costs roughly $20,000/mo. Most teams discover this after they have already turned on full indexing. The fix: selective indexing rules, drop noisy logs at source, and route high-volume access logs to S3.

Self-hosted

When self-managing wins

Self-hosted ELK (Elasticsearch + Logstash + Kibana)

$1K to $4K/mo cloud infra at 100 GB/day plus 0.25 to 0.5 FTE ongoing

Mature, full-text search. Operational overhead is real. Cold-warm-hot tiering required for cost-effectiveness at scale.

Self-hosted Loki + Grafana

$500 to $2K/mo cloud infra at 100 GB/day plus 0.1 to 0.25 FTE ongoing

Cheapest at scale. Label-based search rather than full-text. Good fit for K8s-heavy stacks already on Prometheus.

S3 + Athena (query-on-demand)

$200/mo storage at 100 GB/day; per-query Athena cost

Cheapest archive option. Not suitable for live operational queries; works well for compliance retention.

Cost reduction

Hot, warm, cold: tiered log retention

Tiering cuts log retention cost 60 to 80 percent

Most operational queries hit the most recent 24 to 48 hours of logs. Match retention tier to query pattern, not vendor default.

01Hot tier (24 to 48 hours, fast searchable) on the paid platform.
02Warm tier (3 to 14 days, slow search OK) on a cheaper platform or self-hosted Loki/Elasticsearch.
03Cold tier (15 days to 1 year, rehydrate-on-demand) in S3, GCS, or Azure Blob.
04Compliance archive (1 year+) in glacier-class storage with audit-only access.
05Match retention to query patterns, not vendor defaults.

Where to go next

Elastic Cloud pricing →

Resource tiers vs serverless per-GB, in full.

Datadog log mechanics →

Ingest plus indexed-event detail.

Reduce log spend →

Sampling, drop rules, retention tiering.

Frequently asked

How much does log management cost?

Costs range from $0.10/GB to $150+/GB/day depending on vendor, model, and whether you are ingesting, indexing, or archiving. At 100 GB/day, expect $3K to $25K/mo on commercial platforms. Self-hosted Loki on the same volume runs roughly $1K to $2K/mo plus engineering time.

Why is Splunk so expensive?

Splunk's list price is anchored to ingest volume per day, with the published headline rate at $150 or more per GB/day. Workload pricing softens this in real contracts but Splunk remains the highest-priced major log platform on list. The trade-off is the most powerful query language (SPL) and the deepest enterprise security ecosystem.

What is the cheapest log management solution?

Self-hosted Loki backed by S3 for storage is the cheapest commercial-quality option at scale. Among managed services, Grafana Loki Cloud and Elastic Cloud are the lowest-priced; Datadog and Splunk anchor the higher end of the market.

What is the difference between log ingestion and indexing?

Ingestion is the cost to receive and store logs in their raw form. Indexing is the cost to make logs searchable across all fields. Some vendors (Datadog, Splunk) charge for both. Others (Loki) index only labels and store the rest in cheap object storage; full-text search costs more at query time but bulk storage is cheap.