Cutting CloudWatch Logs costs hiding in a few log groups
A line item that is easy to ignore
CloudWatch Logs rarely shows up as a headline on an AWS bill, which is exactly why it is worth checking. The cost is spread across ingestion, storage, and retention, and it accumulates quietly on log groups that were configured once and never revisited. By the time it is real money, it is buried among hundreds of other log groups.
One log group, $8,000 a year
On one client the biggest single offender was a VPC flow log. Flow logs can be extremely verbose, and this one group had accumulated 2TB of data, costing about $8,000 a year on its own.
The fix was not exotic. First, confirm with the team that they actually need this data at this level of detail, because often nobody does. Then set a sensible retention so the group is not keeping very detailed data forever, and put it on the appropriate log class rather than the standard, most expensive ingestion path. Configuring a couple of fields on that one resource saved roughly $8,000 a year.
The same pattern showed up on another client, where the biggest offender was a Kubernetes container insights log group costing about $1,000 a year. Same root cause: no retention limit and the standard, most expensive ingestion class.
The hard part is finding them
Neither of these clients had one obvious expensive log group. Each had a few hundred log groups, and the costly one was a needle in a haystack. That is the actual work here, and it is why this so rarely gets cleaned up in-house: no engineer is going to open several hundred log groups by hand to find the two that matter.
I built automation that finds the biggest offenders across all log groups in seconds, and can then apply the right retention and log class across them. Once you can see the whole set ranked by cost, the fix itself is trivial.
What to check on your own account
If you want to look before reaching out, the questions are simple:
- Which log groups have no retention limit set? Those keep everything forever by default.
- Which groups are the largest by stored and ingested volume? Flow logs and container insights logs are common culprits.
- Do you actually need the full verbosity you are capturing, or would a sampled or shorter-retention version do?
For most teams, a handful of changes on the few biggest groups is the entire win. The rest is not worth the effort.
If you suspect CloudWatch Logs is costing you more than it should and want a fast look across all your log groups, book a discovery call or reach out on LinkedIn.
-Cristian