Every new service ships logs. Every agent ships telemetry. Every team adds a diagnostic setting and nobody ever turns one off. The result is a Log Analytics bill that compounds quietly, dominated by verbose data that gets ingested, retained, and almost never queried. Observability is frequently among the fastest growing lines in an Azure estate, and disciplined ingestion and retention management routinely cuts it thirty to fifty percent without losing a single insight anyone actually uses, because most of the volume is noise that was collected by default rather than by decision.
Log Analytics charges twice for every gigabyte: once to ingest it and again to keep it past the included retention window. Most cost conversations focus on retention because it sounds like the storage problem, but ingestion is usually the larger and faster growing line. Cutting the bill means addressing both, and addressing ingestion first because it is the volume that retention then multiplies.
Every gigabyte that enters the workspace is billed at ingestion regardless of whether anyone ever queries it. The fastest savings come from sending less, not keeping less.
Beyond the included period, every gigabyte retained bills monthly. The question is not how long data could be useful but how long it is actually queried interactively, which for most operational logs is days, not the months or years they are often kept at full interactive rate.
The most effective lever is treating data by how it is used rather than applying one policy across the whole workspace. Log Analytics now supports per table tiers and retention, so high value security and operational data can sit at the interactive tier while high volume, low value data routes to cheaper tiers built for exactly that profile.
The analytics tier supports full interactive query and alerting at the standard ingestion rate. Reserve it for the tables that dashboards, alerts, and investigations actually touch: security events, application errors, the operational signals teams look at every day.
The basic and auxiliary logs tiers ingest high volume, low value data at a fraction of the analytics rate, trading rich query for cheap storage. Verbose application logs and chatty network data belong here, queryable when an investigation needs them but not paying the analytics premium to sit idle.
Data kept only to satisfy a compliance or retention requirement moves to the archive tier, the cheapest option, queried through a search job on the rare occasion it is needed. This is where the long retention horizons belong, not at interactive rates that pay a daily query premium for data nobody queries.
Three levers close the gap between the bill you have and the bill the workload justifies. Applied in order, they cut volume, then duration, then rate.
Data collection rules and transformations drop the noise before it is ingested and billed. Filtering out health probe chatter, debug verbosity, and redundant fields at the source is the single largest ingestion saving, because the cheapest gigabyte is the one never sent.
Set interactive retention to the window teams genuinely investigate, often thirty to ninety days, and route anything kept longer to long term or archive. Most workspaces carry months of interactive retention on data that has not been queried past week two.
Once volume is rationalized, a daily commitment tier discounts the ingestion rate in exchange for a committed daily volume. Size the commitment against the reduced ingestion, never the inflated number, so the discount lands on real volume rather than locking in the noise you just removed.
The ingestion versus retention model, the per table tiering map, the source filtering method, the retention right sizing approach, and the commitment tier sizing that discounts the rate on the reduced volume. Sent on request.
We profile what your workspaces ingest against what your dashboards and alerts actually query, route each table to the tier that fits its use, filter the noise at source, right size retention to the real investigation window, and size the commitment tier against the reduced volume. The bill comes down and nothing anyone uses disappears.