Log Analytics pricing is per GB a workspace ingests, by table plan (Analytics, Basic, Auxiliary) and pricing model (pay-as-you-go or commitment tier), plus per GB and month for retention beyond the included period, per GB scanned for queries on Basic and Auxiliary tables, search jobs and restores, and Azure Monitor charges beside it for metrics per 10 million samples, alert rules per monitored resource or time series, and notifications beyond the free allowances. The bill is almost always dominated by ingestion into Analytics tables: Microsoft itself calls it the largest item for most customers, and Application Insights and Container Insights are not prices of their own but data sources that fill exactly that ingestion.
Pricing dimensions
| What is metered | Unit | What drives it | Optional |
|---|---|---|---|
| Ingestion into Analytics tables | Per GB at pay-as-you-go, the first 5 GB a month per billing account free; 31 days of interactive retention included; what is metered is the billable size without standard columns, on average about a quarter smaller than the raw event | Diagnostic settings, agents, Application Insights, Container Insights, Sentinel connectors | No |
| Commitment tier | Per day and tier from 100 GB to 50,000 GB a day, overage at the tier's price per GB; 31 days of commitment, then cancellable at any time; Analytics tables only | The daily ingestion volume of the workspace or the dedicated cluster | Yes |
| Ingestion into Basic tables | Per GB at the reduced fixed price, 30 days of retention included, queries per GB scanned | Verbose logs that are rarely queried, such as container logs | Yes, per table |
| Ingestion into Auxiliary tables | Per GB at the lowest fixed price, metered uncompressed, 30 days included, queries per GB scanned | Long-term and compliance logs with very rare access | Yes, per table |
| Interactive retention | Per GB and month beyond the 31 days, up to two years, per workspace or per table | Analytics tables that stay queryable longer | Yes |
| Long-term retention | Per GB and month, the same price for every table plan, total retention up to twelve years; access only through a search job or a restore | Compliance periods | Yes |
| Search jobs and queries on Basic and Auxiliary | Per GB scanned, plus ingestion of the search results at the Analytics price | Investigations in long-term data and in Basic or Auxiliary tables | Yes |
| Restore | Per GB and day, at least 2 TB and 12 hours | Intensive queries on archived periods | Yes |
| Export and processing | Data export per GB; platform logs to destinations other than a workspace per GB; transformations that discard more than half the data per GB above the threshold | Streaming into storage accounts or Event Hubs, filters in data collection rules | Yes |
| Metrics | Platform metrics free; metrics in the Azure Monitor workspace (Prometheus, OpenTelemetry) per 10 million samples ingested and per 10 million queried, 18 months of retention included; metrics API calls per 1,000 above a million a month | Managed Prometheus on AKS, custom metrics | Yes |
| Alert rules | Per monitored resource or time series and month by signal and frequency (1, 5, 10, 15 minutes); ten metric time series free, activity log and service health rules free, dynamic thresholds as a surcharge | The number of rules, dimensions and resources | Yes |
| Notifications | Emails above 1,000, push above 1,000, webhooks above 100,000 a month; SMS and calls per country after an allowance | Action groups | Yes |
| Availability tests | Standard web tests per execution, ping tests free | The number of tests times locations times frequency | Yes |
| Purchase option | The commitment tiers are this service's commitment; there are no reservations and no Savings Plans, EA and MCA discounts apply to tier and list prices. How such a commitment is assessed is shown in reserved capacity for managed services |
Application Insights has had no ingestion price of its own since the move to workspace-based resources: telemetry lands in the App tables of the Log Analytics workspace, counts towards its pay-as-you-go or commitment tier billing and keeps 90 days without a retention fee; a daily cap and sampling limit the volume. Container Insights is the same pattern for AKS: the tables ContainerLogV2, Perf, KubePodInventory and InsightsMetrics fill the ingestion, presets, namespace filters and the Basic plan for ContainerLogV2 throttle it, and the metrics move with Managed Prometheus to the cheaper sample meters.
How it appears in your billing data
Microsoft spreads a workspace's items over four service names, and its own meter reference names them: the ServiceName or MeterCategory Log Analytics carries the pay-as-you-go ingestion (Pay-as-you-go Data Ingestion, new name Analytics Logs Pay-as-you-go Data Ingestion) and the interactive retention (Pay-as-you-go Data Retention, new Analytics Logs Retention); Azure Monitor carries almost everything else: Basic Logs Data Ingestion, Auxiliary Logs Data Ingestion, the tiers 100 GB Commitment Tier Capacity Reservation to 50000 GB Commitment Tier Capacity Reservation, Data Archive (new Long-term Retention), Search Queries Scanned, Search Jobs Scanned, Data Restore, Log Analytics data export Data Exported, Logs Processed GB, Platform Logs Data Processed, Metrics ingestion Metric samples, Prometheus Metrics Queries Metric samples, Native Metric Queries API Calls, the alert meters Alerts Metric Monitored, Alerts Dynamic Threshold, Alerts System Log Monitored at 1 Minute Frequency and Alerts Resource Monitored at 1 Minute Frequency (with variants for 5, 10 and 15 minutes) and Standard Web Test Execution. Application Insights remains for Multi-step Web Test and the old enterprise node meters, Insight and Analytics for the legacy per-node plan and the meter Standard Data Included per Node, which also books the 500 MB per server and day from Defender for Servers.
The ResourceId is the workspace (microsoft.operationalinsights/workspaces), also for workspace-based Application Insights; only classic Application Insights resources and multi-step web tests sit at microsoft.insights/components. Attribution per application or cluster is therefore not in the export but visible only in the workspace's Usage table; what the page on Azure cost exports says about the fields applies here per workspace. Alert meters are not regional, ingestion and retention meters are, and a dedicated cluster books the ingestion at the cluster or proportionally per workspace, depending on the chosen billing mode. With Microsoft Sentinel active, Basic and Auxiliary ingestion and, in the simplified pricing, the Analytics ingestion too run on Sentinel meters; the page on Sentinel, Defender and Key Vault describes those items. In the FOCUS export the commitment tier is ChargeCategory Usage with a daily quantity, not an upfront payment; x_SkuMeterName carries the meter name (FOCUS columns). The cost per Kubernetes namespace that Container Insights causes does not reach the export; the page on Kubernetes cost data names the alternatives.
Levers
Configuration:
- Table plan per table. Basic ingestion costs about a fifth, Auxiliary about a fortieth of the Analytics price in Germany West Central; the price for that is queries per GB scanned and 30 days of retention. Container logs and audit logs are the usual candidates.
- Collect what is queried. Data collection rules with transformations, Container Insights presets, namespace filters, sampling and a daily cap in Application Insights lower ingestion at the source; from more than half the data discarded, Microsoft charges the processing per GB.
- Retention per table. The 31 days are included in the ingestion price, a shorter period saves nothing; longer interactive retention costs five times the long-term retention per GB and month. Tables that stay only for audits belong in long-term retention.
- Bundle alert rules. A log alert rule with dimensions counts per time series; few rules split by resource are cheaper than one rule per resource.
Purchase option:
- Commitment tier from the break-even point. The break-even point lies where the tier's daily price undercuts the pay-as-you-go cost of the actual volume, in the example below at about 85 GB a day for the 100 GB tier; the workspace's "Usage and estimated costs" page computes every tier against the last 31 days. After 31 days of commitment the tier can be lowered; how to check a commitment's coverage and utilisation is shown in commitment coverage and utilisation.
- Merge workspaces. If no workspace reaches a tier alone, a dedicated cluster with several workspaces might; the trade-off against access and Sentinel boundaries belongs to architecture choices and cost.
Architecture:
- Metrics instead of logs. Managed Prometheus charges samples per 10 million and keeps them 18 months; the same values as log lines in
PerforInsightsMetricscost Analytics ingestion per GB. - Empty workspaces and forgotten diagnostic settings. A diagnostic setting that keeps sending all categories of a retired application, or a workspace in a commitment tier without load, belongs to the idle and orphaned resources.
Where it goes wrong
- The export shows no team. Symptom: one workspace carries the whole ingestion, no team recognises its share. Cause: the export knows only the workspace; the
Usagetable or_BilledSizeper table and resource shows which source delivers the volume. - Two services for one bill. Symptom: Log Analytics costs appear partly under
Azure Monitor, partly underLog Analytics. Cause: Microsoft spreads the meters over both service names, commitment tiers and Basic ingestion sit underAzure Monitor; filter by both and by the workspace. - Commitment tier too high. Symptom: the tier's daily price is above what the volume would cost at the pay-as-you-go price. Cause: the volume fell, the tier stayed; after the 31 days it can be lowered, within the first six hours after choosing it as well.
- Retention after switching off. Symptom: retention items for tables nothing flows into any more. Cause: stored data is charged until the end of the retention, even after deleting a custom table; set the retention to the minimum before switching a source off.
- Basic table with many queries. Symptom: items
Search Queries Scannedgrow after the move to the Basic plan. Cause: every interactive query on a Basic or Auxiliary table costs per GB scanned in the period; dashboards and alert rules on such tables multiply it. - Container Insights collects everything. Symptom: an AKS cluster's ingestion exceeds that of its applications. Cause: the default preset collects container logs of all namespaces, performance data and inventory every minute; a leaner preset, namespace filters and Basic Logs for
ContainerLogV2are the levers.
Example
List prices from the Azure Retail Prices API in EUR for Germany West Central, read on 2026-10-21: Analytics ingestion at pay-as-you-go costs EUR 2.631116 per GB after the first 5 GB, Basic ingestion EUR 0.571982, Auxiliary ingestion EUR 0.061598 per GB; the 100 GB tier costs EUR 222.49208 per day, the 200 GB tier EUR 417.740232, the 500 GB tier EUR 981.916579 per day; interactive retention beyond 31 days costs EUR 0.114396, long-term retention EUR 0.022879 per GB and month; search jobs EUR 0.00572 per GB scanned, restore EUR 0.114396 per GB and day; metrics ingestion EUR 0.140795 per 10 million samples. The break-even point for the 100 GB tier lies at 222.49208 divided by 2.631116, so 84.6 GB a day; a workspace with 120 GB a day pays EUR 315.73 a day at pay-as-you-go, 1.2 units or EUR 266.99 in the 100 GB tier, and the 200 GB tier pays off only from 187.8 GB a day, because the overage of the 100 GB tier runs at its tier price of EUR 2.22 per GB. The figures show that the first tier applies from a good 85 GB a day and that the Basic and Auxiliary plans lower ingestion more than any tier.
Sources
Read on 2026-10-21. Microsoft: Azure Monitor pricing, Azure Monitor cost and usage, Azure Monitor Logs cost calculations, Azure Monitor meter names, data retention in a Log Analytics workspace, Container Insights cost, cost details fields, FOCUS schema of the cost export. Prices: Azure Retail Prices API, EUR, Germany West Central, queries Log Analytics and Azure Monitor.