Observability costs follow data volume, not running time: every log line, metric series and trace span is billed where it lands, for ingestion, for retention (on Azure and Google Cloud beyond an included period) and, on some plans, for every query. The bill therefore tracks what applications emit and how long it is kept. A higher log level or a new service that logs every request changes it overnight, with no new resource.
How it works
All three providers split observability into the same parts: log ingestion, storage (on AWS from the first GB, on Azure and Google Cloud beyond an included period), metrics, traces, queries and alerts. Standard metrics of the providers' own services are free; applications and agents pay for what they write on top.
AWS
Amazon CloudWatch bills logs twice: on ingestion per GB, by log class Standard or Infrequent Access, and on storage per compressed GB per month. Logs Insights queries cost per GB scanned. Vended logs, which AWS services such as VPC Flow Logs deliver themselves, have their own volume tiers per destination. Classic custom metrics cost per metric per month, and CloudWatch counts every combination of dimensions as a separate metric. Alarms cost per alarm metric. Traces are priced under Application Observability on the CloudWatch pricing page: per GB of spans ingested plus per million spans indexed, or per X-Ray trace recorded. The monthly free tier includes 5 GB of log data, 10 custom metrics and 100,000 traces recorded.
Azure
Azure Monitor charges mainly for the Log Analytics workspace, which appears as a service of its own on the subscription's bill. Ingestion costs per GB by table plan: Analytics Logs cost most and include 31 days of retention (90 days with Microsoft Sentinel) and free queries; Basic Logs and Auxiliary Logs cost less and include 30 days, but bill every query per GB scanned. Commitment tiers from 100 GB per day lower the price per GB for Analytics Logs only and bind for 31 days at a time. Longer retention costs per GB per month, interactive for up to two years or as long-term retention for up to twelve. Application Insights writes to a workspace and is billed there as ingestion. Once Microsoft Sentinel is enabled on a workspace, all data collected in it also incurs Sentinel charges.
Google Cloud
Cloud Logging bills writing to a log bucket as a one-time charge per GiB that includes 30 days of storage; the first 50 GiB per project per month are free. Longer retention costs per GiB per month, while the _Required bucket with its fixed 400 days costs nothing. Queries carry no extra charge. The project that owns the bucket pays, and an entry routed to three buckets is charged three times. Cloud Monitoring bills metrics by bytes ingested, with the first 150 MiB per billing account free, or by samples for Managed Service for Prometheus. Google has announced a charge per metric reference in alerting policies, starting no sooner than 2027-09-01. Cloud Trace costs per million spans after 2.5 million free spans per billing account.
| Provider | Ingestion | Retention | Metrics | Traces | Queries |
|---|---|---|---|---|---|
| AWS | per GB by log class | per compressed GB per month | per classic custom metric | per GB of spans or per trace | per GB scanned |
| Azure | per GB by table plan | 30 or 31 days included | platform free, Prometheus per sample | as workspace ingestion | Analytics free, Basic and Auxiliary per GB |
| Google Cloud | per GiB into the log bucket | 30 days included | per MiB or per sample | per million spans | no extra charge |
What it means for your cost
In billing data, observability sits where data is ingested and stored, not with the application that produced it. On Azure the charges appear under the service names Azure Monitor, Log Analytics, Insight and Analytics and Application Insights, and workspace costs are found through an Instance ID containing /workspaces/. On Google Cloud the project holding the log bucket pays, including for entries routed in from other projects. Central logging concentrates the cost in one account, subscription or project as shared cost that a split by data volume per source assigns back (Shared cost and how to split it).
Because price follows volume, mistakes show up as jumps: a debug level left on in production appears as an anomaly in the ingestion line long before anyone reads the logs, and cost anomaly detection catches it sooner than a month-on-month comparison. A budget per workspace or logging project (Cloud budgets) sets the limit. Azure also offers a daily cap per workspace, which stops collection for Analytics and Basic tables until the next reset once reached; Auxiliary tables are not covered.
The decisions are log level, retention period and table plan, settings that work well as rules checked before rollout (Guardrails and approval thresholds). Logs that only need keeping can go to object storage: Google charges nothing for routing through a sink, only for storage in Cloud Storage, and AWS delivers vended logs to Amazon S3 at the vended log rate per GB, where storage classes and lifecycle rules apply. For functions, logs add a line of their own beside invocations and duration (Serverless functions).
Where it goes wrong
- Debug level in production. Symptom: the ingestion line jumps while load stays flat. Cause: a deployment raised the log level, and every extra line is ingested and stored per GB.
- High-cardinality custom metrics. Symptom: the CloudWatch metrics line grows with the number of customers. Cause: a dimension carries a user or request ID, and every combination of dimensions counts as a separate metric.
- Double routing. Symptom: the same logs are charged in the source project and the central one. Cause: a sink routes entries to a second bucket without excluding them from
_Default, and Cloud Logging charges for every bucket. - Sentinel on the operations workspace. Symptom: Sentinel meters appear for application logs. Cause: Microsoft Sentinel was enabled on a workspace holding operational data, so all data there incurs Sentinel charges.
- Queries on Basic Logs. Symptom: after a table moves to Basic or Auxiliary, ingestion falls but a query meter rises. Cause: dashboards and alerts keep querying the table, and every query costs per GB scanned.
Example
List prices in USD, read on 2026-10-16: Amazon CloudWatch in Europe (Frankfurt) USD 0.63 per GB of Standard logs ingested and USD 0.0063 per GB scanned by Logs Insights; Azure Monitor in Germany West Central USD 2.99 per GB of Analytics Logs pay-as-you-go and USD 0.65 per GB of Basic Logs; Google Cloud Logging, listed without a region, USD 0.50 per GiB of logs stored and USD 0.01 per GiB per month for retention beyond 30 days.
Sources
Read on 2026-10-16. Amazon CloudWatch pricing, Azure Monitor pricing, Azure Monitor Logs cost calculations and options, Azure Monitor cost and usage, Set daily cap on Log Analytics workspace, Google Cloud Observability pricing.