Practical guide
CloudWatch log retention vs ingestion: which change saves money?
compare CloudWatch log retention and ingestion savings. Includes a worked example, calculator scope, and practical questions.
Updated · Sources checked
Retention and ingestion solve different cost problems
Reducing how much data an application sends affects ingestion. Reducing how long that data is retained affects storage. Neither change is a substitute for the other, and shortening retention does not undo ingestion that has already occurred.
Decide which line item is growing before changing the logging policy. A sudden increase in emitted events calls for a different investigation from several years of accumulated retained logs.
Worked example: constant ingestion with two retention policies
Suppose an application sends a steady 10 GB of uncompressed logs each day. In a 30-day month it sends 300 GB regardless of whether retention is seven days or 30 days.
Assume, purely for a separate storage illustration, that each day’s retained data occupies 2 GB after the relevant storage representation. Once the policy reaches steady state, seven days corresponds to approximately 14 GB retained, while 30 days corresponds to 60 GB. That hypothetical size factor must be measured for a real workload.
Both policies still enter 300 GB in the ingestion calculator. The 46 GB difference belongs in a separate storage calculation and is not a 46 GB ingestion reduction. The first month after a policy change can have a transition period, so a steady-state comparison is not an exact forecast for that month.
Choose a policy around investigation needs
List how far back incident response, operational debugging, and required records need to reach. Different log groups can have different uses; one blanket retention period can preserve too much low-value data while deleting useful evidence too soon.
Then review whether queries repeatedly scan broad time ranges. Analysis charges are separate from the ingestion-only calculator, so narrowing query scope can matter without changing emitted bytes or retention.
The tool also excludes archive, Logs Insights, Live Tail, export, delivery, and data-protection costs. Vended logs and Infrequent Access use different pricing structures. Do not apply its Standard first-tier result to every line item labelled CloudWatch.
Frequently asked questions
Will deleting old logs refund ingestion? No. Previously processed ingestion is a separate service event.
What input should change when retention changes? The ingestion input stays the same if emitted data stays the same. Update the separate retained-storage model and account for the transition period.
Calculate your scenario
Use the cloudwatch logs cost calculator. Keep the displayed region, pricing date, billing units, and exclusions alongside your result. The arithmetic examples above illustrate usage or explicitly hypothetical rates; they are not AWS quotes.
Source
Billing structure checked against official AWS documentation on September 6, 2026.