Azure Log Analytics Pricing and Data Retention Period

Few topics don’t need any briefing so let’s directly jump to the costing factors involved with Azure Log Analytics Workspace.

You are charged for two thingsData Ingestion i.e. amount of data collected and Data Retention i.e. how long you want to retain the data collected.

Free Tier –

  1. Data Ingestion = capped to 500MB/day and
  2. Data Retention = 7 days by default and the maximum limit in this tier
  3. Even though you can see that Data Retention option is enabled there but if you try to change it in this tier, this will end up with an error saying that you can not go beyond 7 days

Paid offerings –

  1. Two options like Pay-As-You-Go and Capacity Reservation per day
  2. Under Pay-As-You-Go, you pay per gig cost for data ingestion e.g. €2.522 per GB
  3. For Capacity Reservation, you reserve the capacity like 100 GB per day e.g. €213.22 per day. This is more or less mathematically similar to per gig cost but with some discount involved.
  4. Both options allows you to configure data retention up to 730 days

730 days = 2 Years

You can configure a separate data retention period for each data type (table) though this can be done through ARM template or by running ARM API only.

If your daily data generation per day is not huge then Pay-As-You-Go is quite a better and economical option in comparison to reserved capacities.

One thing worth mentioning here is that the capacity reservation and the cost associated with it is a per-day metric. This is in contrast to a generic mindset that costs are monthly. So, be mindful of this fact when you are looking at it.

The best part is that you can switch between the tiers instantly and without any upgrade/downgrade restrictions i.e. you can switch from free tier to paid tier (Pay-As-You-Go) and then back to free tier anytime though with reserved capacities you need to complete on billing cycle i.e. 31 days. Also, switching the tier will have obvious impact on the data stored and a purge accordingly if lower tier doesn’t support equivalent flexibility.