Log Storage & Retention TCO
500 GB/day logs, 30-day retention = 15 TB stored. SaaS SIEM pricing: $30K/month. Self-hosted Loki + S3: $1.5K/month. That is a 20× difference — an order of magnitude. Model your log rate, retention, compression, and replication to project 1/3/5-year TCO across self-managed (ELK, Loki) and SaaS (Datadog, Splunk, Grafana Cloud).
📐 Log Ingestion Profile
Set log rate (events/sec), avg event size, retention days, replication factor, and compression ratio. The engine computes daily ingest volume, total stored TB, and 1/3/5-year TCO across self-managed and SaaS stacks.
Log Storage Economics: Why Retention Costs Spiral
Observability data — logs, metrics, and traces — is now the fastest-growing storage category in most cloud infrastructures. A mid-size SaaS platform generating 10,000 log events per second at 512 bytes each produces ~442 GB of raw logs per day. Over a 30-day retention window, that's 13 TB of data before compression and replication. The decisions you make about retention, compression, and storage tier directly translate to thousands of dollars per month in infrastructure spend.
Self-Managed vs. SaaS: The Real Trade-Off
| Solution | Ingest Cost Model | Storage Cost Model | Operational Overhead | Best For |
|---|---|---|---|---|
| Self-Built ELK (Elasticsearch) | Compute nodes (~$300/node/mo) | SSD/HDD (~$0.03–0.10/GB/mo) | High — cluster tuning, shard management, upgrades | Teams with dedicated infra engineers; predictable workloads |
| Self-Built Loki + Grafana | Compute (~$200/node/mo) | Object storage (~$0.02/GB/mo) | Medium — simpler than ELK, no index management | Kubernetes-native stacks; cost-sensitive teams |
| Datadog Log Management | ~$0.10/GB ingested | Included retention (7–30d); extended retention extra | Low — fully managed | Teams that value turnkey UX and unified observability |
| Splunk Cloud | ~$2.50/GB indexed volume | Bundled with ingest; archive to S3 extra | Low — fully managed | Security/SIEM use cases; enterprises with existing Splunk investment |
| Grafana Cloud Logs | ~$0.50/GB ingested | Included retention (13–30d); custom retention available | Low — managed Loki under the hood | Teams already in the Grafana ecosystem; balanced cost/features |
Compression: The Hidden Multiplier
Text logs are highly compressible. A typical JSON-structured log line compresses at 8–12:1 with modern algorithms (zstd, Brotli). That means your 13 TB of raw logs becomes ~1.3 TB on disk. But not all solutions leverage compression equally — self-managed stacks let you control compression settings; SaaS vendors often charge by uncompressed ingested volume, which can swing costs by an order of magnitude.
Replication: Durability Has a Price
Running 3× replication for production-grade durability triples your storage footprint. For compliance use cases (SOC 2, HIPAA) where logs must survive a two-node failure, replication is non-negotiable. But for dev/staging environments, 1× (no replication) or relying on cloud object storage durability (11 9's for S3) can cut storage costs by 50–66%.
Why this tool matters: Every observability vendor publishes a pricing page, but none let you compare across self-built and SaaS solutions with your actual workload parameters. This estimator models the full TCO — compute, storage, and operational overhead — so you can make a defensible build-vs-buy decision.