Log Storage & Retention TCO
500 GB/day logs, 30-day retention = 15 TB stored. SaaS SIEM pricing: $30K/month. Self-hosted Loki + S3: $1.5K/month. That is a 20× difference — an order of magnitude. Model your log rate, retention, compression, and replication to project 1/3/5-year TCO across self-managed (ELK, Loki) and SaaS (Datadog, Splunk, Grafana Cloud).
📐 Log Ingestion Profile
Set log rate (events/sec), avg event size, retention days, replication factor, and compression ratio. The engine computes daily ingest volume, total stored TB, and 1/3/5-year TCO across self-managed and SaaS stacks.
Log Storage Economics: Why Retention Costs Spiral
Observability data — logs, metrics, and traces — is now the fastest-growing storage category in most cloud infrastructures. A mid-size SaaS platform generating 10,000 log events per second at 512 bytes each produces ~442 GB of raw logs per day. Over a 30-day retention window, that's 13 TB of data before compression and replication. The decisions you make about retention, compression, and storage tier directly translate to thousands of dollars per month in infrastructure spend.
Self-Managed vs. SaaS: The Real Trade-Off
| Solution | Ingest Cost Model | Storage Cost Model | Operational Overhead | Best For |
|---|---|---|---|---|
| Self-Built ELK (Elasticsearch) | Compute nodes (~$300/node/mo) | SSD/HDD (~$0.03–0.10/GB/mo) | High — cluster tuning, shard management, upgrades | Teams with dedicated infra engineers; predictable workloads |
| Self-Built Loki + Grafana | Compute (~$200/node/mo) | Object storage (~$0.02/GB/mo) | Medium — simpler than ELK, no index management | Kubernetes-native stacks; cost-sensitive teams |
| Datadog Log Management | ~$0.10/GB ingested | Included retention (7–30d); extended retention extra | Low — fully managed | Teams that value turnkey UX and unified observability |
| Splunk Cloud | ~$2.50/GB indexed volume | Bundled with ingest; archive to S3 extra | Low — fully managed | Security/SIEM use cases; enterprises with existing Splunk investment |
| Grafana Cloud Logs | ~$0.50/GB ingested | Included retention (13–30d); custom retention available | Low — managed Loki under the hood | Teams already in the Grafana ecosystem; balanced cost/features |
Compression: The Hidden Multiplier
Text logs are highly compressible. A typical JSON-structured log line compresses at 8–12:1 with modern algorithms (zstd, Brotli). That means your 13 TB of raw logs becomes ~1.3 TB on disk. But not all solutions leverage compression equally — self-managed stacks let you control compression settings; SaaS vendors often charge by uncompressed ingested volume, which can swing costs by an order of magnitude.
Replication: Durability Has a Price
Running 3× replication for production-grade durability triples your storage footprint. For compliance use cases (SOC 2, HIPAA) where logs must survive a two-node failure, replication is non-negotiable. But for dev/staging environments, 1× (no replication) or relying on cloud object storage durability (11 9's for S3) can cut storage costs by 50–66%.
Why this tool matters: Every observability vendor publishes a pricing page, but none let you compare across self-built and SaaS solutions with your actual workload parameters. This estimator models the full TCO — compute, storage, and operational overhead — so you can make a defensible build-vs-buy decision.
Pricing Basis, Sources & Assumptions
Every rate on this page is a published vendor list price — no negotiated discounts, private pricing, or credit offsets. Totals are in USD and exclude tax. Rates were last checked against the sources below on .
| Pricing input | Basis used on this page |
|---|---|
| Region | us-east-1 (N. Virginia) for the AWS and self-managed rows; SaaS rows use each vendor's published list price, with volume tiers not applied. |
| Currency | USD — on-demand list price, tax excluded |
| Last checked | — List prices were taken from the linked vendor pricing pages; ingest rates move frequently with plan changes, so treat the SaaS rows as starting points. |
Modelling assumptions
- 86,400 seconds per day. Ingested bytes = events/s × average event size × 86,400, divided by the compression ratio.
- Stored bytes = ingested bytes × replication factor × retention days.
- Self-managed rows use published object-storage list prices ($0.02–$0.03 per GB-month) plus node cost of roughly $200–$300 per node per month for Elasticsearch or Loki clusters.
- SaaS rows quote published list prices per GB ingested — Datadog ~$0.10, Grafana Cloud ~$0.50, Splunk Cloud ~$2.50 per GB indexed — and include each vendor's bundled retention window (7–30 days depending on plan).
- Compression is modelled as a simple divisor on stored bytes; it does not change ingest billing on any platform that meters at the door.
What this model excludes
- Volume-tier discounts, annual commits, and negotiated agreements.
- Query, dashboard, and custom-metric charges, plus egress.
- Engineering time except where it is explicitly entered as a cost.
- Index amplification in Elasticsearch, which can store two to three times the raw volume — this model sizes stored bytes, not index size.
Sources
- AWS (2026). "Amazon S3 Pricing." Object-storage rates used for the self-managed retention tier. aws.amazon.com
- AWS (2026). "Amazon CloudWatch Logs Pricing." Ingest and storage rates for the managed AWS comparison. aws.amazon.com
- Datadog (2026). "Datadog Pricing." Log ingest rate and bundled retention window. datadoghq.com
- Grafana Labs (2026). "Grafana Cloud Pricing." Log ingest rate and included retention. grafana.com
- Splunk (2026). "Splunk Pricing." Indexed-volume pricing for Splunk Cloud. splunk.com
Vendor list prices change without notice — re-check the linked pages before committing spend. jslet takes no vendor sponsorship and carries no affiliate links; see about.