CloudWatch Logs DataProcessing-Bytes: the log ingestion line

What it costs

US East (N. Virginia); other regions differ. Checked 2026-11-04. Sources: AWS CloudWatch pricing, AWS price list file, AmazonCloudWatch offer, us-east-1.

Example with made-up numbers

Typical causes

Debug or request-level logging left on in production

A verbose log level or full request/response logging multiplies bytes per request.

Log groups with retention set to never expire

Storage keeps accruing at $0.03 per GB-month forever, even for logs nobody reads.

Load balancer, VPC flow and Lambda logs

Services that publish logs to CloudWatch by default or by an option someone ticked; Lambda functions with a busy invocation rate log at least a few lines per call.

Retry loops writing the same error

A failing dependency produces an error line on every retry, so one incident turns into gigabytes.

The fix, step by step

Verify first

Check these before you change anything: the steps below are suggestions, and only you can see your own configuration.

• Find the top log groups by ingestion: CloudWatch > Log groups, sort by stored bytes, and use the IncomingBytes metric (namespace AWS/Logs) per log group over the last 30 days.
• Ask who relies on those logs: compliance, audit or on-call debugging may require them and a given retention. Do not shorten retention below a stated requirement.
• Check for subscription filters or export tasks that depend on the group.
• Change log level in one service first and compare IncomingBytes after a week.

In the console

1. CloudWatch console > Logs > Log groups: add the Retention column; sort by Stored bytes.
2. For each group where the requirement allows it: Actions > Edit retention setting > choose a period (for example 30 days).
3. Lower the log level in the application config (INFO or WARN instead of DEBUG), or add a filter in the logging agent so repetitive lines are dropped.
4. Metrics > All metrics > Logs > Log Group Metrics > IncomingBytes to confirm the drop.

With the CLI

aws logs describe-log-groups --query 'logGroups[].[logGroupName,retentionInDays,storedBytes]' --output table

aws logs put-retention-policy --log-group-name /example/app --retention-in-days 30   # after confirming requirements

aws cloudwatch get-metric-statistics --namespace AWS/Logs --metric-name IncomingBytes --dimensions Name=LogGroupName,Value=/example/app --start-time 2026-10-04T00:00:00Z --end-time 2026-11-03T00:00:00Z --period 86400 --statistics Sum

Rollback

Raise the retention again; logs already deleted under the shorter period are gone. For log-level changes, revert the config; keep a note of the old level.

See your CloudWatch lines in your own bill

Drop in your Cost Explorer or CUR CSV. Billtrim reads it in your browser and ranks the CloudWatch lines by dollars.

Get my ranked savings list See a sample result

Paste your export: how to export a Cost Explorer CSV or CUR file in two minutes.

Questions people ask

Is storing logs or sending logs more expensive?

Per GB, ingestion at $0.50 is higher than one month of storage at $0.03, but storage recurs every month for as long as the data is kept.

Can I send logs somewhere cheaper?

Possibly, but alternatives have their own prices and operating costs; compare with your real volume before moving.

Does this page cover custom metrics?

No. Custom metrics are a separate CloudWatch charge not covered here.

Related

• NatGateway-Bytes: the NAT Gateway data-processing line
• TimedStorage-ByteHrs: the S3 Standard storage line
• DataTransfer-Out-Bytes: internet egress on your bill

Part of the guide: Why is my AWS bill so high? Check these 8 line items first