Documentation Grafana Cloud Cost management and billing Reduce costs Logs costs

Reduce Grafana Cloud Log costs

Reduce log ingestion costs

To reduce your Grafana Cloud Logs costs, you need to reduce the volume of logs you are sending to Grafana Cloud. Start by looking at Analyze Grafana Cloud Logs costs to identify what software applications and infrastructure are generating the most logs, so that you can decide what areas you want to focus on to reduce log volumes. After you have identified these areas, make changes to your client to drop log lines before they’re sent to Grafana Cloud.

Drop log lines via Grafana Agent

If using Grafana Agent in Flow mode use the stage.drop block to configure a filtering stage that drops log entries based on several conditions, such as the log line length, age, or matching a regular expression.

If you are running Grafana Agent on Kubernetes, try the Kubernetes Logs module. It provides out-of-the-box Flow configurations that include options for trimming or dropping log lines.

If using Grafana Agent in static mode, configure drop and match pipeline stages in the logs_config in the same way you would with Promtail directly. For more information, refer to Drop log lines with Promtail.

Drop log lines with Promtail

Promtail allows you to filter out log lines based on age, length, or content, by using its match and drop pipeline stages.

Drop log lines with other clients

Grafana Cloud Logs accepts log lines sent by other third party clients. To drop log lines via a third party client, refer to that client’s documentation.

Reduce log query usage costs

Grafana Cloud Logs pricing includes a fair use query policy that allows you to query up to 100X your ingested logs volume each month at no additional charge.

You can review log query activity on the Billing and Usage dashboard on the Logs Ingestion and Query Details panel. Usage alerts can be configured from the panels displayed on the Billing and Usage dashboard to notify your team when activity exceeds expected levels.

Alerting and recording rules

The majority of log query usage costs are due to alert rule configuration issues. For alerting rules using the Loki data source, it is recommended to follow the best practices listed below:

1. Use instant queries instead of range for all rules. An instant query is executed once and produces one data point for each series matched by your label selectors. Range queries are effectively instant queries executed multiple times and contribute to higher query usage.
2. Review the evaluation period as it relates to the interval period and ensure these intervals match the amount of time queried. For example, an alert rule that runs every 30 seconds and queries 1 hour of data returns redundant results and query excess data. A rule that runs once per minute should have a query range of 1m.
3. Review alert rules run by the recorded queries scheduler to ensure recording rules are configured as instant queries with optimized evaluation periods as described in the preceding steps.