Understanding cost
The Cost Analytics page breaks down ingestion volume and storage so you can see what's driving your bill.
Header
- Title:
Cost Analytics · Ingestion volume and storage breakdown. - Top-right: time-window dropdown (default
Last 30 days) + Refresh.
KPI tiles
Four tiles across the top, scoped to the chosen window:
| Tile | Means |
|---|---|
| Total ingestion | Bytes ingested in the window. |
| Log events | Total log line count across all sources. |
| Metric points | Total metric data points across all sources. |
| 30-day projection | Estimated total at the current ingestion rate. |
Ingestion volume over time
Area chart showing daily ingestion broken out by signal — Logs, Metrics, Spans — over the chosen window. Toggle each series via the legend below the chart.
Signal breakdown
Donut chart on the right showing the storage distribution across signals:
- Logs (largest share for most installations).
- Metrics.
- Spans.
Numbers next to each legend entry give the absolute size for that signal.
Per-source breakdown
A table at the bottom listing every source with its volume by signal:
| Column | Means |
|---|---|
| SOURCE | Source name. |
| LOGS | Bytes + event count (e.g. 11.8 GB · 23.3M events). |
| METRICS | Bytes + point count. |
| SPANS | Bytes + span count. |
| TOTAL | Sum across signals. |
| SHARE | Percentage of total ingestion + horizontal bar. |
Sorted by share descending. Use this to spot the source that's driving cost.
Retention controls
Hot store and cold tier retention are configured server-side in configs/server.yaml. Changes require an operator to edit the YAML and restart the server. The Cost page does not surface retention as an editable control today.
Reducing cost
Cheapest levers, in order:
- Pipelines — drop debug logs, sample high-volume sources. See Pipelines.
- Retention — shorten the hot-store window. Lots of storage savings with small impact on day-to-day investigation.
- Cold tier — push older data to S3-compatible storage. Cheaper but slower to query.
- Source consolidation — if test/staging clusters generate as much data as prod, consider sampling them harder.