Log Retention Calculator

Volume compounds faster than people expect

A thousand events per second at 500 bytes each is 43 GB a day, 1.3 TB a month and 15.7 TB a year uncompressed. Structured JSON logs are typically two to four times larger than plain text for the same information, because keys repeat on every line. That trade buys queryability, and it is worth making deliberately rather than discovering it in an invoice.

Compression is where the cost goes

Logs compress extremely well — repeated field names, timestamps and hostnames give ratios of 10:1 to 20:1 with standard algorithms. But indexed hot storage stores logs expanded for search, so the same data can cost ten times more in a searchable tier than in compressed cold storage. Most of the bill is usually indexing, not bytes.

Tier by how the data is actually used

Hot storage covering 7 to 30 days handles incident response, which is when almost every query happens. Warm storage of 30 to 90 days covers investigation and trend analysis. Cold or archival storage covering the compliance period is cheap and slow, which is fine because those logs are read almost never — and when they are, retrieval is planned rather than urgent. A single hot tier sized for the compliance period is the most common and most expensive mistake.

Retention periods are set by obligation, not preference

PCI DSS requires a year with 90 days immediately available. HIPAA requires six years for certain records. SOX requires seven. GDPR pushes the other way, requiring personal data not be kept longer than necessary — so an indefinite retention default is not a safe choice, it is a violation waiting to be found. Where obligations conflict, the answer is different retention for different log types, not one policy covering everything.

Logs are discoverable

Anything retained can be subpoenaed. That is a reason to retain what you need and delete what you do not, on a documented schedule applied automatically. Ad hoc deletion during a dispute looks like spoliation regardless of intent, which is why the schedule matters as much as the period.

Sampling and filtering beat buying storage

Debug logs in production, health-check requests and successful static asset responses commonly make up most of the volume and are almost never queried. Dropping them at the collector, or sampling high-volume low-value events at a small percentage, typically cuts cost far more than any storage optimisation — and improves signal in the process.