Nobody Decided to Spend $8,000 a Month on Logs

Open your Azure invoice and find Log Analytics. In a lot of mid-size environments it sits in the top five services, ahead of databases that actually serve customers. Ask who approved that spend and you'll usually get a shrug, because nobody did.

Log Analytics cost is rarely a decision. It's the sum of a hundred small defaults: a diagnostic setting ticked "all categories", an AKS cluster shipping every line of stdout, a VM insights onboarding that switched on dependency mapping nobody looks at.

Each default is reasonable on the day. Together they become a bill.

Why this line item grows quietly

Ingestion has no natural owner. The platform team owns the workspace. App teams own what their containers log. Security owns the Defender and Sentinel decisions. Networking turned on firewall diagnostics during an incident two years ago and never turned them off.

Everyone pays. Nobody looks.

A worked example

The figures below are illustrative, not a client case. Take a hypothetical 600-person organisation with one central workspace ingesting 60 GB a day into the Analytics plan. Assume, for round numbers, $4.50 per GB for Analytics ingestion and $1.00 per GB for Basic (AUD). Real Australia East rates will differ, so run your own numbers in the Azure pricing calculator.

60 GB × 30 days × $4.50 = $8,100 a month, or roughly $97,000 a year. Here's where it comes from:

• ContainerLogV2 (AKS stdout and stderr): 25 GB a day, about $3,375 a month.
• AzureDiagnostics (firewall, Application Gateway, Key Vault): 15 GB a day, about $2,025 a month.
• Perf (VM counters every 10 seconds): 8 GB a day, about $1,080 a month.
• SecurityEvent and Syslog: 7 GB a day, about $945 a month.
• Everything else: 5 GB a day, about $675 a month.

Three changes, none of which remove anything an engineer actually uses:

1. Container logs to Basic. Microsoft notes ContainerLogV2 is compatible with Basic logs. Those logs are read during troubleshooting, not by alert rules. 25 GB × 30 × ($4.50 − $1.00) = $2,625 a month less. The trade-off: Basic charges per GB scanned when you query, so it suits tables you search occasionally, not dashboards that hit them every minute.
2. Filter the diagnostics. Diagnostic settings only let you pick categories, so use a workspace transformation in a data collection rule (DCR) to drop low-value rows and columns, such as allowed-traffic firewall entries. Cutting 6 of the 15 GB: 6 × 30 × $4.50 = $810 a month.
3. Slow the counters down. Moving VM performance counters from 10-second to 60-second sampling in the Azure Monitor agent DCR takes Perf from about 8 GB to about 2 GB a day in this scenario: 6 × 30 × $4.50 = $810 a month.

New monthly figure: 23 GB a day on Analytics ($3,105) plus 25 GB a day on Basic ($750) = $3,855. That's about $4,245 a month less on paper, in a made-up scenario. Your mix will be different, and query charges on Basic tables need watching for the first month.

What's not on the list: a commitment tier

Commitment tiers start at 100 GB a day and apply only to Analytics Logs ingestion. Basic and Auxiliary Logs are billed at flat per-GB rates and aren't covered. At 60 GB a day you'd be paying for capacity you don't use.

Shrink first, then decide whether a tier still makes sense.

How to check your own estate

These steps are read-only.

1. Find your top five tables

Open the workspace in the Azure portal and go to Monitoring > Insights for a usage breakdown, or run this in Logs to see billable volume by table over the last 30 days:

Usage
| where TimeGenerated > ago(30d)
| where IsBillable == true
| summarize BillableGB = sum(Quantity) / 1000 by DataType
| sort by BillableGB desc

The Usage table is itself free from ingestion charges, so looking costs nothing.

2. Put an owner against each table

Not a team mailbox: a person. This is the Allocation capability from the FinOps Framework applied to one service. Unowned volume grows.

3. Check Advisor for Basic plan candidates

Azure Advisor flags tables ingesting more than 1 GB a month that are eligible for the Basic plan, and raises a recommendation when ingestion is much higher than in the previous weeks. It won't tell you which diagnostic categories are pointless, so treat it as a starting list.

4. Hunt for duplicates

Look for the legacy Log Analytics agent and the Azure Monitor agent both running on the same VM, and for overlapping data collection rules sending the same data to more than one workspace. Microsoft's cost guidance warns against both unless each is collecting unique data.

5. Set an alert, not just a cap

A daily cap stops collection for the rest of the day once it's hit, which means you lose data exactly when something may be going wrong. Microsoft says the cap shouldn't be used as a method to reduce costs. Alert on unusual ingestion instead, and treat a spike as a question to answer.

The point

None of this is clever. It's attention, applied to a line item that has been running on defaults.

The hard part isn't knowing what Basic Logs is. It's sitting down with the usage data and asking, table by table, "who reads this?"

Sources

• Cost optimization in Azure Monitor (Microsoft Learn)
• Azure Monitor Logs cost calculations and options (Microsoft Learn)
• Azure Monitor pricing, Australia (Microsoft Azure)
• FinOps Framework overview (FinOps Foundation)
• State of FinOps 2026 (Linux Foundation press release)
• FinOps on Azure (Microsoft Azure)