One click on CloudWatch Logs Insights, a few seconds waiting for results — and a bill for scanning half a terabyte of logs.

Hi everyone 👋

CloudWatch Logs Insights is a genuinely convenient SQL-like log query tool. The way AWS bills for it, though, catches a lot of people off guard.

😱 The common mistake

Open Logs Insights, pick a log group that’s accumulated 6 months of logs (~500 GB), type a broad search query with no explicit time range set, hit Run.

🔍 What’s actually happening

Logs Insights doesn’t bill based on how many log lines your query returns, or how complex the query is — it bills based on the total raw volume of log data scanned, at roughly $0.005 per GB scanned.

That single click, run against a 500 GB log group: 500 × $0.005 = $2.50, whether your query matched 3 lines or 3 million. It feels cheap for one click. It stops feeling cheap the moment someone wires that same unscoped query into a dashboard on a 5-minute cron job — that’s 500 GB scanned every 5 minutes, and the monthly bill for log scanning alone lands in the thousands of dollars.

🔬 The time range picker is the cost control

It’s easy to miss that the time range selected in the console (or passed to StartQuery) directly determines the GB scanned — there’s no separate “scan budget” setting hiding elsewhere. Narrowing that one control from “6 months” to “last hour” is, by itself, most of the fix.

🛠️ The fix

  • Always scope the query’s time range as tight as possible — the last 15 minutes or 1 hour, not “all time” or an implicit multi-month default.
  • For dashboards or recurring automated queries, this matters even more: a query that runs every few minutes multiplies the scanned-GB cost by however many times it fires.
  • For large-scale historical log analysis, export logs to S3 and query them with AWS Athena instead — querying data at rest in S3 is dramatically cheaper per GB than repeatedly scanning through Logs Insights.
  • For log groups that don’t need Live Tail, metric filters, or alarming — audit trails, verbose debug logs, anything mostly kept “just in case” — create them (or migrate them) using the CloudWatch Logs Infrequent Access log class instead of Standard. It ingests at roughly half the price ($0.25 vs $0.50 per GB) while Logs Insights queries still work against it. Note it’s a one-time choice: the log class can’t be changed after the log group is created.

💡 What we learned

  • “Pay for what you scan, not what you get back” is a very different cost model than most people assume for a query tool, and it’s easy to miss until the bill shows up.
  • A tool that feels free because “it’s just a query” can be the most expensive thing on the bill once it’s automated.
  • The fix here isn’t avoiding Logs Insights — it’s using it for what it’s good at (ad-hoc, time-boxed investigation) and routing everything recurring or historical to something billed per byte of storage scanned in a cheaper tier (Athena over S3).

📚 References