Find CloudWatch Logs Ingestion Cost by Log Group

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListLogGroups",
      "Effect": "Allow",
      "Action": "logs:DescribeLogGroups",
      "Resource": "*"
    },
    {
      "Sid": "ReadIngestionMetrics",
      "Effect": "Allow",
      "Action": "cloudwatch:GetMetricData",
      "Resource": "*"
    }
  ]
}

// top-log-groups-by-ingestion.ts
// Ranks CloudWatch Logs log groups by the data they ingested over the last 30 days (AWS/Logs IncomingBytes),
// estimates the monthly ingestion cost of each from its log class, and prints the top N. Report only.
// Usage: npx tsx top-log-groups-by-ingestion.ts [--regions us-east-1,eu-west-1] [--days 30] [--top 20]
import { CloudWatchLogsClient, paginateDescribeLogGroups, type LogGroup } from "@aws-sdk/client-cloudwatch-logs";
import { CloudWatchClient, paginateGetMetricData, type MetricDataQuery } from "@aws-sdk/client-cloudwatch";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const regions = (flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1").split(",").map((r) => r.trim()).filter(Boolean);
const days = Math.min(Math.max(Number(flag("--days") ?? 30), 1), 90);
const top = Math.max(Number(flag("--top") ?? 20), 1);
const GB = 1024 ** 3;

// First-tier ingestion price per GB, us-east-1, AWS Price List (published 22 September 2026).
// Custom logs are flat. Vended logs (Lambda and other AWS service logs) drop to lower tiers after 10 TB a month.
const PRICE_PER_GB: Record<string, number> = { STANDARD: 0.5, INFREQUENT_ACCESS: 0.25 };

interface Row {
  LogGroup: string;
  Class: string;
  GBPerMonth: number;
  BusiestDayGB: number;
  CostPerMonth: string;
  Share: string;
  Retention: string;
  cost: number;
}

const errorText = (err: unknown): string => (err instanceof Error ? `${err.name}: ${err.message}` : String(err));

/** Daily IncomingBytes sums per log group, in batches of 500 metric queries per GetMetricData call. */
async function ingestion(cw: CloudWatchClient, names: string[]): Promise<Map<string, number[]>> {
  const end = new Date();
  const start = new Date(end.getTime() - days * 86_400_000);
  const queries: MetricDataQuery[] = names.map((name, i) => ({
    Id: `g${i}`,
    MetricStat: {
      Metric: { Namespace: "AWS/Logs", MetricName: "IncomingBytes", Dimensions: [{ Name: "LogGroupName", Value: name }] },
      Period: 86_400,
      Stat: "Sum",
    },
  }));
  const out = new Map<string, number[]>();
  for (let i = 0; i < queries.length; i += 500) {
    const pages = paginateGetMetricData({ client: cw }, { MetricDataQueries: queries.slice(i, i + 500), StartTime: start, EndTime: end });
    for await (const page of pages) {
      for (const r of page.MetricDataResults ?? []) {
        const name = names[Number((r.Id ?? "").slice(1))];
        if (name && r.Values?.length) out.set(name, [...(out.get(name) ?? []), ...r.Values]);
      }
    }
  }
  return out;
}

async function scanRegion(region: string): Promise<void> {
  const logs = new CloudWatchLogsClient({ region });
  const groups: LogGroup[] = [];
  for await (const page of paginateDescribeLogGroups({ client: logs }, {})) groups.push(...(page.logGroups ?? []));
  if (groups.length === 0) {
    console.log(`${region}: no log groups`);
    return;
  }
  const byName = new Map(groups.filter((g) => g.logGroupName).map((g) => [g.logGroupName as string, g]));
  const daily = await ingestion(new CloudWatchClient({ region }), [...byName.keys()]);

  const rows: Row[] = [];
  let totalGb = 0;
  let totalCost = 0;
  for (const [name, values] of daily) {
    const g = byName.get(name);
    const logClass = g?.logGroupClass ?? "STANDARD";
    const gbPerMonth = (values.reduce((a, b) => a + b, 0) / GB) * (30 / days);
    const price = PRICE_PER_GB[logClass];
    const cost = price === undefined ? 0 : gbPerMonth * price;
    totalGb += gbPerMonth;
    totalCost += cost;
    rows.push({
      LogGroup: name,
      Class: logClass,
      GBPerMonth: Number(gbPerMonth.toFixed(2)),
      BusiestDayGB: Number((Math.max(...values) / GB).toFixed(2)),
      CostPerMonth: price === undefined ? "see pricing" : `$${cost.toFixed(2)}`,
      Share: "",
      Retention: g?.retentionInDays ? `${g.retentionInDays} days` : "never expire",
      cost,
    });
  }
  rows.sort((a, b) => b.cost - a.cost || b.GBPerMonth - a.GBPerMonth);
  for (const r of rows) r.Share = totalCost > 0 ? `${((r.cost / totalCost) * 100).toFixed(1)}%` : "-";

  console.log(`\n${region}: ${groups.length} log groups, ${daily.size} ingested data in the last ${days} days (scaled to 30 days)`);
  console.table(rows.slice(0, top).map(({ cost: _cost, ...visible }) => visible));
  console.log(`Total: ${totalGb.toFixed(1)} GB a month, about $${totalCost.toFixed(2)} in ingestion at first-tier us-east-1 prices.`);
  const quiet = groups.length - daily.size;
  if (quiet > 0) console.log(`Log groups with no ingestion in this window: ${quiet}.`);
}

async function main(): Promise<void> {
  for (const region of regions) {
    try {
      await scanRegion(region);
    } catch (err) {
      console.error(`${region}: ${errorText(err)}`);
    }
  }
}

main().catch((err) => {
  console.error(errorText(err));
  process.exit(1);
});

npm install @aws-sdk/client-cloudwatch-logs @aws-sdk/client-cloudwatch
npm install --save-dev tsx typescript @types/node

AWS_PROFILE=readonly npx tsx top-log-groups-by-ingestion.ts --regions us-east-1,eu-west-1 --days 30 --top 20

us-east-1: 6 log groups, 5 ingested data in the last 30 days (scaled to 30 days)
┌─────────┬─────────────────────────────┬─────────────────────┬────────────┬──────────────┬──────────────┬─────────┬────────────────┐
│ (index) │ LogGroup                    │ Class               │ GBPerMonth │ BusiestDayGB │ CostPerMonth │ Share   │ Retention      │
├─────────┼─────────────────────────────┼─────────────────────┼────────────┼──────────────┼──────────────┼─────────┼────────────────┤
│ 0       │ '/aws/lambda/orders-api'    │ 'STANDARD'          │ 360        │ 41           │ '$180.00'    │ '47.7%' │ '30 days'      │
│ 1       │ '/ecs/checkout-service'     │ 'STANDARD'          │ 186        │ 6.2          │ '$93.00'     │ '24.7%' │ 'never expire' │
│ 2       │ '/aws/vpc/flow-logs-prod'   │ 'STANDARD'          │ 123        │ 4.1          │ '$61.50'     │ '16.3%' │ '90 days'      │
│ 3       │ '/app/audit-archive'        │ 'INFREQUENT_ACCESS' │ 150        │ 5            │ '$37.50'     │ '9.9%'  │ '365 days'     │
│ 4       │ '/aws/lambda/image-resizer' │ 'STANDARD'          │ 10.5       │ 0.35         │ '$5.25'      │ '1.4%'  │ '14 days'      │
└─────────┴─────────────────────────────┴─────────────────────┴────────────┴──────────────┴──────────────┴─────────┴────────────────┘
Total: 829.5 GB a month, about $377.25 in ingestion at first-tier us-east-1 prices.
Log groups with no ingestion in this window: 1.