To reduce Azure Log Analytics and Monitor costs, you cut the volume of data ingested, shorten retention on data you do not query, and move noisy, low-value tables to cheaper log tiers, then lock in a commitment tier once your baseline is steady. Azure Monitor charges almost entirely on ingestion and retention, so the bill is a direct function of how much telemetry you collect and how long you store it. Most teams collect far more than they ever read.
This article is part of our Azure cluster. For the full picture, start with the complete guide to Azure cost optimization, the pillar this piece links up to. Log Analytics waste is a textbook case of the Cut step in our See, Cut, Lock, Run method: clear the spend you are not using before you commit to anything.
Diagnostic settings, agents, and resource logs default to verbose. A single chatty resource, a debug flag left on, or a new AKS cluster streaming container logs can double a workspace's daily ingestion overnight. Because the cost is per gigabyte ingested and per gigabyte retained, the bill scales with engineering activity, not with how much of that data anyone actually reads. That gap between collected and consulted is where the savings live.
Step 1: See what you are actually ingesting
You cannot cut what you cannot see. Start in the Log Analytics workspace usage view, or query the Usage table directly, to break ingestion down by table and by source resource over the last 30 days. Almost always a handful of tables dominate: container logs, application traces, network flow logs, or a misconfigured diagnostic setting. Rank tables by gigabytes ingested and you have your target list. This mirrors how we open every Azure engagement, the same approach described in how to run an Azure cost optimization assessment: measure before you touch anything.
Step 2: Reduce ingestion at the source
The cheapest gigabyte is the one you never ingest. Work down the top tables and ask, for each, whether you need every record. Practical levers that reduce ingestion volume:
| Lever | What it does | Typical saving |
|---|---|---|
| Tighten diagnostic settings | Stop sending log categories nobody queries | Often the single biggest win |
| Filter at the agent | Drop verbose or debug-level events before they leave the host | High on chatty apps |
| Ingestion-time transformations | Use a data collection rule to filter or trim columns on the way in | Removes dead-weight fields |
| Sample high-volume telemetry | Sample Application Insights traces rather than keeping every request | Large on busy services |
| Scope what agents collect | Collect only the performance counters and event logs you use | Steady, compounding |
Data collection rules and ingestion-time transformations are the most powerful of these, because they let you filter and reshape data before you ever pay to store it. A rule that drops health-probe noise or strips an unused column can take double-digit percentages off a busy workspace.
Step 3: Set retention per table, not per workspace
Retention is the second half of the bill. Azure Monitor includes a default interactive retention period, and you pay for any data kept beyond it. The mistake is setting one long retention on the whole workspace. Instead, set retention per table: keep security and audit tables long enough to satisfy compliance, but trim debug, performance, and container-log tables to days rather than months. For data you must keep for the long term but rarely query, archive it at the much lower archive rate instead of holding it in interactive retention.
Observability bill creeping up every quarter?
Our Azure cost audit profiles your Log Analytics ingestion table by table, designs the data collection rules and retention policy that cut volume, and sizes the right commitment tier. On the performance model, you pay only from realized savings. No savings, no fee.
Book an Azure cost audit →Step 4: Use the cheaper log tiers for high-volume, low-value data
Not all logs deserve the full analytics tier. Azure Monitor offers lower-cost tiers for high-volume data you rarely run rich queries against. Basic and Auxiliary logs ingest at a much lower per-gigabyte rate than the analytics tier, in exchange for limited query features and a search-style retrieval model. Route firewall logs, verbose container logs, and other "keep it for investigation, do not analyze daily" data into these tiers, and reserve the full analytics tier for the telemetry your dashboards and alerts actually depend on. Confirm the current tier names, features, and per-gigabyte rates in Azure Monitor documentation before you re-route, as Microsoft has revised these tiers more than once.
Step 5: Commit once the baseline is clean
Only after you have cut ingestion and right-sized retention should you commit. Log Analytics offers commitment tiers, a daily-capacity discount where you reserve a level of ingestion in exchange for a lower effective rate. The order matters: if you buy a commitment tier on a bloated, un-optimized baseline, you lock in the waste. Clean first, then size the commitment to your true steady-state volume. This is the same discipline we apply to compute, covered in Azure reservations vs Azure savings plan for compute: commitments come last, on a clean baseline.
The ingestion controls, log tiers, retention model, and commitment tiers described here reflect Azure Monitor as of May 2026. Pricing tiers and feature names in Monitor change relatively often, so verify the current options and rates in Microsoft's Azure Monitor documentation before standardizing your configuration.
The Azure Cost Optimization Field Guide includes our Log Analytics ingestion-audit worksheet and the retention and tier decision matrix we use on engagements. It is the downloadable companion to this article.
The short version
Azure Monitor and Log Analytics are priced on data, so the bill is a function of how much telemetry you ingest and how long you keep it. Profile ingestion by table, cut volume at the source with diagnostic settings and data collection rules, set retention per table, route high-volume low-value logs to Basic or Auxiliary tiers, and only then buy a commitment tier on the clean baseline. To set budgets and alerts so the savings hold, see Azure budgets and cost alerts: a setup guide. When you want the full ingestion teardown done for you, that is exactly what our Azure cost optimization service delivers.