Azure Log Analytics Cost Optimization in 2026: Basic Logs, Auxiliary Logs, and Commitment Tiers

Updated: September 2, 2026

Azure Log Analytics cost optimization in 2026 comes down to four levers: route high-volume, low-query data to Basic or Auxiliary Logs instead of the default Analytics tier, drop unneeded columns and rows at ingestion using Data Collection Rules (DCRs), buy a commitment tier once daily ingest crosses ~100 GB, and archive older data through interactive-plus-archive retention. Applied together, teams routinely cut Log Analytics bills 50-80% without losing a single alert or dashboard. Honestly, I've walked into environments burning $18K/month on workspaces where a two-week cleanup dropped the run rate to $4K. Same alerts, same dashboards, just far less garbage flowing in.

• Analytics Logs cost roughly $2.99/GB ingested (Pay-As-You-Go, East US); Basic Logs are ~$0.85/GB; Auxiliary Logs (GA September 2025) are ~$0.15/GB, a 20x spread for the same raw data.
• Commitment tiers start at 100 GB/day and give ~15% at 100 GB, scaling to ~30% at 5 TB/day; the workspace auto-charges Pay-As-You-Go rates for any daily overage.
• Data Collection Rules with a transformKql clause let you drop columns and filter rows before ingestion. It's the single biggest lever most teams miss.
• Every workspace gets 90 days of Interactive retention free; anything longer moves to Long-term Retention at ~$0.10/GB/month, or Archive at ~$0.026/GB/month with a rehydrate step for queries.
• Microsoft Sentinel adds a ~$4.30/GB analytics-tier surcharge on top of Log Analytics ingestion. Basic and Auxiliary tiers are Sentinel-eligible in 2026 and cut that surcharge dramatically.
• Application Insights (workspace-based) shares the same pricing knobs; sampling and adaptive sampling can halve trace/dependency volume before it ever hits the workspace.

Azure Log Analytics pricing in 2026: what you actually pay for

Every gigabyte of data flowing into a Log Analytics workspace hits three billing dimensions: ingestion (per GB, by tier), retention (per GB per month beyond the free window), and, if you have Microsoft Sentinel enabled on the workspace, a Sentinel analytics surcharge on top. Ingestion is where 70-90% of the bill lives, which is why the tier-routing decision matters more than any other.

In East US, list prices in 2026 are approximately:

Tier	Ingestion (per GB)	Query cost	Retention included	Typical use
Analytics Logs (Pay-As-You-Go)	~$2.99	Free (KQL)	31 days (90 with Sentinel)	Alerts, dashboards, hot investigations
Basic Logs	~$0.85	~$0.007/GB scanned	30 days interactive	Verbose app logs, debug traces
Auxiliary Logs (GA 2025)	~$0.15	~$0.005/GB scanned	30 days interactive, 12 months total	Firewall logs, NetFlow, high-volume verbose
Long-term Retention	N/A	Free after rehydrate	Up to 12 years	Compliance, occasional lookback
Archive tier	N/A	~$0.007/GB + rehydrate fee	Up to 12 years	Cold compliance only

The 20x spread between Analytics and Auxiliary isn't a marketing gimmick. It reflects real query performance differences. Auxiliary Logs are stored in a columnar format with looser indexing; you can't alert on them and you can't freely join them to Analytics tables. That trade is fine for a firewall log you touch once a quarter during a forensic investigation, and catastrophic for a Perf table backing an SRE dashboard. See Microsoft's official Log Analytics cost documentation for the exact per-region multipliers.

Basic Logs, Auxiliary Logs, and Analytics Logs: which tier for which table

Tier choice is a per-table decision, not per-workspace. In practice, I bucket tables like this:

• Analytics (default, hot): Heartbeat, AzureActivity, SecurityEvent, Perf, SigninLogs. Anything an alert rule or a dashboard tile queries every minute.
• Basic Logs: ContainerLog/ContainerLogV2, AppServiceHTTPLogs, custom app logs. You get KQL access, but only for the last 30 days and with a small per-GB scan fee. Ideal for verbose developer logs you troubleshoot with, but do not alert on.
• Auxiliary Logs: AzureDiagnostics for firewalls, NSG flow logs, WAFV2, load-balancer access logs, StorageBlobLogs. Extremely high volume, extremely low query frequency.

Switching a table's plan is a one-line ARM/Bicep change, but be aware: switching from Analytics to Basic destroys the ability to run alert rules on it, and switching to Auxiliary changes the schema constraints. Test the change on a non-prod workspace first.

// Bicep: switch ContainerLogV2 to Basic Logs
resource containerLogPlan 'Microsoft.OperationalInsights/workspaces/tables@2023-09-01' = {
  name: '${workspaceName}/ContainerLogV2'
  properties: {
    plan: 'Basic'
    retentionInDays: 30       // Basic Logs cap at 30 days interactive
    totalRetentionInDays: 365 // remainder ends up in Long-term Retention
  }
}

A pattern that's aged well: keep AppTraces from Application Insights on Analytics for the first 7 days (so alerts and Live Metrics keep working), then export older data to Auxiliary or archive. Log Analytics itself doesn't have automatic tier transitions like S3 Intelligent-Tiering, so the "cliff" is set by your DCR + retention config.

Cut ingestion at the source with Data Collection Rules

The cheapest gigabyte is the one you never ingest. Data Collection Rules (DCRs) sit between your resources and the workspace, and since the 2024 DCR-transformations GA you can run a transformKql block that drops columns, filters rows, or rewrites data at ingestion, all before the meter runs.

Two transforms handle the majority of savings I've measured:

// 1. Drop debug/verbose rows from ContainerLogV2 before ingestion
source
| where LogLevel !in ("DEBUG", "TRACE", "VERBOSE")
| where not (LogMessage startswith "GET /health")
| project-away Computer, _ResourceId  // columns you don't query

// 2. Drop Application Insights dependency spam
source
| where Type != "AppDependencies" or Success == false or DurationMs > 500

You attach the transform to the DCR either in the portal (Monitor → Data Collection Rules → Data sources → Transform) or via Bicep. A typical Kubernetes cluster with a chatty ContainerLogV2 table sees 40-60% ingestion drop after the first health-check filter alone. Combine with per-container namespace filtering in the Azure Monitor Container Insights ConfigMap for another 20-30%.

For an end-to-end walk-through of how logs, metrics, and traces stack up across observability vendors, our observability cost optimization guide covers the same trade-offs on Datadog, New Relic, and Splunk.

When commitment tiers are worth it

Commitment tiers give you a fixed daily allowance (100 GB, 200 GB, 300 GB, 400 GB, 500 GB, 1 TB, 2 TB, or 5 TB) at a per-GB rate lower than Pay-As-You-Go. In East US:

Tier	Daily allowance	Effective $/GB	Discount vs PAYG
Pay-As-You-Go	0	~$2.99	n/a
100 GB/day	100 GB	~$2.55	~15%
200 GB/day	200 GB	~$2.44	~18%
500 GB/day	500 GB	~$2.30	~23%
1 TB/day	1000 GB	~$2.14	~28%
5 TB/day	5000 GB	~$2.05	~31%

The break-even math is straightforward: if you consistently ingest more than the tier allowance for that band, the commitment tier is cheaper. Look at the last 30 days of the Usage table and pick the tier whose allowance is just under your P50 daily ingest, not your P95. Overage bills at PAYG, not at commitment rates, but the overall blended rate still comes out ahead when your P50 sits inside the tier.

// KQL: last 30 days daily ingest, P50 and P95
Usage
| where TimeGenerated > ago(30d)
| where IsBillable == true
| summarize DailyGB = sum(Quantity)/1024 by bin(TimeGenerated, 1d)
| summarize P50=percentile(DailyGB, 50), P95=percentile(DailyGB, 95), Max=max(DailyGB)

Retention, Long-term Retention, and Archive

Every Log Analytics table has three retention knobs:

1. Interactive retention: 4-730 days. Fully queryable, indexed. Included for the first 31 days on Analytics tables (90 days if Sentinel is enabled), 30 days on Basic/Auxiliary. Anything beyond bills at ~$0.10/GB/month.
2. Long-term Retention: up to 12 years total. Same schema, but queries require a small scan fee similar to Basic Logs. Bills at ~$0.026/GB/month.
3. Archive: the tail end of long-term retention, where data older than the interactive window automatically flows. Query requires a rehydrate job that can take hours and adds a per-GB rehydrate fee.

The default 90-day Sentinel window is a common overspend trap: most SecOps teams alert on the last 24-48 hours and only pull older data during an incident. Set Sentinel's Interactive to 30 days and Long-term to 2 years, and expect a 40-50% retention-line drop. For compliance-driven retention (HIPAA, PCI, SOX), the Archive tier is the correct home, not Interactive.

// Bicep: set 30-day interactive + 2-year long-term retention on SecurityEvent
resource secEventRetention 'Microsoft.OperationalInsights/workspaces/tables@2023-09-01' = {
  name: '${workspaceName}/SecurityEvent'
  properties: {
    retentionInDays: 30
    totalRetentionInDays: 730
  }
}

Microsoft Sentinel cost implications

Sentinel is billed at ~$4.30/GB on top of Log Analytics ingestion for Analytics-tier data, effectively doubling the per-GB cost of any table you connect. Two 2026 developments matter:

• Basic Logs are Sentinel-eligible for detection rules using summary rules and near-real-time (NRT) analytics, drastically cheaper than sending high-volume raw logs to Analytics.
• Auxiliary Logs work with Sentinel search jobs. You can hunt across firewall/proxy data at ~$0.15/GB ingest, then use search results in incident investigation without paying the Analytics-tier surcharge.

The Sentinel commitment tiers stack with the Log Analytics ones: buying a Sentinel 500 GB/day tier gets you ~25% off the Sentinel surcharge for that allowance. If your workspace is Sentinel-enabled and ingesting more than 100 GB/day, always buy Sentinel commitment tiers alongside the Log Analytics commitment tier, because the discounts are independent.

Application Insights sampling and cost

Workspace-based Application Insights bills through the Log Analytics workspace, but has its own upstream lever: sampling. Two flavors:

• Adaptive sampling (default in the SDK): the SDK targets a max item rate per second and drops the rest. Good for traffic-heavy web apps.
• Ingestion sampling: server-side, keeps the SDK dumb but drops on the Application Insights endpoint. Slightly less accurate for exception rates but preserves full raw data at the SDK.

Setting adaptive sampling to maxTelemetryItemsPerSecond = 5 (default is often 20) cut one client's AppInsights ingest 78% overnight, with no measurable loss in dashboard fidelity. Combine with a DCR transform that drops AppDependencies rows where DurationMs < 100 and Success == true for another 40-60% on top. I hit exactly that combo on a .NET 9 API last quarter and shaved ~$3.2K/month with one config PR.

// appsettings.json: cap Application Insights item rate
{
  "ApplicationInsights": {
    "SamplingSettings": {
      "MaxTelemetryItemsPerSecond": 5,
      "EvaluationInterval": "00:00:15",
      "InitialSamplingPercentage": 100,
      "MinSamplingPercentage": 0.1
    }
  }
}

Cost-optimization patterns from other Azure services apply here too. Our Azure Hybrid Benefit guide covers the biggest compute-side lever, and the AWS CloudWatch cost optimization piece shows how the same tiering ideas play out on the AWS side.

A 30-minute Log Analytics cost audit

Run these five queries in order against every workspace over 50 GB/day. Ninety percent of the savings comes out of the first three (in my experience, anyway).

// 1. Top 10 tables by ingest volume (30 days)
Usage
| where TimeGenerated > ago(30d) and IsBillable
| summarize GB = sum(Quantity)/1024 by DataType
| top 10 by GB desc

// 2. Ingest by resource: which VMs/apps are the noisy ones
union withsource=Table *
| where TimeGenerated > ago(7d)
| summarize Count = count(), EstMB = sum(estimate_data_size(*))/1024/1024 by _ResourceId
| top 20 by EstMB desc

// 3. Which columns dominate a table (candidates for project-away)
ContainerLogV2
| take 10000
| summarize
    avg_LogMessage = avg(strlen(LogMessage)),
    avg_ComputerLen = avg(strlen(Computer)),
    avg_PodName = avg(strlen(PodName))

// 4. Health-check spam, usually the fastest quick win
ContainerLogV2
| where TimeGenerated > ago(1d)
| where LogMessage has_any ("/health", "/ready", "/live", "/metrics")
| count

// 5. Tables with retention set beyond default
.show table * details
| where RetentionPolicy.SoftDeletePeriod > 30d
| project TableName, Retention = RetentionPolicy.SoftDeletePeriod

Feed the outputs from steps 1-3 into your DCR transformations, then re-check the Usage table 24 hours later. For a broader FinOps context on how Azure fits alongside AWS and GCP cost governance, see our cloud cost tagging strategy guide. Full pricing details are in the official Azure Monitor pricing page, and the Microsoft Learn DCR transformations reference is the authoritative source for transform KQL syntax.

Frequently Asked Questions

How much does Azure Log Analytics cost per GB in 2026?

Pay-As-You-Go Analytics Logs cost approximately $2.99/GB in East US, Basic Logs cost ~$0.85/GB, and Auxiliary Logs (GA September 2025) cost ~$0.15/GB. Commitment tiers reduce Analytics-tier ingestion by 15-31% depending on daily volume, starting at 100 GB/day.

What is the difference between Basic Logs and Auxiliary Logs in Azure?

Basic Logs support KQL queries and 30 days of interactive retention at ~$0.85/GB. Auxiliary Logs are columnar-stored, roughly 5x cheaper at ~$0.15/GB, but have looser schema constraints and are optimized for occasional forensic queries rather than dashboards or alerts. Both are ineligible for standard Analytics alert rules.

How do I reduce my Azure Log Analytics bill?

Attack the four biggest levers in order: (1) route high-volume tables like ContainerLogV2, firewall logs, and NSG flow logs to Basic or Auxiliary tiers, (2) add Data Collection Rule transformations to filter rows and drop columns before ingestion, (3) buy a commitment tier once daily ingest crosses 100 GB, and (4) shorten interactive retention and move older data to Long-term Retention or Archive.

Are Azure Log Analytics commitment tiers worth buying?

Yes, if your P50 daily ingest sits inside a tier's allowance. At 100 GB/day you save ~15%; at 5 TB/day you save ~31%. Overage bills at Pay-As-You-Go rates, so consistent volume is more important than peak volume when picking a tier. Use the last 30 days of the Usage table to compute P50 before committing.

Do DCR transformations reduce my Log Analytics bill retroactively?

No. Data Collection Rule transformations only affect data ingested after the DCR is deployed. Historical data stays priced at the tier and volume it was originally ingested under. Also, a transform that adds columns via extend can increase per-record size and raise your bill, so always measure the Usage table for 24 hours after deploying a new DCR.