CloudWatch Cost Optimization: Cut Monitoring Costs

CloudWatch is often one of the most surprising costs on an AWS bill. What seems like a basic monitoring service can quietly accumulate thousands of dollars monthly through verbose logging, excessive custom metrics, and default retention policies that keep data forever. The solution isn't to monitor less — it's to monitor smarter.

CloudWatch Cost Components

Strategy 1: Set Log Retention Policies

CloudWatch Logs default retention is never expire. This means every log group you've ever created is still storing data and incurring monthly charges.

Impact: A team generating 100 GB/day of logs with no retention policy accumulates 36 TB in a year, costing $1,080/month in storage alone. Setting 30-day retention limits storage to 3 TB ($90/month).

Strategy 2: Filter Logs Before Ingestion

Every byte ingested costs $0.50/GB. Reduce log volume before it reaches CloudWatch:

• Set application log levels to WARN or ERROR in production (not DEBUG or INFO)
• Use subscription filters to route only important logs to CloudWatch
• Filter out health check logs from ALB/NLB — these can be 50%+ of web server log volume
• Exclude routine cron job success output

Strategy 3: Route Verbose Logs to S3

For logs that need long-term storage but not real-time search, use CloudWatch Logs subscriptions to stream to S3 via Kinesis Data Firehose.

For 1 TB/month of logs stored for 1 year, CloudWatch costs $6,360 vs S3 at $276 — a 96% reduction.

Strategy 4: Reduce Custom Metrics

Each custom metric costs $0.30/month (first 10,000). Teams using detailed monitoring or custom dimensions often create thousands of metrics without realizing it.

Common over-creation patterns:

• Per-customer metrics (1,000 customers = $300/month in metrics alone)
• Per-endpoint metrics with multiple dimensions
• High-resolution (1-second) metrics when 1-minute suffices

Alternatives:

• Use CloudWatch Embedded Metric Format (EMF) — publish metrics through logs at log ingestion rates
• Aggregate metrics before publishing (per-service instead of per-instance)
• Use metric math instead of publishing calculated metrics

Strategy 5: Optimize Container Insights

Container Insights publishes custom metrics for every ECS task/EKS pod. For clusters with hundreds of pods, this creates thousands of custom metrics.

Cost control:

• Disable Container Insights on dev/staging clusters
• Use enhanced observability selectively — only for namespaces that need it
• Consider third-party tools (Prometheus + Grafana) for large clusters — they're often cheaper than Container Insights at scale
• Review recommendations from AWS Cost Management for additional monitoring savings

Strategy 6: Right-Size Alarms

Audit alarms quarterly. Delete alarms for decommissioned services and resources.

Related Guides

• AWS CloudWatch Pricing: Metrics, Logs, and Costs
• Cloud Cost Optimization Checklist
• Cloud Tagging Strategy Guide
• AWS EC2 Cost Optimization: 12 Proven Strategies

FAQ

How can I find which log groups cost the most?

In the CloudWatch console, go to Log Groups and sort by stored bytes. Or use the AWS CLI: aws logs describe-log-groups --query 'sort_by(logGroups, &storedBytes)[-10:]' to find the top 10 largest log groups.

Is CloudWatch Logs cheaper than Datadog or Splunk?

For ingestion, CloudWatch at $0.50/GB is comparable to Datadog ($0.10/GB ingested + higher retention costs). For small volumes under 100 GB/month, CloudWatch is simpler and cheaper. For large volumes, S3 + Athena is the cheapest option.

Should I use CloudWatch Logs Insights or Athena for log analysis?

Logs Insights ($0.0057/GB scanned) is best for ad-hoc queries on recent logs. For routine analysis on large historical datasets, export to S3 and query with Athena ($5/TB scanned with partition pruning) — it's cheaper for large-scale analysis.