Estimate daily log storage from log lines per second, average line size, and compression ratio. Plan log infrastructure capacity.
Application logs are one of the fastest-growing data sources in any infrastructure. A single microservice generating 500 log lines per second at 200 bytes per line produces over 8 GB of raw log data per day. Multiply that by dozens or hundreds of services, and you're looking at terabytes of log data that need to be stored, indexed, and searchable.
This calculator estimates daily, weekly, and monthly log storage volume using the fundamental formula: log lines per second × average line size × 86,400 seconds per day. It also applies a compression ratio to show how much disk space you'll actually need after gzip, zstd, or LZ4 compression—which is critical for platforms like Elasticsearch, Loki, or Splunk that compress log data.
Accurate log volume estimation prevents running out of disk space on your logging cluster, helps you budget for SaaS logging services that charge by ingestion volume, and ensures your retention policies are achievable within your storage budget.
Over-provisioning log storage wastes money; under-provisioning causes log loss during incidents when you need them most. This calculator gives you accurate daily volume estimates so you can size logging infrastructure correctly from day one. Precise quantification supports capacity planning and performance budgeting, ensuring infrastructure investments are right-sized for both current workloads and projected future growth.
daily_raw = log_lines_sec × avg_line_bytes × 86400; daily_compressed = daily_raw / compression_ratio; monthly = daily_compressed × 30
Result: 2.02 GB/day compressed
500 lines/sec × 250 bytes × 86,400 sec = 10.8 GB/day raw. With 5:1 compression, actual storage is 2.16 GB/day. Monthly: ~64.8 GB. For a 30-day retention window, provision at least 65 GB of compressed log storage.
For Elasticsearch, multiply compressed daily volume by retention days, then add 30% for indexes and replicas. A 2 GB/day compressed log stream with 14-day retention needs ~36 GB of primary storage, or 72 GB with one replica. Size the cluster with 20% headroom.
Datadog, Splunk Cloud, and New Relic charge by ingestion volume (GB/day). Prices range from $0.10 to $2.50/GB depending on the provider and tier. Estimate your daily volume accurately to avoid surprise bills at month-end.
Log volume typically grows 20–50% per year as services are added and traffic increases. Build growth into your capacity plan. Set alerts at 70% storage utilization to trigger proactive expansion or retention policy adjustments.
Check your log shipper metrics (Filebeat, Fluentd, Vector). Alternatively, count lines in a recent log file and divide by the time span. For multiple services, sum their individual rates.
Plain text logs average 100–200 bytes per line. Structured JSON logs average 200–500 bytes due to field names and formatting. Access logs (Nginx, Apache) average 150–300 bytes. Audit logs with full context can exceed 1 KB.
Elasticsearch creates inverted indexes for full-text search, adding 10–30% storage overhead. Loki uses label-based indexing with much less overhead. Splunk licenses are based on ingestion volume, not stored volume.
Yes, if your shipper supports it. gzip or zstd compression reduces network transfer by 70–85%. Most log aggregators (Elasticsearch, Loki, Datadog) accept compressed input and decompress server-side.
Drop DEBUG logs in production. Sample repetitive logs (e.g., log every 100th health check). Use structured logging to avoid verbose stack traces in INFO logs. Aggregate metrics instead of logging every event.
Text logs typically compress 4–6× with gzip and 5–8× with zstd. JSON logs compress 5–10× due to repetitive field names. Binary or already-compressed data compresses poorly (1–1.5×). Use 5× as a safe default.