Data and cost estimation for Log Analytics

A while ago I wrote an article on how to estimate data consumption for Log Analytics. Since then there were changes to the way that Log Analytics tracks the volume and the cost associated with data flowing into the workspace.

The documentation on standard properties in Log Analytics records now lists two new attributes that are of interest: _isBillable and _BilledSize.

Clive Watson went out and built queries that are very handy to answer questions that are commonly asked such as Which solution is free? or How much data is stored for a certain solution? or even How much data are my Network Security Groups generating? I recommend to take a look at his blog post to easily answer these questions.

In my original post I built a query that presents the data volume by solution. With the changes made this query now looks as follows:

let daystoSearch = 1d;
union withsource = tt *
| where TimeGenerated > ago(daystoSearch)
| summarize 
    RecordCount=count(),
    MbperRecord = round(sum(_BilledSize / 1024 / 1024) / count(), 4),
    TotalMBytes= round(sum(_BilledSize / 1024 / 1024), 2)
by SolutionName = tt, _IsBillable
| sort by SolutionName asc

Take that query for a spin in the Log Analytics playground, and you’ll get something like the following: