CostLensLog Analytics Retention (Azure)
Log Analytics Retention (Azure)
CostLens flags Log Analytics workspaces retaining data far beyond the free period, where long interactive retention is billed per GB per month.
Updated July 20261 min read
CostLens flags Log Analytics workspaces with long retention. Data kept past the included ~31 days is billed per GB per month. Trimming retention to what you actually query — or archiving cold data — cuts the ongoing charge.
How it works
Workspaces are enumerated
CostLens lists Log Analytics workspaces via the Azure Resource Manager API and reads each workspace's retentionInDays.
Long retention is flagged
Workspaces retaining more than 90 days are considered.
Savings are estimated
Estimated from the workspace's configured daily ingestion cap (dailyQuotaGb) × the billable retention days beyond the free period × the per-GB retention rate.
What to do
- Decide how long you genuinely need interactive (queryable) retention — often 30–90 days is enough for operational use.
- Reduce interactive retention (workspace → Usage and estimated costs → Data Retention), and move longer-term needs to Archive tier or export, which is far cheaper per GB.
- Consider per-table retention so verbose tables are trimmed without shortening the ones you rely on.
Severity levels
| Severity | Estimated monthly savings |
|---|---|
| critical | >$500 |
| high | $100–$500 |
| medium | $20–$100 |
| low | <$20 |
Required permissions
- Detect:
Reader— see Azure Accounts.
Limitations
- Savings are estimated from the workspace's daily ingestion cap; workspaces with no cap set give no reliable ingest signal and are not flagged (a future revision will read ingestion volume directly).
- The estimate is a ranking signal — the exact retention bill depends on actual ingested volume and per-table settings.