Log Retention (GCP)
CostLens flags Cloud Logging buckets retaining logs beyond the free 30-day window, where extended-retention storage is billed per GiB-month.
CostLens flags the Cloud Logging _Default bucket when it retains logs beyond the free 30-day window. Cloud Logging stores logs free for 30 days; storage kept longer is billed at ~$0.01/GiB-month — on a high-volume project that adds up quietly.
How it works
Log buckets are enumerated
CostLens lists the project's Cloud Logging buckets and reads each one's retentionDays.
The _Default bucket is sized
Per-bucket ingestion isn't exposed by any GCP API, so the volume is derived from the project's monthly log ingestion (Cloud Monitoring billing/bytes_ingested) and attributed to the _Default bucket — where sink-less logs land.
Retention overage is estimated
At steady state the volume older than 30 days ≈ daily ingest × (retention − 30), billed at ~$0.01/GiB-month.
What to do
- If you don't need logs beyond 30 days, set the
_Defaultbucket retention back to 30 days (Logging → Logs Storage → edit bucket). - If you do need long-term logs, route only the logs you must keep to a dedicated bucket with the longer retention, or export them to cheaper storage (a BigQuery/Cloud Storage sink) and trim
_Default. - Reduce ingestion at the source with exclusion filters for noisy, low-value logs.
Severity levels
| Severity | Estimated monthly savings |
|---|---|
| critical | >$500 |
| high | $100–$500 |
| medium | $20–$100 |
| low | <$20 |
Required permissions
- Detect: Logging read (
roles/logging.viewer) + Monitoring Viewer (roles/monitoring.viewer) — see GCP Accounts.
Limitations
- Only the
_Defaultbucket is costed. GCP exposes no per-bucket ingestion volume, so custom log buckets with extended retention are not sized (and therefore not flagged). - The estimate is advisory — it assumes steady-state ingest and attributes the project's total ingestion to
_Default. Actual retention volume depends on your routing and exclusion filters. - No finding is produced when the ingestion signal is unavailable (missing Monitoring permission or a project with negligible logging).