Azure Log Analytics Query Cost Calculation

Question

While reviewing the Azure Log Analytics Basic Table plan query costs, it states: "The charge for a query on Basic and Auxiliary tables is based on the amount of data the query scans, which depends on the size of the table and the query's time range."

If a table contains 100 GB of data per day and a query with WHERE clauses filters this data down to 25 GB per day, how will the charging work in this scenario? Will the WHERE clause filtering contribute to a reduction in costs?

Answer 1

Hi

Welcome to MS Q&A.

if i understood correctly.

When you're running queries in Azure Log Analytics, the way costs are calculated can be a bit tricky. To understand how you're charged, you need to know that the cost comes from the amount of data your query scans, not the amount of data returned.

Here’s a simple breakdown:

1. Data Ingestion

First, Azure charges based on how much data is ingested into the Log Analytics workspace. In your example, if your table receives 100 GB of data per day, you're paying for that amount of data ingestion. This part is straightforward and separate from query costs.

2. Query Execution

When you run a query, Azure charges for the amount of data the query scans, not the amount of data it returns after filtering. This is where things get interesting.

Let’s say you have 100 GB of data in a table, and your query includes a WHERE clause that filters the data down to 25 GB. You might think that you’d only be charged for the 25 GB, but that’s not the case.

The query has to scan the entire 100 GB of data before it can apply the filters and reduce it to the 25 GB you care about. Since Azure calculates query cost based on how much data is scanned, you’ll be charged for scanning the full 100 GB, not just the filtered 25 GB.

3. Time Range and Query Costs

The time range you set in your query can significantly affect the cost. For instance, if your query only looks at one day’s worth of data, it scans 100 GB. But if you set the time range to a week, it will scan 7 x 100 GB = 700 GB of data.

So, by tightening the time range in your queries, you can limit the amount of data being scanned and reduce costs.

Will the WHERE Clause Reduce Costs?

No, the WHERE clause won’t reduce query costs because the system still needs to scan the entire data set before applying the filters. The cost is based on how much data is scanned during the query process.

How to Optimize Costs

Here are a few ways you can lower your query costs:

• Reduce the time range: Limit the time span in your query to reduce how much data is scanned.
• Query specific tables: If you know where your data is, query specific tables to avoid scanning unnecessary ones.
• Use Aggregations: Try aggregating data in the query to minimize the need to scan large amounts.

Helpful Blog

For a deeper dive into how Azure charges for queries and tips to reduce costs, you can check out Microsoft’s official documentation:

• Azure Monitor pricing

It explains how data scanning and query execution costs work and offers tips to help you optimize and reduce your spending.

Hope this makes it clearer! If you need more details or examples, feel free to ask