Log Storage Calculator
How much storage a log retention policy needs — events per second, event size, compression and how long you keep them.
Log volume is events per second times average size times seconds of retention.
How the log storage calculator works
Log volume is events per second times average size times seconds of retention. It is straightforward arithmetic that routinely produces a number an order of magnitude larger than people expect.
Compression is the lever: structured logs compress five to ten times, which turns an impossible retention policy into a cheap one. The second lever is tiering — hot storage for a week, cold for the rest.
Formula: storage = events/s × bytes × retention days × 86,400 / compression
Worked examples
| Inputs | Storage needed | Note |
|---|---|---|
| 2,500 events/s for 90 days | 2.33 TB | about 2.3 TB |
| No compression | 18.66 TB | eight times the disk |
| A year of retention | 9.46 TB | over 9 TB |
FAQFrequently asked questions
How much do logs compress?
Structured logs typically compress five to ten times, because they repeat field names and values. Free-text logs compress less.
How long should I keep logs?
Whatever the compliance requirement is, plus enough for debugging. Thirty days hot and a year cold is a common shape.
Why tier storage?
Because cold storage is often ten times cheaper and logs older than a week are almost never read. The retrieval delay is irrelevant for an audit.
Do replicas double the cost?
Yes, exactly. Two replicas means twice the storage, which is why log systems often replicate hot data and not cold.
What is the ingest rate for?
Sizing the pipeline. A high event rate can saturate a network link or a broker long before storage becomes the constraint.
Where these figures come from
- IEC 80000-13 — Information science and technology (quantities and units) — the decimal (kB, MB) versus binary (KiB, MiB) prefixes used throughout
- RFC 4632 — Classless Inter-domain Routing (CIDR) — the address-plan arithmetic behind the subnet calculator
- RFC 1918 — Address Allocation for Private Internets — the private ranges the subnet calculator recognises
- NIST SP 800-63B — Digital Identity Guidelines, Authentication — length over composition rules; the basis of the password guidance here
- NIST SP 800-57 Part 1 — Recommendation for Key Management — key-strength comparisons used by the key-space calculator
- National Cyber Security Centre — password guidance — UK national guidance on password policy
Last checked: September 2026. Units follow the SI decimal convention (IEC 80000-13 defines the binary alternatives); network and security figures cite the defining standard.