AWS CloudWatch difference log data ingested and actual size of Log Groups

Question

I am currently analysing my cloud watch bill. It says that I have ingested 1,826.520 GB of Logs via AmazonCloudWatch PutLogEvents this month.

However when I go and check out my 8 Log Groups they only add up to a total of roughly 163 GB and they all have a retention period of far over a month.

Any idea what I am missing here? Would have assumed the number of ingested data at least to be the same size as the sum size of all log groups? Happy to provide more information also.

Answer 1

Had this same question and reached out to AWS Support to clarification. They indicated that:

IncomingBytes is the raw, uncompressed bytes while the Stored Bytes is compressed

Additionally, while investigating a cost spike shortly after it occurred with CloudWatch, we also saw that reported storage in CloudWatch Logs for the effected Log Group was dramatically less than what was reported in the PutLogEvents line item on them bill. AWS Support indicated that:

Stored Bytes/Stored GB do not update in real time. There is a delay of at least 24 hours on average but it can vary some.