Calculate total log ingestion volume per day across all monitored services.
Log ingestion volume scales with the number of sources, how frequently each source emits events, and the size of each event: rate_GB_per_day = sources × events_per_sec × avg_event_bytes × 86400 ÷ 1e9. This is the foundational sizing input for every downstream stage of a logging pipeline — buffers, shippers, indices and long-term storage should all be sized against this rate.
rate_GB_per_day = sources × events_per_sec × avg_event_bytes × 86400 / 1e9
Sample actual log output over a representative window (including peak traffic periods, not just average) using `wc -l` on rotated logs divided by the time window, or query your existing log shipper's own ingestion metrics.
Rarely — most systems see peak ingestion during business hours or traffic spikes; size buffers and shippers against peak rate, not average rate, to avoid backpressure during busy periods.
Plain text access logs are often 100-300 bytes; structured JSON application logs with stack traces or context fields commonly run 500 bytes to several KB per event.
Feed this rate into buffer sizing (Fluentd/Fluent Bit), index storage sizing (OpenSearch), and observability cost calculators to get a full picture of pipeline capacity and spend.