Log Ingestion Calculator

Calculate total log ingestion volume per day across all monitored services.

About Log Ingestion Calculator

Log ingestion volume scales with the number of sources, how frequently each source emits events, and the size of each event: rate_GB_per_day = sources × events_per_sec × avg_event_bytes × 86400 ÷ 1e9. This is the foundational sizing input for every downstream stage of a logging pipeline — buffers, shippers, indices and long-term storage should all be sized against this rate.

Formula

rate_GB_per_day = sources × events_per_sec × avg_event_bytes × 86400 / 1e9

sources: Number of log-emitting hosts/services
events_per_sec: Average events per second per source
avg_event_bytes: Average log event size (bytes)

Worked example

With the default values below, Log Ingestion Calculator returns Ingestion Rate of 43.20. Change any input above and every figure here is recalculated in your browser.

Inputs used

Log Sourcesaccepts 0–1,000,000 sources: 200 sources
Events per Second (per source)accepts 0–1,000,000 events/sec: 5 events/sec
Avg Event Sizeaccepts 1–1,000,000 bytes: 500 bytes

Results

Ingestion Rate: 43.20 GB/day
Ingestion Rate: 0.042 TB/day
Projected Monthly Volume: 1,296.0 GB/month
Total Events per Day: 86,400,000 events

Step by step

1Total events/sec: sources × events/sec per source= 1,000 events/sec
2Bytes/sec: total events/sec × avg bytes= 500,000 bytes/sec
3GB/day: bytes/sec × 86400 ÷ 1e9= 43.20 GB/day

Assumptions and limits

The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How do I measure events per second per source accurately?

Sample actual log output over a representative window (including peak traffic periods, not just average) using `wc -l` on rotated logs divided by the time window, or query your existing log shipper's own ingestion metrics.

Does this rate stay constant throughout the day?

Rarely — most systems see peak ingestion during business hours or traffic spikes; size buffers and shippers against peak rate, not average rate, to avoid backpressure during busy periods.

How does average event size vary by log type?

Plain text access logs are often 100-300 bytes; structured JSON application logs with stack traces or context fields commonly run 500 bytes to several KB per event.

What's a good next step after estimating ingestion rate?

Feed this rate into buffer sizing (Fluentd/Fluent Bit), index storage sizing (OpenSearch), and observability cost calculators to get a full picture of pipeline capacity and spend.