Log Ingestion Calculator
Calculate daily log ingestion volume from the number of log sources, events per second per source, and average event size.
Inputs
Number of distinct hosts/services/pods emitting logs.
Average log events emitted per second by a single source.
Average size of one log event/line, including metadata.
Ingestion Rate
43.20GB/day
Ingestion Rate
0.042TB/day
Projected Monthly Volume
1,296.0GB/month
Total Events per Day
86,400,000events
Step by step
Total events/sec: sources × events/sec per source
200 × 5
= 1,000 events/sec
Bytes/sec: total events/sec × avg bytes
1,000 × 500
= 500,000 bytes/sec
GB/day: bytes/sec × 86400 ÷ 1e9
500,000 × 86400 ÷ 1e9
= 43.20 GB/day
How it works
Log ingestion volume scales with the number of sources, how frequently each source emits events, and the size of each event: rate_GB_per_day = sources × events_per_sec × avg_event_bytes × 86400 ÷ 1e9. This is the foundational sizing input for every downstream stage of a logging pipeline — buffers, shippers, indices and long-term storage should all be sized against this rate.
Formula
rate_GB_per_day = sources × events_per_sec × avg_event_bytes × 86400 / 1e9
- sources
- Number of log-emitting hosts/services
- events_per_sec
- Average events per second per source
- avg_event_bytes
- Average log event size (bytes)
Frequently Asked Questions
How do I measure events per second per source accurately?
Sample actual log output over a representative window (including peak traffic periods, not just average) using `wc -l` on rotated logs divided by the time window, or query your existing log shipper's own ingestion metrics.
Does this rate stay constant throughout the day?
Rarely — most systems see peak ingestion during business hours or traffic spikes; size buffers and shippers against peak rate, not average rate, to avoid backpressure during busy periods.
How does average event size vary by log type?
Plain text access logs are often 100-300 bytes; structured JSON application logs with stack traces or context fields commonly run 500 bytes to several KB per event.
What's a good next step after estimating ingestion rate?
Feed this rate into buffer sizing (Fluentd/Fluent Bit), index storage sizing (OpenSearch), and observability cost calculators to get a full picture of pipeline capacity and spend.
You might also need
- Fluentd Buffer CalculatorCommonly used together
- Log Compression CalculatorCommonly used together
- ELK Storage CalculatorCommonly used together
- Fluent Bit Throughput CalculatorCommonly used together
- Log Parsing Performance CalculatorCommonly used together
- Log Search Performance CalculatorCommonly used together