SIEM Log Ingestion Calculator
Turn an EPS figure and a source mix into GB per day, wire bandwidth and annual raw volume using real average event sizes.
Inputs
Normalised fields, GeoIP, threat-intel tags and asset context added at ingest.
Raw Ingest per Day
458.16GB/day
Average Event Size
884bytes
Sustained Ingest Bandwidth
42.42Mbps
Enriched Volume per Day
526.89GB/day
Volume per 30 Days
13.74TB
Volume per Year
167.23TB
Step by step
Values used
Sustained EPS = 6,000 EPS; Firewall and NetFlow share (~300 B/event) = 45 %; Windows Security share (~1.5 KiB/event) = 25 %; Web proxy and DNS share (~800 B/event) = 20 %; EDR telemetry share (~2 KiB/event) = 10 %; Parsing and enrichment overhead = 15 %
SIEM Log Ingestion
GB/day = EPS × average event bytes × 86,400 ÷ 1,000,000,000, where the average event size is the share-weighted mean of the source types.
Enrichment and bandwidth
Enriched volume = raw volume × (1 + enrichment overhead); ingest bandwidth (Mbps) = EPS × bytes × 8 ÷ 1,000,000.
Raw Ingest per Day
= 458.16 GB/day
Average Event Size
= 884 bytes
Sustained Ingest Bandwidth
= 42.42 Mbps
Enriched Volume per Day
= 526.89 GB/day
Volume per 30 Days
= 13.74 TB
Volume per Year
= 167.23 TB
How it works
Event size varies by more than 6× across common sources, so a single average is misleading: 6,000 EPS of NetFlow is a fraction of the volume of 6,000 EPS of EDR telemetry. Weighting each source share by its real average size gives a mean event size, which multiplied by EPS and 86,400 gives daily bytes. GB/day is the unit most SIEM contracts, cloud egress bills and storage plans are denominated in, and mis-estimating the source mix is the single most common cause of a blown first-year licence.
Formulas
SIEM Log Ingestion
GB/day = EPS × average event bytes × 86,400 ÷ 1,000,000,000, where the average event size is the share-weighted mean of the source types.
- EPS
- Sustained events per second
- average event bytes
- Weighted mean of 300 B firewall, 1.5 KiB Windows, 800 B proxy, 2 KiB EDR
- 86,400
- Seconds per day
Enrichment and bandwidth
Enriched volume = raw volume × (1 + enrichment overhead); ingest bandwidth (Mbps) = EPS × bytes × 8 ÷ 1,000,000.
- enrichment
- Extra bytes added by normalisation, GeoIP and intel tagging
- × 8
- Bytes to bits
Frequently Asked Questions
How is SIEM Log Ingestion calculated?
GB/day = EPS × average event bytes × 86,400 ÷ 1,000,000,000, where the average event size is the share-weighted mean of the source types. Event size varies by more than 6× across common sources, so a single average is misleading: 6,000 EPS of NetFlow is a fraction of the volume of 6,000 EPS of EDR telemetry. Weighting each source share by its real average size gives a mean event size, which multiplied by EPS and 86,400 gives daily bytes.
Why does SIEM Log Ingestion matter?
GB/day is the unit most SIEM contracts, cloud egress bills and storage plans are denominated in, and mis-estimating the source mix is the single most common cause of a blown first-year licence.
What values do I need to enter?
This calculator takes 6 inputs: Sustained EPS, Firewall and NetFlow share (~300 B/event), Windows Security share (~1.5 KiB/event), Web proxy and DNS share (~800 B/event), EDR telemetry share (~2 KiB/event), Parsing and enrichment overhead. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why decimal GB rather than binary GiB?
Vendors quote licence tiers and cloud storage in decimal GB (10^9 bytes), so this calculator matches the invoice. Divide by 1.074 if you need GiB for filesystem planning.
Does compression reduce the licensed volume?
Almost never. Licences meter the raw volume presented at ingest; compression only reduces what you pay the storage vendor. Budget both numbers separately.