SIEM Log Ingestion Calculator
Turn an EPS figure and a source mix into GB per day, wire bandwidth and annual raw volume using real average event sizes.
About SIEM Log Ingestion Calculator
Event size varies by more than 6× across common sources, so a single average is misleading: 6,000 EPS of NetFlow is a fraction of the volume of 6,000 EPS of EDR telemetry. Weighting each source share by its real average size gives a mean event size, which multiplied by EPS and 86,400 gives daily bytes. GB/day is the unit most SIEM contracts, cloud egress bills and storage plans are denominated in, and mis-estimating the source mix is the single most common cause of a blown first-year licence.
Formulas
SIEM Log Ingestion
GB/day = EPS × average event bytes × 86,400 ÷ 1,000,000,000, where the average event size is the share-weighted mean of the source types.
- EPS
- Sustained events per second
- average event bytes
- Weighted mean of 300 B firewall, 1.5 KiB Windows, 800 B proxy, 2 KiB EDR
- 86,400
- Seconds per day
Enrichment and bandwidth
Enriched volume = raw volume × (1 + enrichment overhead); ingest bandwidth (Mbps) = EPS × bytes × 8 ÷ 1,000,000.
- enrichment
- Extra bytes added by normalisation, GeoIP and intel tagging
- × 8
- Bytes to bits
Worked example
With the default values below, SIEM Log Ingestion Calculator returns Raw Ingest per Day of 458.16. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Sustained EPSaccepts 0–10,000,000 EPS
- 6,000 EPS
- Firewall and NetFlow share (~300 B/event)accepts 0–100 %
- 45 %
- Windows Security share (~1.5 KiB/event)accepts 0–100 %
- 25 %
- Web proxy and DNS share (~800 B/event)accepts 0–100 %
- 20 %
- EDR telemetry share (~2 KiB/event)accepts 0–100 %
- 10 %
- Parsing and enrichment overheadaccepts 0–200 %
- 15 %
Results
- Raw Ingest per Day
- 458.16 GB/day
- Average Event Size
- 884 bytes
- Sustained Ingest Bandwidth
- 42.42 Mbps
- Enriched Volume per Day
- 526.89 GB/day
- Volume per 30 Days
- 13.74 TB
- Volume per Year
- 167.23 TB
Step by step
- 1Values used
- 2SIEM Log Ingestion
- 3Enrichment and bandwidth
- 4Raw Ingest per Day= 458.16 GB/day
- 5Average Event Size= 884 bytes
- 6Sustained Ingest Bandwidth= 42.42 Mbps
- 7Enriched Volume per Day= 526.89 GB/day
- 8Volume per 30 Days= 13.74 TB
- 9Volume per Year= 167.23 TB
Assumptions and limits
- The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is SIEM Log Ingestion calculated?
GB/day = EPS × average event bytes × 86,400 ÷ 1,000,000,000, where the average event size is the share-weighted mean of the source types. Event size varies by more than 6× across common sources, so a single average is misleading: 6,000 EPS of NetFlow is a fraction of the volume of 6,000 EPS of EDR telemetry. Weighting each source share by its real average size gives a mean event size, which multiplied by EPS and 86,400 gives daily bytes.
Why does SIEM Log Ingestion matter?
GB/day is the unit most SIEM contracts, cloud egress bills and storage plans are denominated in, and mis-estimating the source mix is the single most common cause of a blown first-year licence.
What values do I need to enter?
This calculator takes 6 inputs: Sustained EPS, Firewall and NetFlow share (~300 B/event), Windows Security share (~1.5 KiB/event), Web proxy and DNS share (~800 B/event), EDR telemetry share (~2 KiB/event), Parsing and enrichment overhead. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why decimal GB rather than binary GiB?
Vendors quote licence tiers and cloud storage in decimal GB (10^9 bytes), so this calculator matches the invoice. Divide by 1.074 if you need GiB for filesystem planning.
Does compression reduce the licensed volume?
Almost never. Licences meter the raw volume presented at ingest; compression only reduces what you pay the storage vendor. Budget both numbers separately.