What are the ####-VendedLog-Bytes charges on my AWS bill?

Short description

Note: In this article, #### represents the AWS Region code for the Region where you configured the logs. For example, USE1 is the Region code for us-east-1.

VendedLog-Bytes charges appear on your AWS bill when AWS services automatically publish logs to Amazon CloudWatch Logs on your behalf. These charges are based on the volume of log data ingested and AWS calculates these charges at discounted rates compared to standard CloudWatch Logs pricing.

The charge type depends on where you send your logs. For example, if you configure Amazon Virtual Private Cloud (Amazon VPC) Flow Logs to transfer data to Amazon CloudWatch Logs, then ####-VendedLog-Bytes charges appear in Cost Explorer. If you use Amazon Simple Storage Service (Amazon S3) to store your logs, then ####-S3-Egress-Bytes charges appear in Cost Explorer. If you transfer logs to Amazon Data Firehose, then ####-FH-Egress-Bytes charges appear in Cost Explorer.

You can use CloudWatch Vended Logs to send logs from the following AWS services to CloudWatch Logs, Amazon S3, or Firehose:

• Amazon VPC
• AWS Global Accelerator (S3 only)
• Amazon Route 53 Resolver (CloudWatch Logs/S3 only)
• AWS WAF

Resolution

View and analyze VendedLog charges in Cost Explorer

View daily costs and volume trends

To view Vended Logs costs for transfers to CloudWatch Logs, complete the following steps:

1. Open the AWS Billing and Cost Management console.
2. In the navigation pane, choose Cost Explorer.
3. From the Report parameter pane, apply the following filters:
   For Time, choose the relevant dates.
   For Granularity, choose Daily.
   For Dimension, choose Usage type. Under Filters, for Service, select CloudWatch. Then, choose Apply.
   For Usage type, enter vended in the search field, and then select the Vended logs that you want to review.
4. Choose Apply filter.

The results include two graphs that show the daily volume of logs and the corresponding costs. Use these graphs to compare log volume changes against your workload activity.

Identify high usage log groups

Requirement: Before you complete this procedure, activate resource-level data at daily granularity in Cost Explorer.

Complete the following steps:

1. Open the AWS Billing and Cost Management console.
2. In the navigation pane, choose Cost Explorer.
3. From the Report parameter pane, apply the following filters:
   For Dimension, choose Resource.
   For Usage Type, enter vended in the search field, and then select the vended logs that you want to review.
4. Choose Apply.

Identify Vended logs sent to S3

Complete the following steps:

1. Open the AWS Billing and Cost Management console.
2. In the navigation pane, choose Cost Explorer.
3. From the Report parameter pane, apply the following filters:
   For Dimension, choose Resource.
   For Usage Type choose S3-Egress-Bytes.

(Optional) Export and analyze charges with Data Exports

You can use the AWS Data Exports page on the AWS Billing and Management console to create data exports and manually calculate the cost to transfer your data to S3. Compare the exported costs against your AWS bill to identify savings opportunities. To include individual resource IDs in your report, add the lineItem ResourceId field.

Reduce future costs

Vended log charges are based on the volume of logs that you send to Amazon CloudWatch Logs, S3, or Firehose. To reduce future costs, reduce the quantity of logs.

If you use VPC Flow Logs, then limit your flow logs to specific elastic network interfaces, subnets, or traffic types such as REJECT and ACCEPT traffic to reduce log volume. If you don't require the VPC Flow Logs continuously, then turn off the feature and only turn the feature on when you troubleshoot issues.

For more information, see Analyzing, optimizing, and reducing CloudWatch costs