CI/CD log retention cost in 2026: where the bytes actually go

Build logs feel free because the CI vendor includes them. They are not free; the vendor priced 30-90 days of retention into your seat cost and your minute cost. The bill becomes visible the moment you decide you need longer retention than the platform default, or you ship logs to your observability stack for cross-system correlation. This page maps the per-vendor default, the per-language log volume, and the per-GB cost of every common downstream destination.

Per-vendor log retention defaults

Each vendor includes log retention as part of the plan. None expose a per-workflow override the way they do for artifact retention. If you need different retention you are shipping logs out, not configuring the vendor.

Per-language build log volume

Languages and build tools differ wildly in how chatty they are. Java/Gradle is verbose by default. Go is terse. Node sits in the middle, with the test framework adding the most variability. The ranges below are for a typical build: install dependencies, compile or transpile, run unit tests, output coverage and a results summary. Verbose flags inflate considerably; failed builds with stack traces typically double the volume.

Worked example: a Java backend team running 800 builds/day across services with Gradle as the build tool. Average 1.5 MB per build = 1.2 GB/day = 36 GB/month of build logs. Verbose CI on PRs adds another 25%. Failed-build amplification at a 10% flake rate adds another 15%. Realistic monthly log volume: 50-55 GB.

Shipping logs to Datadog

Datadog is the most common destination for CI logs because most teams already pay for Datadog for application observability. The integration is well-documented; the cost is not always obvious. Datadog charges by ingestion volume and by retention duration, separately. The Datadog Log Management pricing page is the authoritative source. Headline numbers: $0.10/GB ingested, plus retention at $1.27/million events for 7 days, $1.59/million for 15 days, $2.50/million for 30 days, $3.75/million for 90 days. Each line of a build log counts as roughly one event.

A 50 GB/month CI log ingestion at 30-day retention with say 60 million events (a fairly typical event-to-byte ratio for build logs) lands at $5 ingestion + $150 retention = $155/month. Bump retention to 90 days for forensics and the line becomes $5 + $225 = $230/month. The team that flipped on CI log shipping in a sprint without modelling retention costs is the team most likely to discover this surprise on the next bill.

Shipping logs to Splunk

Splunk pricing is workload-based and quoted, but Splunk Cloud Standard is roughly $1.80-$2.00/GB/day of indexed data on average, billed monthly. A 50 GB/month ingestion (about 1.7 GB/day) at 30-day retention is roughly $90-110/month for the index plus storage. Splunk is the standard choice for enterprise security teams that already have a SIEM mandate, where the marginal cost of adding CI log sources is small relative to the existing Splunk investment.

Shipping logs to Grafana Loki (self-hosted)

Loki is the self-hosted log store designed by Grafana Labs as a Prometheus-compatible alternative to Datadog and Splunk for log workflows. Cost structure is Kubernetes pods + S3 storage. A typical 3-node Loki deployment for 100 GB/day ingestion runs about $80-150/month total when you include S3 storage at $0.023/GB-month and the underlying compute. The big cost is engineering time: someone owns the Loki cluster, the dashboards, and the retention policies.

The break-even versus Datadog at typical CI log volumes (50-100 GB/month) is about 6-12 months of operational time; for higher volumes (500 GB/month and up) Loki self-hosted typically lands an order of magnitude cheaper than the equivalent Datadog or Splunk bill, justifying the operational investment.

When to ship logs vs use the vendor default

Three legitimate reasons to ship CI logs to an external store: cross-system correlation (you want to query CI logs alongside production logs in one tool when investigating an incident), retention beyond 90 days for compliance or forensics, and trend analysis on build duration / flake rates that the vendor UI does not surface well.

If none of those apply, the vendor default is fine and the log retention line on your bill is zero. Many teams flip on log shipping out of platform-engineering enthusiasm and discover the storage bill is now $200/month for capability nobody uses. Audit annually: is anyone actually querying the CI logs in your observability tool? If not, switch off the export.

Frequently Asked Questions