I didn't realize Log Analytics was on and suddenly have this huge pending charge that would exceed my budget.

Haken 0 Reputation points
2026-09-14T12:16:56.1566667+00:00

New to Azure and I didn't realize Log Analytics was active and growing, now I have a huge pending cost that exceeded my $100 monthly budget 4x over just for logging. Other than that, everything is working great. Tried contacting support, can't figure out how to do that. Is there anything I can do?

Cost Management
Cost Management

A Microsoft offering that enables tracking of cloud usage and expenditures for Azure and other cloud providers.

0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-14T12:17:13.6866667+00:00

    Yes. The fastest path is to identify what is driving the Log Analytics cost, stop or reduce ingestion, and then open a billing support request.

    1. Check the charge source in Cost Management.
      • In the Azure portal, open Cost Management > Cost analysis.
      • Set the view to Daily Costs.
      • Group by Meter to see which Azure Monitor or Log Analytics meters are generating the cost.
      • To narrow the view to monitoring charges, filter Service names to:
        • Azure Monitor
        • Log Analytics
        • Insight and Analytics
        • Application Insights
    2. Investigate the Log Analytics workspace directly.
      • Open the Log Analytics workspace.
      • On Overview, select View Cost to open Cost analysis for that workspace. If View Cost is missing, use the Azure Preview portal.
      • In Cost analysis, select View AccumulatedCosts and then Services to identify which connected service is causing the increase.
      • Change to Daily costs, set a date range such as Last 3 months, and set Group by to Meter category. This helps isolate the spike date and the service behind it.
    3. Understand why the bill grew.
      • Log Analytics charges are typically driven by data ingestion and data retention.
      • Higher-than-expected usage commonly comes from:
        • enabled insights or services and their configuration
        • number and type of monitored resources
        • volume of data collected from each monitored resource
    4. Reduce or stop further cost growth.
      • Review the services sending data to the workspace and investigate those services.
      • If the workspace is not needed, deleting it stops future ingestion charges. This is destructive and removes the workspace.
      • If the workspace is needed, use cost controls instead of waiting for the bill to grow further:
        • consider a daily cap as a preventative measure
        • create alerts when the cap is reached and before it is reached, such as at 90%
        • review Advisor recommendations for Log Analytics cost optimization
      • A daily cap is a safeguard, not a general cost-reduction method, because it disables data collection for the rest of the day after the limit is reached.
    5. Open a support request for the unexpected charge.
      • In the Azure portal, go to Help + Support and create a Billing support request.
      • If usage or charges are not recognized, creating an Azure support request is one of the recommended actions.
    6. For future prevention.
      • Set up budgets and cost alerts in Cost Management.
      • Monitor daily costs for the workspace so spikes are visible early.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.