CloudWatch Logs Insights vs self-hosted Loki: stop paying per scan
TL;DR. CloudWatch Logs Insights bills roughly $0.005 per GB scanned by queries, not per GB stored. So an always-on dashboard — Grafana or CloudWatch’s own — that re-runs its panels on a timer becomes a metered query loop: the same ~30 GB of logs re-scanned every few minutes adds up to hundreds of TB and hundreds of dollars a month, to look at data you stored for about $1. Move the querying to Grafana + Loki on one flat-rate box and it costs the rent of the box — querying is free, so a dashboard that refreshes constantly costs the same as one that never does.
The difference in one table
| CloudWatch Logs Insights | Grafana + Loki (self-hosted) | |
|---|---|---|
| Pricing model | per GB scanned, every query | flat: the rent of one box |
| Always-on dashboard | a metered loop — cost grows with panels + refresh rate | $0 at the margin |
| Example: 30 GB re-queried ~every 10 min, 24/7 | ~$15–50/mo flat | |
| Storage / retention | billed | cheap on the box, or object storage (B2 / MinIO) |
| Lock-in | AWS-native | open source you own |
The stack
Grafana Alloy (ships logs) → Loki (stores + queries; indexes labels, not full text — no per-scan meter)
→ Grafana (the dashboards you already have, repointed to Loki). One flat-rate Hetzner/OVH box; a single
docker-compose. Keep a thin slice of CloudWatch for AWS-native alarms.
The honest part
The box isn’t free to run — priced at engineer rates a self-hosted log stack is realistically $200–500/mo all-in. It still beats a four-figure-and-climbing scan bill decisively; compare against the honest number, not a fantasy “$0.”
→ Full walkthrough — the hardware, a docker-compose to copy, the migration path, and the 5-year math:
The way out of the CloudWatch trap.
For the broader monitoring picture (metrics + logs), see CloudWatch costs too much: the self-hosted stack that cuts it ~90%.
Want your own scan line broken out? Send me a recent cloud bill and I’ll estimate the saving in a business day — free, read by me, never shared.