Pricing
Two numbers decide your invoice
How many gigabytes we accepted, and how long you asked us to keep them. Everything else — queries, dashboards, alert rules, users, agents, API calls, support tickets — is included and unmetered.
Accepted volume is measured after normalisation and before compression, at the ingest point, and is reported to you continuously rather than at the end of the month. A gigabyte here is 109 bytes, because that is what your own capacity planning uses.
Compression is ours to worry about, not a variable in your invoice. Across the 1 284 TB the platform accepted in August 2026 the blended ratio was 8.4:1, which is why holding a filtered slice for 400 days is affordable at all — but the meter counts the 1 284, not the 153 TB that landed on disk.
Plans
Starter
$0.34per accepted GB
One region, one team, no commitment. Sized for a fleet under two hundred hosts.
- retention included15 d
- retention ceiling90 d
- extra retention$0.021 / GB-mo
- ingest ceiling50 000 ev/s
- agents200
- alert rules50
- query concurrency4
- monthly minimumnone
- supportemail, 2 bd
Standard most accounts
$0.28per accepted GB
The default. One region of your choice, the full retention ceiling, room for a real fleet.
- retention included30 d
- retention ceiling400 d
- extra retention$0.019 / GB-mo
- ingest ceiling400 000 ev/s
- agents5 000
- alert rules1 000
- query concurrency16
- monthly minimum$150
- supportemail + chat, 8 h
Regional
$0.24per accepted GB
Multiple pinned regions under one contract, negotiated ceilings, a named escalation path.
- retention included30 d
- retention ceiling400 d
- extra retention$0.017 / GB-mo
- ingest ceilingnegotiated
- agentsunlimited
- alert rules5 000
- query concurrency32
- monthly minimum$1 800
- support1 h P1, 24/7
Every plan reaches every region and every protocol. The plan changes limits and price, never capability. Region availability and jurisdiction: regions.
How retention is charged
Ingest price buys the included window. Beyond it you pay per gigabyte-month, on the accepted volume you choose to keep, prorated to the day and billed as 30-day months.
ingest_cost = accepted_GB × ingest_rate extra_months = (retention_days − included_days) / 30 retention_cost = retained_GB × extra_months × retention_rate invoice = max(ingest_cost + retention_cost, monthly_minimum)
retained_GB is not necessarily all of it. Retention policies are written per stream, so the usual shape is a small slice kept for a year and everything else dropped at the included window.
Cutting a policy from 400 days to 60 stops the charge at the next daily meter and deletes the blocks outside the new window within 24 hours. There is no minimum retention term and nothing to unwind.
Worked examples
The three anonymised profiles from the overview, with the arithmetic shown. Nothing is rounded except the final line.
| Input | A · logistics, 400 hosts | B · payments, 2 100 hosts | C · game studio |
|---|---|---|---|
| plan | Standard | Standard | Regional |
| region | eu-central-1 | eu-north-1 + na-east-1 | ap-southeast-1 |
| accepted_GB | 700 | 9 400 | 31 000 |
| ingest_rate | $0.28 | $0.28 | $0.24 |
| ingest_cost | $196.00 | $2 632.00 | $7 440.00 |
| retained_GB | 80 | 1 200 | 1 500 |
| retention_days | 180 | 360 | 210 |
| extra_months | 5.0 | 11.0 | 6.0 |
| retention_rate | $0.019 | $0.019 | $0.017 |
| retention_cost | $7.60 | $250.80 | $153.00 |
| monthly_minimum | $150.00 | $150.00 | $1 800.00 |
| invoice | $203.60 | $2 882.80 | $7 593.00 |
Not metered
- queries — any number, subject only to the concurrency limit of your plan
- dashboards and saved queries — unlimited
- users and API keys — unlimited, no per-seat charge
- agents — up to the plan count, no per-host licence
- notifications — webhook, email and syslog deliveries
- rejected data — anything returning 4xx is never billed
- deduplicated batches — within the 15-minute window
- shed data — anything we refused under backpressure
- egress — query results and exports, at any volume
- support — included at the plan’s response target
Metered
- accepted bytes — normalised, pre-compression, per the meter you can read yourself
- retention beyond the included window — per GB-month, prorated daily
Reading your own meter
from metrics | where ts > ago(30d) and name == "hk_accepted_bytes_total" | summarize gb = sum(rate(value, 1h)) * 3600 / 1e9 by signal, d = bin(ts, 1d) | sort by d asc
This series is written into your own account, in your own region, at a one-minute resolution. It is not billed against you and it is the same counter the invoice is generated from.
Billing mechanics
Exceeding your ingest ceiling past the burst allowance does not produce a bigger invoice. It produces 503 responses and shedding, in the fixed order documented under backpressure. We would rather refuse data loudly than bill you for a runaway debug flag. If the ceiling is genuinely too low, raise it — that is a plan change, and it takes effect immediately.
What a bad month looks like
The usual cause of an unexpected invoice is a debug level left on in production. Here is the arithmetic, so it is not a surprise.
| Scenario | Events/s | GB/month | Ingest cost | Change |
|---|---|---|---|---|
| 400 hosts, INFO and above | 640 | 700 | $196.00 | — |
| Same fleet, DEBUG on one service | 2 900 | 3 170 | $887.60 | +353% |
| Same fleet, DEBUG everywhere | 11 400 | 12 460 | $3 488.80 | +1 680% |
| DEBUG everywhere, agent filter on | 680 | 743 | $208.04 | +6% |
The last row is the same fleet with drop: 'severity == "DEBUG" and env == "prod"' in the agent config. The filter runs on your host, so those bytes never become accepted bytes — see agent configuration.
Ask for a sized estimate
Tell us the fleet and the retention you need and we will send back the arithmetic, not a discovery call. Nothing on this form is transmitted anywhere — this is a static page, and the handler below runs entirely in your browser.