Data Collection Rules (DCRs) let you filter and transform logs before they land in your Log Analytics workspace. This is great for reducing ingestion volume and cost — but the transformation itself can carry a data processing charge depending on the destination table plan and whether Microsoft Sentinel is enabled on the workspace.
The key thing to understand: you always pay ingestion for the data that actually arrives in the table, but the data processing charge is calculated on how much data entered the DCR pipeline, not how much came out. The rules for when and how much you pay differ per plan.
Microsoft documented this behavior on multiple pages. I just collected everything in one post to make it easy to share.
East US Pricing and Processing Rules
| Plan | Ingestion Cost | Data Processing Cost | Data Processing Behavior | Rule |
|---|---|---|---|---|
| Auxiliary / Data lake | $0.05/GB | $0.10/GB | Charged on all data entering the DCR | Always billed, regardless of filtering |
| Basic | $0.50/GB | $0.10/GB | Charged on filtering above 50% | First 50% filtering is free |
| Analytics (no Sentinel) | $2.30/GB | $0.10/GB | Charged on filtering above 50% | First 50% filtering is free |
| Analytics (with Sentinel enabled) | $2.30/GB | $0.10/GB | Free | No data processing cost at all if Sentinel is enabled |
So, in short:
- Auxiliary/Data lake tables: always have processing cost and you have to pay for the full amount reaching the pipeline (not for what is ingested).
- Basic tables: If your filter keeps at least 50% of the data, there is no filtering cost. If you drop more than 50%, you pay data processing cost for the amount above 50%.
- Analytics tables: If Sentinel is not enabled on the Log Analytics workspace, the same rules apply as for Basic tables. If Sentinel is enabled, you don’t pay data processing at all.
To make it easier ‘Log Processing’ in the data lake terminology is called ‘Data Processing’.
Example
100 GB ingested, 60% filtered → 40 GB stored for each table.
| Plan | Ingestion | Data Processing | Total |
|---|---|---|---|
| Auxiliary | 40 GB × $0.05 = $2.00 | 100 GB × $0.10 = $10.00 | $12.00 |
| Basic | 40 GB × $0.50 = $20.00 | 10 GB × $0.10 = $1.00 | $21.00 |
| Analytics (no Sentinel) | 40 GB × $2.30 = $92.00 (LAW prices) | 10 GB × $0.10 = $1.00 | $93.00 |
| Analytics (Sentinel) | 40 GB × $4.30 = $172.00 (Sentinel prices) | $0.00 | $172.00 |
Processing:
- Auxiliary: all 100 GB entering the DCR are billed.
- Basic: 60% filtered − 50% free = 10 GB billed.
- Analytics (no Sentinel): 60% filtered − 50% free = 10 GB billed.
- Analytics (with Sentinel): Free filtering