What does it cost to send your logs to an LLM?
Pick a log format — or paste a sample and it is recognised — set your daily volume, and see the tokens and the monthly cost on Claude, GPT and Gemini models. Token counts per megabyte are measured on 49 real log formats with the models’ own tokenizers; nothing you paste leaves your browser.
Request size, output and batch
What we measured
- One megabyte of security logs is about 501,913 tokens on Claude's current tokenizer, 394,909 on the one before it and 336,391 on OpenAI's o200k — logs tokenize far worse than prose, because addresses, timestamps and IDs split into many small pieces.
- Per megabyte, Palo Alto Networks PAN-OS (CSV syslog) costs the most (690,985 Claude tokens) and Duo Security (authentication and administrator logs) the least (367,152).
- On logs, Claude's current tokenizer (Opus 4.7 and later) produced 27% more tokens than the previous one and 49% more than OpenAI's — compare models by cost per log, not by price per token.
- Sending 1 GB of nginx logs a day, raw, to Claude Sonnet 5.5 costs about $40,000 a month (Claude Haiku 5.5: $2,000). Sending only the 2% that matter: $800.00. One 3,000-token summary an hour: $15.12.
Tokens per megabyte, by log format
Measured 2026-10-24 on 141 files from LogTriage’s parser test corpus (sample logs and vendor-documented examples). Free to reuse under CC BY 4.0.
| Log format | Claude (current) | Claude (previous) | OpenAI o200k |
|---|---|---|---|
| Palo Alto Networks PAN-OS (CSV syslog) | 690,985 | 572,657 | 530,842 |
| AWS S3 server access logs | 683,512 | 568,767 | 473,048 |
| HAProxy | 649,582 | 568,245 | 511,421 |
| nginx / Apache access logs | 634,806 | 527,137 | 462,316 |
| IIS and W3C extended logs (also Amazon CloudFront) | 630,558 | 529,207 | 449,651 |
| AWS VPC Flow Logs | 622,142 | 580,983 | 547,066 |
| AWS ALB / ELB access logs | 618,756 | 530,946 | 471,568 |
| CEF (Common Event Format) | 610,968 | 474,768 | 412,976 |
| CSV access logs | 604,154 | 526,331 | 474,254 |
| IBM QRadar LEEF 1.0 / 2.0 | 592,120 | 464,916 | 404,503 |
| Juniper SRX | 585,070 | 476,757 | 391,115 |
| Linux audit log (auditd) | 578,022 | 490,518 | 396,692 |
| Linux auth.log / syslog | 575,108 | 476,701 | 416,775 |
| Zeek logs (http, conn, ssh, notice, dns) | 562,733 | 498,882 | 414,410 |
| Cisco ASA / Firepower (FTD) | 560,442 | 477,578 | 440,100 |
| MySQL / MariaDB (slow, error and general logs) | 555,866 | 437,849 | 386,173 |
| SentinelOne threats | 548,437 | 404,828 | 369,545 |
| Snort / Suricata fast alerts | 547,838 | 435,152 | 409,639 |
| VMware Carbon Black (EDR, Cloud) | 547,388 | 395,284 | 359,686 |
| AWS WAF logs | 538,483 | 379,029 | 308,483 |
| Cloudflare logs (HTTP requests, firewall events) | 536,614 | 330,534 | 296,943 |
| CrowdStrike Falcon (FDR, event streams) | 535,728 | 361,437 | 326,654 |
| Suricata EVE JSON | 528,175 | 398,552 | 352,084 |
| Sysmon (XML) | 523,454 | 393,452 | 339,460 |
| Traefik access logs (JSON) | 517,713 | 358,300 | 319,838 |
| PostgreSQL (csvlog, stderr, jsonlog) | 515,927 | 409,749 | 368,243 |
| FortiGate | 509,559 | 431,317 | 375,345 |
| F5 BIG-IP ASM / Advanced WAF | 507,930 | 418,056 | 362,342 |
| Wazuh / OSSEC alerts | 504,694 | 384,904 | 340,781 |
| Windows Security events (XML) | 498,043 | 383,786 | 326,461 |
| Microsoft 365 unified audit log | 497,530 | 352,326 | 301,091 |
| JumpCloud Directory Insights | 496,623 | 376,104 | 334,545 |
| Kubernetes audit log | 494,289 | 345,015 | 299,402 |
| GitHub audit log | 490,584 | 400,773 | 340,898 |
| AWS Security Hub findings (ASFF) | 488,329 | 359,029 | 300,676 |
| Okta System Log | 485,276 | 341,162 | 297,462 |
| Elastic Common Schema (Beats, Elastic Agent, Elastic Security) | 483,687 | 348,432 | 317,073 |
| Slack audit logs | 475,377 | 354,271 | 303,015 |
| Google Workspace audit (Reports API) | 474,788 | 329,506 | 292,561 |
| Azure Activity Log | 465,164 | 344,824 | 278,275 |
| Google Cloud audit logs | 463,939 | 337,469 | 253,680 |
| AWS CloudTrail | 460,752 | 374,769 | 309,664 |
| Amazon Inspector findings | 451,789 | 350,223 | 288,491 |
| Microsoft Entra ID sign-in logs | 435,255 | 338,370 | 289,139 |
| AWS Config configuration items | 432,612 | 349,855 | 290,327 |
| Amazon GuardDuty findings | 429,281 | 351,397 | 299,759 |
| Azure NSG / VNet flow logs | 399,962 | 342,135 | 278,398 |
| Microsoft Defender for Endpoint / XDR | 395,413 | 308,360 | 260,893 |
| Duo Security (authentication and administrator logs) | 367,152 | 277,113 | 228,871 |
| All 49 formats | 501,913 | 394,909 | 336,391 |
Claude current = Fable 5.1, Opus 5.5, Opus 5, Sonnet 5.5, Sonnet 5, Haiku 5.5; previous = Haiku 4.5, Sonnet 4.6; o200k = the GPT-4o and GPT-5 families. Counted with Anthropic’s token-counting endpoint (claude-sonnet-5-5, claude-haiku-4-5) and tiktoken 0.14.0; message framing subtracted.
Prices used
Standard prices per million tokens, copied from each provider’s page on 2026-10-24. Check before you budget: prices change.
| Model | Input | Output | Notes |
|---|---|---|---|
| Claude Fable 5.1 · Anthropic | $10 | $50 | |
| Claude Opus 5.5 · Anthropic | $4 | $20 | |
| Claude Sonnet 5.5 · Anthropic | $2 | $10 | |
| Claude Haiku 5.5 · Anthropic | $0.1 | $0.5 | $0.10 / $0.50 for prompts up to 100,000 tokens; $0.50 / $2.50 above. |
| Claude Haiku 4.5 · Anthropic | $1 | $5 | |
| GPT-6 Astra · OpenAI | $10 | $50 | Short-context price (prompts up to 272K tokens). |
| GPT-6.1 Sol · OpenAI | $2 | $10 | Short-context price (prompts up to 272K tokens). |
| GPT-5.6 Luna · OpenAI | $0.2 | $1.2 | Short-context price (prompts up to 272K tokens). |
| GPT-6 Luna · OpenAI | $0.1 | $0.5 | Short-context price (prompts up to 272K tokens). |
| Gemini 4 Argon · Google | $2 | $10 | $4 / $20 from 2026-12-01 · tokens estimated with o200k |
| Gemini 3.8 Flash · Google | $0.75 | $3.75 | $1.5 / $7.5 from 2027-01-01 · tokens estimated with o200k |
| Gemini 3.5 Flash-Lite · Google | $0.3 | $2.5 | tokens estimated with o200k |
Questions
- How many tokens is a 1 MB log file?
- About 501,913 on current Claude models and 336,391 on GPT models, averaged over 141 real log files in 49 formats; individual formats range from 367,152 to 690,985 Claude tokens per MB. English prose runs closer to four bytes per token; logs run about two to three.
- Why do logs use so many more tokens than normal text?
- Tokenizers are trained mostly on prose and code, so they hold whole words but not IP addresses, timestamps, hashes, request IDs or user agents. Those break into many short tokens: an IPv4 address alone is often seven or more. The more numbers and identifiers a format has per line, the more tokens per byte.
- Is it realistic to send all my logs to an LLM?
- For anything beyond small files, no: the model sees every token you send, and raw volume multiplies quickly — the 1 GB-a-day example above is $40,000 a month on a mid-priced model. What works is to filter, aggregate and enrich first, then send the model the events and context that matter.
- How can I cut the cost of LLM log analysis?
- Send less: deduplicate repeated lines, drop fields the model does not need, filter to the suspicious events and group them into sessions. Then use the batch APIs (half price at Anthropic, OpenAI and Google) for anything not urgent, and prompt caching for the instructions you repeat on every request.
- How accurate are these numbers?
- Claude counts come from Anthropic's token-counting endpoint and GPT counts from OpenAI's o200k tokenizer, run on LogTriage's test corpus on 2026-10-24. Your logs will differ by format, field choice and line length, so paste a sample to see its size. Google does not offer its tokenizer offline, so Gemini figures use the o200k ratio and are marked as estimates. Prices were copied from the providers' pages on 2026-10-24.
Let the model read only what matters
LogTriage parses 51 log formats, enriches and scores every event, and sends the AI a few thousand tokens of what matters — not the raw gigabytes. Try the live demo, no signup.