Cost allocation for logs: Precise, flexible, and non-disruptive

Today, most enterprise IT teams operate as internal service providers. It's likely that you and your team offer services, applications, and infrastructure while charging costs back to business units and application owners.

As onboarding and deployment become faster, self-service and automation have become a requirement; more than ever before, costs must remain predictable, attributable, and easy to report.

If you're working to make log spend visible and fair across teams, you're not alone-this is a common challenge in modern, and cloud native environments.

Assign cost centers and products

Dynatrace allows precise cost allocation for logs, so you can attribute log ingestion and retention to the right cost centers and cost products. This makes internal showback and chargeback straightforward.

Figure 1. Map your signals with your company structure to allocate costs to a cost center or an application

Why this matters

• Cloud-native apps and microservices generate log sources rapidly, while shared platforms can blur ownership. Cost allocation brings clarity.
• Teams want autonomy and instant access, without surprises. Build accountability and trust with simplified and automated cost attribution.
• Service providers require accurate reporting for budgeting, audits, and governance purposes. Cost allocation makes it predictable and repeatable, with more than 60,000 cost allocation combinations out of the box and more available for our large enterprise customers, who are adopting this feature today at scale.

Cost optimization is a team sport

The era of budgets and cost optimization being a concern solely left to finance departments is a thing of the past. Teams are expected to own their budgets. Meaning that cost optimization is not a separate accounting artifact, but rather a shared accountability that each team is expected to contribute to.

Whether your teams offer services, applications, or infrastructure, they will want to leverage logs. Team-level accountability for log management begins with allocating log spend to individual products, owners, or any other method your FinOps practice uses for tracking.

With cost allocation for logs, you can take the non-disruptive route

You can leverage the established and defined annotations and labels of the source, for instance, directly from Kubernetes.

But there might be reasons you want to make that attribution at the processing stage:

• Your source might not be capable of providing annotations and tags.
• You don't have the resources to configure each source individually to match attribution.
• You might want to take a centralized approach, rather than contacting each team individually.
• Your cost allocation requirements are too complex and require a script or a processing technology.

In Dynatrace OpenPipeline®, you can enrich your logs during processing. What may be tedious manual work elsewhere is now centralized and automated.

Figure 2. Set cost-related attributes as part of your central processing in OpenPipeline or reuse attributes from your source

Whatever your requirements and expectations are, whether you need simple tagging or complex attribution rules, OpenPipeline is here to help.

Because cost optimization is a team sport, the output aligns perfectly with the most common FinOps formats, providing the exact granularity necessary to support enterprise-wide optimization initiatives.

What's new with cost allocation

• Billing usage events for logs can now be enriched with dt.cost.costcenter and dt.cost.product.
• Attribution of cost centers and products should best take place at source, but can be dynamically processed with OpenPipeline.
• You can mix and match both attributes or use them individually. This allows you to allocate costs by business unit and product/service, allowing for granular chargeback and showback.

Example: Chargeback and showback with Dynatrace cost attributes

Many organizations use chargebacks to create accountability and transparency for shared costs by charging internal departments for the resources or services they consume, based on actual usage. An effective way to implement this with Dynatrace is to use the dt.cost.costcenter and dt.cost.product attributes together.

Consider a scenario where a central IT team provides observability services to multiple business units, such as Retail, Corporate Banking, and Wealth Management. Each unit runs several applications that generate logs through ingestion channels, such as OneAgent®, Log Ingest API, or OpenTelemetry integrations. To ensure accurate cost attribution, the IT team configures these log sources to automatically enrich each log with the appropriate cost center and product identifiers.

For example, logs generated by the Retail unit's mobile banking app are enriched with dt.cost.costcenter: retail and dt.cost.product: mobile-app. This dual-tagging approach allows the central IT team to allocate log-related costs to the correct business unit and break down those costs by specific products or services within that unit. When billing usage events are enriched with these attributes, Finance teams can apply direct chargeback methods.

Optimize log spend with granular showback

Using the same attribution, IT teams can generate detailed reports showing how much each cost center is spending on log ingestion and retention, as well as which products drive that spend. These reports can be flexibly incorporated with other costs attributed to the same owners or products, such as query costs, using Lookup data in Grail®.

Now consider that same Retail unit. The granular attribution shows that the mobile app is responsible for 70% of its log spend. The team can now take targeted actions. For instance, it can reduce log verbosity in non-critical flows or adjust retention policies to optimize costs.

Meanwhile, central IT maintains full transparency and control over the shared observability platform. This centrally operated, data-driven chargeback model allows teams to operate autonomously without disruption, while aligning with FinOps principles.

Figure 3. Create showback or chargeback reports with account-wide visibility that shows which teams and products retain and ingest logs.

Getting to the numbers

You can report and analyze cost allocation in multiple ways, depending on your audience, business requirements, workflows, and the tools you have.

• Dashboards: Crafting individual dashboards to visualize log ingestion and retention by cost center and product is one of Dynatrace's key strengths. Individual filters, views, and visuals allow you to slice and dice custom dashboards for your teams.
• Notebooks: Explore and validate enriched billing usage events alongside Grail data for deeper analysis or ad-hoc investigations. This route allows admins to align consumption data with log query insights of users in a shareable manner, as the results are stored. Non-admin users can view the results this way when the Notebook is shared with them.
• Account Management portal: Create cost management reports to track accrued costs and perform showback/chargeback at scale across business units and products, sent by email and downloadable in CSV format.
• Lookup data: Some organizations may prefer using lookup tables to allocate costs to their owners or products. This is a good fit for customers who already work with organizational structures that link owners with product and their respective cost centers. It can also serve as an additional support to track queries in your environments. Learn more about Lookup data in Grail.

With these views, IT and Finance can align on the same source of truth, driving targeted optimizations such as adjusting log verbosity in non-critical flows or tuning retention policies, while maintaining shared platform governance.

Get started: a guide for cost allocation

Let's recap the best practices to get started successfully:

1. Inventory your log ingest channels and sources (OneAgent, API, OpenTelemetry, cloud/hyperscaler forwarders, log shippers).
2. Define attributes and assign labels for dt.cost.costcenter and dt.cost.product at the source before ingestion, for example, in Kubernetes, OneAgent, or the API and OpenTelemetry configuration of your apps and services.
3. If updating agents or code changes aren't feasible, define OpenPipeline rules to enrich during the process.
4. Send sample data, verify attributes configured in Grail, and confirm visibility using the Logs app or your existing dashboards.
5. Iterate by team/product, expand coverage, and standardize reporting in the Account Management portal.

New to Log Management & Analytics in Dynatrace?

Ready to make log costs clear, fair, and easy to report? Define your attributes, turn on enrichment, and give your teams the accountability and insights they need-without slowing them down.

If you're already using Dynatrace Platform Subscription (DPS), you can instantly get started with logs today! Additional resources and downloads are available in our community examples space on GitHub.

We invite you to explore our Dynatrace Playground tenant at no cost or to start a free trial to ingest your first logs with cost allocation.