KQL Cost Query Builder
Ready-to-use KQL queries for Azure Log Analytics cost analysis. Customise the parameters and copy directly into Log Analytics.
These queries run in your own Azure Log Analytics workspace. Copy the query and paste it into Azure Portal → Log Analytics → Logs to run it against your data. AzureCalc.uk does not connect to your Azure subscription.
Ingestion by Resource Group
Aggregate billable ingestion and estimated cost by Azure resource group. Useful for team chargeback and showback.
let CostPerGB = 2.13;
let TimeRange = 30d;
let CurrencySymbol = "£";
find where TimeGenerated between(startofday(ago(TimeRange)) .. startofday(now()))
project _ResourceId, _BilledSize, _IsBillable
| where _IsBillable == true
| summarize BillableDataBytes = sum(_BilledSize) by _ResourceId
| extend ResourceGroup = tostring(split(_ResourceId, "/")[4])
| summarize BillableDataBytes = sum(BillableDataBytes) by ResourceGroup
| extend DataIngestedInGB = round(BillableDataBytes / 1e9, 2)
| extend Cost = strcat(CurrencySymbol, round(DataIngestedInGB * CostPerGB, 2))
| project-away BillableDataBytes
| sort by DataIngestedInGB descLines 1–3: Variables
Edit these in the panel on the right. CostPerGB is your PAYG ingestion rate. These let-bindings make the query easy to customise.
Line 4: find operator
Scans ALL tables in the workspace for matching rows. Note: this can be resource-intensive on large workspaces with many tables.
Lines 5–6: Billable filter
_IsBillable filters to only data you are charged for. Free tables like Heartbeat and AzureActivity are excluded from the cost total.
Lines 7–8: Resource group extraction
Extracts the resource group name from the ARM resource ID string (segment at position [4] in the "/" split).
Lines 9–10: Bytes to GB
Converts bytes to GB using Azure's billing standard (10⁹ bytes = 1 GB, not 1 GiB = 1,073,741,824 bytes).
Lines 11–12: Cost & tidy
Formats the cost as a currency string. project-away removes the raw bytes column — only GB and cost are shown in results.
Global Parameters
Query Parameters
Active Values