Why does index traffic cost several times higher than read and write traffic?

Index traffic and read and write traffic use different measurement methods, which is why index traffic can cost several times more.

The difference comes down to compression. Index traffic is measured on uncompressed data — it reflects the volume of index data generated when logs are indexed or reindexed. Read and write traffic is measured on compressed data — it reflects the volume actually transferred after compression. Because raw log data compresses well but index files do not, the two numbers diverge significantly.

The size of index data also depends on the complexity of the log content and the number of indexed fields. For example, with 10 GB of raw data, the index file is 8 GB and the compressed data is 2 GB — so index traffic is billed at 8 GB while read and write traffic is billed at 2 GB.

For more information, see Billable items of pay-by-feature.