A log data service in a virtual environment that allows customers of a compute service provider to access system, application and custom log files associated with virtual machine instances that are executing. In some embodiments, log data can be received that includes events or messages from virtual machines in a multi-tenant environment. The log data can be transformed into metric data, which can be used by the customer to generate statistics, view graphs, and generally monitor the customer's virtual machine instances. The log data can also be stored as a service so that the customer has a central repository for which to access the log data.