What you runRunning Datadog?
Every host, every log and every custom metric has its own meter.
Datadog is the platform engineers actually want to use: the trace view, the integrations and the speed from signal to screen are best in class. The pressure is the meters: per host, per GB of logs and again to index them, per custom metric, and per GB your Cloud SIEM analyzes.
Free. No system access. No obligation. You keep the drawing.
Datadog APM and monitoring
$15 per host a month
To monitor one host for a month, at list price.
APM is $31 more per APM host a month.
Datadog pricing list, checked 2026-09-24
Datadog Cloud SIEM SIEM
$150 per GB/day a month
To analyze 1 GB every day for a month, at list price.
Log ingest and indexing are billed separately by Datadog Log Management.
Datadog Cloud SIEM pricing, checked 2026-09-24
01The four problems
Which of these hits your Datadog estate?
Budget, renewals, the order to bring in AI, and collection that runs on someone else’s agents. Each one is about where the data lives, and with Datadog it lives in Datadog’s ecosystem. Pick yours.
“Every new service adds hosts, logs and custom metrics, and each one is a line on the Datadog bill.”
Pay Datadog for what your engineers read. Keep everything else in your own Lake.
- Why it happens
Datadog bills per host, per GB of logs ingested, again per event indexed, and per custom metric. Verbose data and ordinary hosts pay the same meters as the services that matter.
- What changes
Logs and metrics are governed before the meters. The APM stays on the services that earn it, and ordinary hosts move to a store you own.
- How sure you can be
Nothing is lost. The full copy stays in your Lake and replays on demand, and every routing rule is readable code. The reduction is measured on your own noisiest sources, before and after, in writing.
- How soon
With the first source. We start where the most volume sits, prove it, then continue.
- What it takes from you
Your diagrams and one call to start. We build it as code in your repositories and teach your team to run it.
What shrinks
- GB indexed by your SIEMOnly what detection reads is indexed. Duplicates, debug output and unread fields stay out.
- Tokens per AI investigationEvery query to the Lake returns only the fields the agent needs.
- Hosts on per-node licensesOrdinary hosts move to monitoring you own. The APM keeps the apps that earn it.
- Vendor licenses and modulesYou keep the features that earn their price, not the whole platform.
Shapes, not figures. Yours are measured on your own sources in the review.
“Datadog is in every team’s workflow, and every renewal adds a product.”
Keep the APM your engineers love. Make the rest a choice.
- Why it happens
The Datadog Agent, the dashboards, the monitors and now the security products sit on one agreement. Each product added is one more reason to stay.
- What changes
Collection, routing and history live in your account. Datadog keeps the tracing it is best at, and the rest can go wherever you choose.
- How sure you can be
The detections, dashboards and alerts your team relies on keep firing where they do today. A move becomes a parallel run on the same routed feed, proven before anything is retired.
- How soon
Before your next renewal, if we start with the sources that drive it.
- What it takes from you
Your diagrams, your renewal date, and one call.
Your way out
- MigrationToday: Quarters of overlapping licensesWith you in control: Weeks: a parallel run, then a routing change
- Your dataToday: Their format, in their storeWith you in control: Open schemas, OCSF and OpenTelemetry, in your Lake
- HistoryToday: Stays behind when you leaveWith you in control: Replays into any tool you choose
- Collection and fleetToday: Their agents, their consoleWith you in control: A control layer and fleet plane you own
“Our AI plans keep landing on Datadog’s AI, on Datadog’s copy of our data.”
Your agents, on your data, following your runbooks. Not one more module on their price list.
- Why it happens
Datadog’s AI reads what you paid to send and index, sold as one more product. It is their AI, on their rules and their runbooks, never yours.
- What changes
We trim every event in flight to only the fields an agent needs and land it in your Lake. When you add AI triage later, your agent runs in your account on a model you approve, follows the trace ID Datadog raises into the full history, read-only, and works the alerts you choose, with a person on every exception.
- How sure you can be
Agents reason well on clean, trimmed data and badly on noise. Knowing which fields matter takes understanding machine data, source by source, and that is the work we do.
- How soon
As soon as the first sources land clean in your Lake, your agent has something worth reading.
- What it takes from you
Your runbooks, or we write them with you. The agents, prompts and runbooks are code you own.
What you get running
- Agents you control, in your accountThey run where your data is, under your access rules.
- Models you choose, and swapSmall or open-weight models for routine alerts, larger ones for investigations. Changing one is a config change, not a renewal.
- Your runbooks, as codeVersioned in your repositories. The agent follows them step by step.
- Token controlFields trimmed in flight to what the agent needs, so every query reads less and costs less.
- Fixes as pull requestsThe agent writes the fix, a person approves it, and remediation moves at the speed of a review.
- A Lake anyone can queryDevelopers and stakeholders ask the clean Lake directly, at object-storage prices.
“We want OpenTelemetry, not the Datadog Agent on every host.”
LaterA later step, sold only after step one is proved on your data.
Open collectors you configure, routed wherever each signal earns its place.
- Why it happens
The Datadog Agent is the default path in. Datadog accepts OpenTelemetry, and recommends its own build of the collector.
- What changes
Open collectors you configure, routed to Datadog for the services that earn it and to your own store for the rest.
- How sure you can be
OpenTelemetry is the open standard the major APM vendors already accept. Nothing about your destinations has to change on day one.
- How soon
Later. We start with the logs in front of your SIEM, because that is where the money is. Open collection follows once that is proved, host group by host group.
- What it takes from you
Your diagrams and one call. We plan the order with you.
Your control plane
- OpenTelemetry collectorsOpenOne open collector on every host, built for your estate.
- A fleet plane you ownYoursConfiguration and rollout from a console in your account, under OpAMP.
- Changes as pull requestsAs codeAI native: an assistant drafts the change, your team reviews and merges it.
- No vendor agentsRemovedNothing on a host reports to someone else’s console.
- Monitoring, only what earns itYour callStep away from a vendor’s full architecture and keep only the features you value.
02Today, and after
Today, and with the Blueprint
A Datadog estate pays a per-host meter at the door and more inside: traces per host, logs on ingest and again to index, and custom metrics multiplied by cardinality.
Scroll the drawing sideways to see all of it.
What Datadog does best
Datadog is the APM engineers actually want to use. The trace view, the integrations, and the speed from signal to screen are genuinely best in class, and on crown-jewel services the per-host price buys real value. Teams that love Datadog are not wrong.
The bill grows in the corners. Custom metrics are counted by every unique combination of name and tags, so engineers who instrument thoroughly get penalized by cardinality and quietly stop collecting telemetry they need. Log management charges for ingest and again for indexing, so verbose data nobody queries is paid for twice. And ordinary infrastructure hosts pay APM-grade meters for basic checks.
How it works, and where we sit
Datadog is the SaaS platform engineers actually want to use: one Datadog Agent per host carries metrics, traces, and logs into a single console, and monitors alert on any of them. It is billed per product, and the meters multiply: per host for infrastructure and APM, per GB to ingest logs and again to index them, and per custom metric beyond the allowance. We keep Datadog for the tracing your engineers love, govern what reaches its meters, and take infrastructure monitoring off the per-host meter.
03The five verbs
What we keep, and what changes
Keep it and govern what flows in, shrink its footprint, cut what it costs, extend it with an agent, and replace only where replacement is honest.
- Keep
The APM and the traces on the crown-jewel services that earn it. Existing Datadog agents keep running while the control layer works upstream, so nothing your engineers rely on moves.
- Shrink
Logs tier by signal value: the high-value subset indexes in Datadog, the rest lands in object storage you can replay, and the double charge on unqueried data ends.
- Cut
Custom-metric cardinality drops through aggregation and tag governance before metrics hit the Datadog meter, and Cloud SIEM analyzes the security-relevant subset instead of everything.
- Extend
An agent follows the same trace ID Datadog raises into everything the collector kept around it in the Lake.
- Replace
Only where replacement is honest: ordinary infrastructure hosts on basic checks move to an open fleet and an open source time series database you own, with each alert rebuilt and proven in writing first. The APM stays.
The letters mark where each verb acts in the drawing with the Blueprint.
The infrastructure offload, honestly scoped
The tier that moves off Datadog is ordinary nodes on basic checks, and the tier that stays is the tracing your engineers would fight to keep.
We put a control layer in front of Datadog and tier the data before it reaches the meter: high-signal logs, traces, and metrics flow in for full analysis, verbose and duplicate data lands in object storage at a fraction of the cost and stays replayable. One metering view shows every GB by source and destination, replacing the guesswork of reconciling dozens of product lines.
For the infrastructure tier, alert parity comes first: each monitor and each alert is rebuilt on the open fleet and proven to behave as it does today, in writing, before a single host comes off per-host pricing.
Datadog Cloud SIEM
Datadog Cloud SIEM, fed what detection needs
Datadog Cloud SIEM is billed on every GB it analyzes, a meter of its own beside log ingest and indexing, so what reaches it decides the bill.
Cloud SIEM is a natural step for teams already in Datadog: the detection rules run on logs the platform already collects, and investigations stay in the console engineers know. It is a real SIEM, and we treat it as one.
What changes is what reaches the analysis meter. The control layer sends Cloud SIEM the security-relevant subset, cleaned and enriched, and lands the full copy in your Lake, where your agent reads it. The detections keep their inputs, and the rest of the volume stops paying a third meter.
Datadog Cloud SIEM SIEM
$150 per GB/day a month
To analyze 1 GB every day for a month, at list price.
Log ingest and indexing are billed separately by Datadog Log Management.
Datadog Cloud SIEM pricing, checked 2026-09-24
04The free architecture review
We draw your Datadog estate, free.
Telemetry engineers look at your whole environment and show you exactly where the cost, the waste and the hurdles are, and what your architecture could look like. No strings attached.
What you get
- Your Datadog architecture today, drawnEvery source, pipeline and destination, as it actually flows.
- The waste mapWhere you pay for data nobody reads, and what it costs you each year.
- Costs before and after, with estimatesWhat you spend now, and what the same coverage would cost.
- Your target architectureWhat your Datadog estate could look like, drawn on your own sources.
- Options for your business problemNot one product. The choices, with what each one costs and changes.
Who does it
A lead architect with 26 years in monitoring and observability, leading a team of senior engineers in telemetry engineering and pipeline design. The team that reviews it is the team that would build it.
What it takes from you
Your diagrams and one call. No system access.
What comes next
If it pays, a two-week proof of value on your noisiest source, free unless you go ahead. At least 20% less into your SIEM, every alert kept, proved on your data.
What it costs
Nothing
No strings attached. You keep the drawing, whatever you decide.
05Questions
What Datadog teams ask before they book
Do you replace Datadog?
Not the part your engineers love. The APM and deep tracing stay on the services that earn them, and Cloud SIEM stays your SIEM. The honest replacement case is ordinary infrastructure hosts running basic checks, which collect just as well on an open fleet you own, with no per-host license. And with the control layer in front, leaving becomes a routing change, whenever you choose it.
How do you cut custom-metric spend without losing visibility?
Aggregation and tag governance upstream of the Datadog meter. The metrics your dashboards and monitors actually read keep flowing, the cardinality nobody consumes gets aggregated before it bills, and the decision of what counts is made deliberately instead of by default.
What happens to data that stops flowing into Datadog?
It lands in full-fidelity object storage you own, enriched and partitioned, and replays into Datadog or any other destination on demand. Nothing is lost. What changes is which data pays Datadog prices.
Why is the review free?
Because the drawing is how you judge us. You see your own architecture, your waste and your options before you spend anything, and you keep the drawing whatever you decide. No system access, no obligation.
Are you a reseller for a vendor?
Yes, for certain vendors’ software. We are also the delivery partner and integrator on custom projects, directly or alongside your systems integrator. The pipeline subscription is in your name, bought from the vendor, its channel or through Logmetry where we resell it, and priced on its own line. We recommend what fits your business problem, even when that means changing nothing, and no SIEM or APM vendor pays us to recommend it.
What if the savings don’t hold on our data?
You see it measured before you commit. The two-week proof of value runs on your noisiest source, with success criteria signed before it starts, measured in your SIEM’s own license usage view. At least 20% less into your SIEM, every alert kept, proved on your data.
See your Datadog estate drawn, with the costs, before you spend anything
Run by a lead architect with 26 years in monitoring and observability. No system access, no charge, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing