Skip to content
Logmetry
What you run
SplunkMicrosoft SentinelDatadogDynatraceSolarWindsCriblOpenTelemetryA Data Lake
The Logmetry Blueprint
The whole methodPhase 01 · FoundationPhase 02 · FootprintPhase 03 · AI triageEverything as codeAI native
CompareJournalAboutBook the review

What you run · Datadog

Keep the APM your engineers love

Datadog is the SaaS platform engineers actually want to use: one Datadog Agent per host carries metrics, traces, and logs into a single console, and monitors alert on any of them. It is billed per product, and the meters multiply: per host for infrastructure and APM, per GB to ingest logs and again to index them, and per hundred custom metrics beyond the allowance. We keep Datadog for the tracing your engineers love, govern what reaches its meters, and take infrastructure monitoring off the per-host meter.

01Today

How a Datadog estate looks today

A Datadog estate pays a per-host meter at the door and three more inside: traces per host, logs on ingest and again to index, and custom metrics multiplied by cardinality.

How a Datadog estate looks todayA Datadog agent on every host, billed per host per month, feeds the platform where three more meters wait: APM and traces on every host they touch, log management billed on ingest and again to index, and custom metrics multiplied by cardinality. Telemetry that would cost too much to send is simply never collected.YOUR ESTATEServers, VMs, containersDATADOG AGENTSOne per host, billed per hostApplications, custom metricsPriced outTOO EXPENSIVE TO SEND,SO NEVER COLLECTEDPER HOST, PER MONTHDATADOGMetered per host, per GB, per metricAPM AND TRACESThe part engineers love,on every host it touchesLOG MANAGEMENTBilled on ingest, andbilled again to indexCUSTOM METRICSCardinality multipliesthe meterWHAT YOU PAY FOROrdinary hosts pay APM-gradeprices for basic checks.Custom metrics commonly run30 to 52 percent of Datadogspend.Logs are paid twice, oningest and again to index.Engineers learn to stopinstrumenting.
How a Datadog estate looks today. The agent is billed per host, logs are billed twice, custom metrics are billed by cardinality, and the telemetry that would cost too much is never collected at all.

What Datadog does best

Datadog is the APM engineers actually want to use. The trace view, the integrations, and the speed from signal to screen are genuinely best in class, and on crown-jewel services the per-host price buys real value. Teams that love Datadog are not wrong.

The bill grows in the corners. Industry benchmarks put custom metrics at 30 to 52 percent of total Datadog spend, so engineers who instrument thoroughly get penalized by cardinality and quietly stop collecting telemetry they need. Log management charges for ingest and again for indexing, so verbose data nobody queries is paid for twice. And ordinary infrastructure hosts pay APM-grade prices for basic checks.

02The five verbs

What we do to a Datadog estate

Keep it and govern what flows in, shrink its footprint, cut what it costs, extend it with an agent, and replace only where replacement is honest.

The Logmetry Blueprint applied to a Datadog estateCrown-jewel hosts keep the Datadog agent and the APM. Ordinary hosts move to the open collector, feeding a metric store you own with no per-host bill. A control layer tiers logs and governs tags before anything reaches a meter, everything lands at full fidelity in a lake in your own storage, and only what earns its place crosses into Datadog. An agent you own follows the same trace ID Datadog raises into everything the collector kept around it. Pins: replace on the metric store, cut on the meter, shrink on logs, keep on the APM, extend on the agent.YOUR ESTATEServers, VMs, containersCROWN JEWELS KEEP DATADOGOrdinary hosts, open collectorApplications, custom metricsAll of itYOUR GROUNDTHE CONTROL LAYERLogs tiered by value,tags governedAs code, in your reposYOUR METRIC STOREOrdinary infrastructure,no per-host billREverything, full fidelityTHE LAKE, YOURSPER HOST, PER GBOnly what earns its placeCDATADOGKept for the work only it can doAPM AND TRACESKLOGSHigh-value subset indexesSThe alertYOUR AGENTFollows the same trace IDinto everything around itEIt queries your historyWHAT CHANGEDThe APM stays where itearns its price.Ordinary hosts collect on anopen fleet, parity in writing.Cardinality is governedbefore the meter.
The Logmetry Blueprint applied. The APM stays on the services that earn it, the ordinary tier collects on an open fleet into a store you own, and every meter reads a governed flow. The pins mark where each of the five verbs acts.
KKeep

The APM and the traces on the crown-jewel services that earn it. Existing Datadog agents keep running while the control layer works upstream, so nothing your engineers rely on moves.

SShrink

Logs tier by signal value: the high-value subset indexes in Datadog, the rest lands in object storage you can replay, and the double charge on unqueried data ends.

CCut

Custom-metric cardinality drops through aggregation and tag governance before metrics hit the Datadog meter, where 30 to 52 percent of spend commonly sits.

EExtend

An agent follows the same trace ID Datadog raises into everything the collector kept around it in the Lake.

RReplace

Only where replacement is honest: ordinary infrastructure hosts on basic checks move to an open fleet and an open source time series database you own, with every alert rebuilt and proven in writing first. The APM stays.

The letters mark where each verb acts in the drawing above

03The approach

The infrastructure offload, honestly scoped

The tier that moves off Datadog is ordinary nodes on basic checks, and the tier that stays is the tracing your engineers would fight to keep.

We put a control layer in front of Datadog and tier the data before it reaches the meter: high-signal logs, traces, and metrics flow in for full analysis, verbose and duplicate data lands in object storage at a fraction of the cost and stays replayable. One metering view shows every GB by source and destination, replacing the guesswork of reconciling dozens of product lines.

For the infrastructure tier, alert parity comes first: every monitor and every alert is rebuilt on the open fleet and proven to behave as it does today, in writing, before a single host comes off per-host pricing.

04Questions

Asked about Datadog estates

Do you replace Datadog?

Not the part your engineers love. The APM and deep tracing stay on the services that earn them. The honest replacement case is ordinary infrastructure hosts running basic checks, which collect just as well on an open fleet you own, at a fraction of per-host pricing. And with the control layer in front, if you ever do want to leave, it is a routing change and a migration in weeks, not months held in place by a licence.

How do you cut custom-metric spend without losing visibility?

Aggregation and tag governance upstream of the Datadog meter. The metrics your dashboards and monitors actually read keep flowing, the cardinality nobody consumes gets aggregated before it bills, and the decision of what counts is made deliberately instead of by default.

What happens to data that stops flowing into Datadog?

It lands in full-fidelity object storage you own, enriched and partitioned, and replays into Datadog or any other destination on demand. Nothing is lost. What changes is which data pays Datadog prices.

Start with the review

You share your diagrams, we review them with you, and you leave with your version of the Logmetry Blueprint drawn on your Datadog estate. No system access, no obligation.

Book the reviewOr take the Logmetry Blueprint as a PDF →