Datadog published new log management pricing on Sunday, cutting ingestion rates by 35 percent for customers above 50 terabytes a month and introducing a tier at 500 terabytes that lands roughly 52 percent below the previous effective rate. The change follows a second quarter earnings call where chief financial officer David Obstler acknowledged competitive pressure in logs specifically, and follows three large customer departures that competitors have been publicizing. Grafana Labs won a major European retailer and a US logistics company. ClickHouse's observability offering took a fintech that had been spending above $4 million annually. Datadog's overall revenue still grew 22 percent year over year.
How log pricing got here
Datadog prices logs on ingestion and separately on indexed retention, a structure that made sense when logs were relatively scarce and that scales badly against the volume Kubernetes and microservices produce. A team that decomposed a monolith into forty services generates far more log lines for the same user activity, and every one costs money at ingestion whether or not anyone ever queries it. Bills grew faster than value, which is the precondition for a competitive market.
The workaround customers built was aggressive sampling and filtering before ingestion, often through a separate pipeline product, which meant paying for a tool to reduce what they paid another tool. Datadog sells that tool. Cribl built a business on it. The absurdity of the arrangement has been a running joke among platform engineers for years and it made customers receptive to alternatives.
What the competitors offer
Grafana Loki indexes only labels rather than log content, which makes ingestion cheap and queries slower for full-text search. That trade suits teams whose primary access pattern is filtering by service and time, which describes most operational use. Grafana Cloud prices on ingested volume at rates roughly a third of Datadog's list, and self-hosting is free.
ClickHouse takes a different approach, storing logs in a columnar database with strong compression and pricing on storage and compute rather than ingestion. For high-volume, long-retention use it is dramatically cheaper, and the query language is SQL, which teams already know. What both alternatives lack is the integration Datadog has spent a decade building: the correlation between a log line, a trace, a metric, and a deployment event, in one interface, without configuration.
The story is rarely the launch. It is what breaks, what ships, and who owns the mess at 2 a.m.
Whether the price cut works
We asked six companies spending over $1 million annually on Datadog whether the new pricing changes their plans. Two said it removes the immediate pressure to migrate. Three said it helps and does not close the gap, with one platform director calculating that his Grafana proposal remains 58 percent cheaper after the cut. One said the evaluation is already too far along to stop.
The consistent theme was that the cut applies to ingestion and not to indexing, which for several of them is the larger line. A customer ingesting 80 terabytes and indexing 12 saves meaningfully on the first number and nothing on the second. Datadog's pricing page has eleven distinct SKUs for observability and the complexity itself has become a competitive liability, with several customers saying they cannot forecast their own bill.
The OpenTelemetry factor
The reason migrations are now feasible at all is OpenTelemetry. Historically, switching observability vendors meant reinstrumenting every service, which for a large organization is a multi-year project nobody approves. With OpenTelemetry instrumentation, the vendor is a destination configured in a collector, and switching is a configuration change plus dashboard and alert migration.
That dashboard and alert migration is still substantial, typically three to six months of work for a large environment, and it is the remaining moat. Several vendors now offer automated conversion tools, and Grafana's Datadog dashboard importer handles a claimed 80 percent of cases. As those tools improve, the switching cost drops further, and observability moves toward being a commodity purchase decided on price. Datadog's long-term answer has to be capability rather than lock-in.
What Datadog is betting on instead
The company has been pushing hard into adjacent products: security monitoring, application security, cloud cost management, and an incident response workflow. Those carry higher margins and lower competitive intensity, and Datadog's earnings materials emphasize that customers using more than four products have dramatically better retention. That is the classic platform strategy and it works when the individual products are good enough to win on their own merits.
The risk is defending too many fronts. Datadog competes with Splunk and CrowdStrike in security, with specialized cloud posture vendors, with PagerDuty in incident response, and with Grafana and ClickHouse in the core. Each of those competitors is focused. A price cut in logs buys time and does not resolve the question of whether a single vendor can stay best in class across a portfolio this wide.
For customers the practical exercise this month is to price the alternative properly rather than approximately. A Grafana or ClickHouse migration is cheaper on the invoice and carries costs Datadog customers rarely account for: engineers who maintain the collector fleet, a query language your on-call rotation does not know at three in the morning, and correlation between signals that you now build yourself. Several teams that migrated in 2025 told us the savings were real and roughly 30 percent smaller than their proposal predicted once they counted the two engineers who ended up owning the platform.
Skarvonix will keep following this beat with reporting grounded in how systems behave outside the launch keynote.
- Kubernetes
