Datadog Alternatives for Full-Stack Observability in 2026

Datadog lists more than 30 separately priced SKUs, and a Kubernetes cluster with node and pod growth plus custom metrics moves several of those meters at once. Fragmented billing, incomplete telemetry access, SaaS-only residency for metrics and traces, and an OpenTelemetry path that Datadog's own compatibility docs hedge with exclusions are why platform teams evaluate Datadog competitors and alternatives in 2026. This guide first covers the reasons teams leave and the criteria for judging replacements. It then compares the leading tools, deployment choices, pricing mechanics, migration steps, team-specific decisions, and common questions.

Why teams are moving away from Datadog

A single Kubernetes cluster on Datadog bills on at least five independent meters, each with its own overage behavior. Infrastructure Monitoring runs $15–$27 per host per month, and APM adds between $31 and $48 per APM host depending on tier, term, and which Datadog pricing page you read (the APM product page lists $36–$47 annual, $4–6 above the pricing list). The meters below account for most of the documented switching stories.

• Per-host add-on SKUs: Continuous Profiler costs $19–$23 per profiled host per month and Database Monitoring $70–$84 per host, both on top of the base infrastructure fee. Universal Service Monitoring bills $9 per infrastructure host unless the customer has already purchased APM on that host.
• Ingestion and indexing meters: Log Management charges $0.10 per GB ingested plus $1.06–$2.50 per million indexed events depending on retention, and log overages bill at +50% of the annual price. APM charges $0.10 per GB of spans beyond 150 GB per host plus $1.27–$2.50 per million indexed spans.
• Custom metric overages: Pro includes 100 indexed and 100 ingested custom metrics per host and Enterprise includes 200 of each, according to Datadog's allotments page. The overage rate reads as $5 per 100 custom metrics on the pricing table and $0.10 per 100 ingested custom metrics in the billing docs.
• Cardinality multipliers: Distribution metrics generate 5 custom metrics per unique tag combination by default, and adding percentile aggregations (p50–p99) multiplies that by another 5×. There is no separate cardinality surcharge; high-cardinality tags such as user IDs and request IDs inflate the count through ordinary billing.
• Digital experience SKUs: RUM Measure bills $0.15 per 1,000 sessions, RUM Investigate $3.00, and Session Replay $2.50 as an add-on. Synthetic API tests cost $5 per 10,000 runs and browser tests $12 per 1,000.
• Per-seat products: On-Call runs $20 per seat, Incident Management $30 per seat, and Incident Response $40 per seat on annual terms. Pipeline Visibility and Test Optimization bill per active committer, defined as three or more commits a month.

Kubernetes environments add billing traps that do not exist on static VM fleets. Per-pod versus per-node agent deployment causes unexpected host-count spikes, and one r/devops thread from October 30, 2025 with roughly 128 upvotes documented a new Fargate APM SKU that moved the price from $1 to $4 per task without warning.

A Gartner Peer Insights review from February 3, 2026 says: "the billing model is complex, and you have to be extremely careful with custom metrics and log indexing, or the cost will explode."

A New Stack article explains why volume-priced bills grow faster than infrastructure does. In production environments the publication analyzed, 75% of logs were exact duplicates and 81% of trace data consisted of Redis PING commands and health check endpoints, and organizations reported surprise bills of $130,000 a month or more in 2025. Under per-GB and per-event billing, every one of those duplicate log lines costs money to ingest and index.

Contract lock-in makes the cost problem worse. Datadog's proprietary agent and query language raise switching costs, and a Gartner Peer Insights reviewer from January 22, 2026 complained that overages bill at list price rather than the negotiated rate. One Hacker News poster called Datadog's sales process "truly awful".

Three feature gaps show up alongside the cost complaints:

• Data residency: Datadog is SaaS-only for the full telemetry stack. BYOC covers logs, while metrics and traces leave the customer environment; RUM does as well. No on-premises option exists for the complete stack.
• Instrumentation model: APM requires a per-language SDK (10 supported languages) or Single Step Instrumentation, and SSI on Kubernetes requires application restarts for its supported set of Java, Node.js, Python, .NET, Ruby, and PHP. Datadog uses eBPF only inside three scoped products (USM, Network Monitoring, Cloud Security), not for universal telemetry.
• OpenTelemetry exclusions: Datadog excludes OTel SDK data from App and API Protection, Continuous Profiler, Ingestion Rules, and Data Streams Monitoring. The direct OTLP intake accepts HTTP only (no gRPC), requires delta temporality for metrics even though cumulative is the SDK default, and does not compute trace metrics by default.

Teams that stay have reasons worth stating plainly. An r/sre thread credits Datadog with "far superior log controls to help mitigate logging costs" and a "significantly more performant" UI, and the business is growing: Q3 2025 revenue reached $885.7M, up 28% year over year. Having laid out the cost and lock-in drivers plus residency, the next question is how to score a replacement against them.

How to evaluate a Datadog alternative

Score every candidate on six dimensions before you look at a demo, because each one maps to a specific Datadog pain and each has a concrete test. Each dimension below has a test you can run during a trial rather than a claim you have to take on faith.

• Pricing model: Identify the unit of billing (host, node, GB, series, event, seat, or credit) and which workload behaviors move it. A cluster with a high telemetry-to-node ratio favors a per-node unit; a cluster with sparse instrumentation and few services favors a volume unit.
• Deployment flexibility: Determine where the data plane runs: vendor SaaS, your VPC under vendor management, self-hosted, on-premises, or air-gapped. Ask which components store raw telemetry and which store only configuration.
• OpenTelemetry support: Test whether OTLP is a first-class ingest path or a secondary one behind a proprietary agent, and whether the vendor's dashboards and alert definitions use open formats. The switching cost sits in the collection layer and the query language.
• APM depth: Check whether instrumentation uses kernel-level eBPF or application-level bytecode and SDK agents, the default sampling policy, and whether request and response payloads are captured. Ask what happens to a service nobody has instrumented yet.
• Unified telemetry: Count the query languages an on-call engineer must know and confirm that a metric anomaly links to correlated traces in one interface. Then verify that each trace links to its log lines. Three backends with three query languages is a correlation tax paid at 2 AM.
• Infrastructure and Kubernetes monitoring: Verify that Kubernetes events and deployment revisions attach to node conditions and application signals automatically. Then check whether the tool covers VMs and serverless functions. Confirm coverage for any network devices you also run.

The quick-reference table applies those six dimensions to the eight tools this guide profiles.

Quick reference: top Datadog alternatives compared

The table summarizes each tool's positioning, billing unit, deployment model, and OpenTelemetry posture; the sections that follow supply the pricing figures and mechanisms behind each cell:

How the top Datadog competitors stack up

Across the eight Datadog competitors, the decisive differences sit in four places: the unit each vendor bills on, the mechanism each uses to capture traces, how much of the collection path is open standard, and where the data plane physically runs. The four subsections below take each dimension in that order.

Pricing model

Volume-based models bill on bytes or items ingested, consumption models bill on compute-time or per-signal units, retained-series models bill on what survives to storage, and flat per-node models bill on infrastructure count alone.

Volume-based vendors publish the clearest rate cards. New Relic charges $0.40 per GB (Original) or $0.60 per GB (Data Plus) beyond 100 GB a month, plus per-user seats: Core users at $49, Full Platform users at $99 on Standard (capped at 5), $349 per user on Pro annual, or $418.80 per user on monthly pay-as-you-go. Grafana Cloud Pro adds a $19 platform fee to $6.50 per 1,000 active series in the 10,001–100,000 band (falling to $5.50 above 200,001) and $0.05 process, $0.40 write, and $0.10 retain per GB of logs. SigNoz Cloud bills $0.30 per GB for logs and traces and $0.10 per million metric samples, and Coralogix prices everything in units worth $1.50, with logs tiered from 0.75 units per GB ($1.125) for Frequent Search down to 0.08 units ($0.12) for Blocked.

Consumption vendors bill on more meters than volume vendors do. Dash0 splits every signal into an ingest charge and a storage charge: $0.060 plus $0.540 per million spans, log records, or web events, and $0.020 plus $0.180 per million metric data points, with no seat fees. Dynatrace's rate card bills Full-Stack Monitoring at $0.01 per memory-GiB-hour (about $58 a month for an 8 GiB host), with a 4 GiB minimum per host and 15-minute rounding, and then meters logs separately at $0.20 per GiB ingested, $0.0007 per GiB-day retained, and $0.0035 per GiB scanned at query time.

Chronosphere publishes no dollar list prices; billing is contract-based in credits, and unit prices appear only in the tenant's Contract tab. The primary metrics unit is the persisted series: a metric-name-and-label combination written to storage, charged again if it reappears after a 48-hour gap.

Flat node-based pricing bills a flat rate per monitored Kubernetes node or Linux host: Free at $0, Pro at $30, Enterprise at $35, and On Premise at $50 per host per month at published list price. Log volume, custom metric cardinality, trace sampling rate, and user count do not move the bill, and every capability module is included at every paid tier. BYOC compute and storage in your own AWS or GCP account are separate from the license. Your cloud provider also bills the infrastructure costs in your Azure account.

Teams can choose a billing model by comparing telemetry volume with node count. A 700-node cluster emitting terabytes of logs and traces a day sits on the far end of that ratio, and a 12-node cluster with three instrumented services sits on the near end. Pricing model failure modes and TCO get a full treatment later in this guide; the next comparison dimension is how each tool produces the traces you are paying to store.

APM and unified telemetry

The instrumentation mechanism determines coverage, overhead, and what an uninstrumented service looks like on day one.

For supported Linux, Kubernetes, and protocol combinations, eBPF at the kernel captures service traffic when the workload runs. groundcover's Flora eBPF sensor deploys as a Kubernetes DaemonSet, one pod per node, and inspects packets at the protocol level out of process; the documentation states it achieves "100% coverage. No sampling rates or relying on statistical luck." No SDK, no language agent, and no restart. Flora captures the full HTTP request and response body plus headers from the kernel.

eBPF has a shared limitation every vendor in the category inherits. For TLS-encrypted traffic, an eBPF sensor cannot inject trace context into outgoing HTTP headers, so Grafana's Beyla docs describe falling back to TCP/IP-level propagation that breaks at L7 proxies and load balancers, and bpf_probe_write_user is unavailable when the kernel runs in integrity lockdown mode (kernel 5.14 onward). The OpenTelemetry project's OBI announcement states that "Language agents and manual instrumentation are still recommended so that you can specify the granularity of each part of the code," which is why groundcover accepts OTel spans as a first-class source alongside Flora's kernel-captured data.

Bytecode agents trade coverage breadth for code-level depth. Dynatrace's OneAgent injects into supported runtimes and PurePath delivers code-level context end to end, praised by reviewers as "install and forget about it."

SDK-based vendors differ on sampling. Dash0 relies on OTel SDK auto-instrumentation for Java, Node.js, .NET, Python, and Go plus an OTel eBPF Profiler covering seven languages with no code changes.

Grafana's LGTM stack requires PromQL for Mimir, LogQL for Loki, and TraceQL for Tempo, and Elastic exposes five query languages across one backend. Dynatrace's Grail lakehouse queries every signal through DQL, New Relic's NRDB uses NRQL, and groundcover stores logs and traces in ClickHouse. It stores Kubernetes events there as well, while metrics reside in VictoriaMetrics with PromQL. Both storage systems run inside your environment. Having covered how traces get produced and joined, the next question is how much of that collection path you can take with you when you leave.

OpenTelemetry support and lock-in

OpenTelemetry reached CNCF Graduated maturity on May 11, 2026, and SDK stability now varies by signal: Java, .NET, C++, and PHP are stable for traces, metrics, and logs, Go's logs SDK is beta, and Python's and JavaScript's logs SDKs are still in development. Zero-code auto-instrumentation exists for .NET, Go, Java, JavaScript, PHP, and Python. Those maturity gaps matter because a vendor's "OTel support" is only as portable as the weakest signal you depend on.

Three vendors build on OTel without a proprietary agent. Dash0 positions itself as the first OTel-native tool: switching backends requires only a URL change, dashboards use Perses (a CNCF sandbox project), alerting uses PrometheusRule, and raw OTLP data is exportable at any time. SigNoz accepts OTLP over gRPC on 4317 and HTTP on 4318 plus Prometheus and Jaeger receivers. It also supports Zipkin receivers. Coralogix ships no proprietary agent and accepts OTLP over gRPC or HTTP.

The incumbents support OTel behind a proprietary primary path, and the seams show. Datadog's DDOT Collector is GA but requires Agent v7.65 or later, Kubernetes v1.29 or later, and does not support EKS Fargate, and a GitHub issue on Datadog's own mapping library describes the documentation as "outdated and incomplete"; community reviewers went further, calling the OTel docs "incomplete, contradicting or sometimes completely wrong." Dynatrace accepts OTLP over HTTP only, with no gRPC, and treats OTel as a secondary instrumentation path. New Relic offers OTLP ingest plus a hybrid agent OTel API, and Grafana's Alloy is a full OTel Collector distribution while Beyla's eBPF captures only RED metrics and basic spans.

groundcover sits in a fourth position: OTel is first-class on ingest, and the collection sensor is proprietary. Existing OTel SDK spans land in the same ClickHouse tables as Flora-captured traces and appear in one investigation view, so an OTel-instrumented service does not need to be touched during a migration. The switching cost that remains is on the collection side; Flora is groundcover's sensor, so leaving means standing up a different collector, while your stored data stays queryable in ClickHouse and VictoriaMetrics because both run in your account.

Practitioner sentiment has moved toward OTel-first for exactly this reason. Two r/sre threads from 2025 summarize it: "Use OpenTelemetry to avoid vendor lock-in" and "The beauty is that you're not locked into one vendor." Portability of the collection path is one half of lock-in; the other half is where the bytes live, which is the last comparison dimension.

Deployment and data residency

Only two of the eight tools keep raw telemetry inside your own account by default, and only one does so at every price tier. A security review has to evaluate the deployment model first. Compliance badges document controls within that architecture.

SaaS-only vendors move all telemetry to their infrastructure. New Relic stores data in US and EU regions. A separate Japan region keeps Systems Operations Data in the US, as do all New Relic regions. Dash0 runs EU and US regions with SOC 2 Type II and GDPR while Dash0 lists ISO 27001, HIPAA, and PCI DSS as "coming 2026," and Coralogix runs seven endpoints across AWS and GCP with data stored in the customer's own S3 bucket. Chronosphere's Observability Platform is fully managed SaaS with no private deployment documented; only its separate Telemetry Pipeline product runs a data plane in the customer environment while the management plane stores configuration, not raw telemetry.

Self-managed options put the operations burden on you. Grafana OSS, Prometheus, and SigNoz self-hosted are all customer-operated, and SigNoz's Enterprise tier adds a BYOC variant that SigNoz manages in your cloud. Dynatrace Managed provides an on-premises install, though it is a customer-operated appliance rather than vendor-managed infrastructure in your VPC.

Vendor-managed BYOC is rare. Grafana Cloud offers BYOC only on Enterprise with a $25,000-a-year minimum. groundcover's BYOC (Bring Your Own Cloud, where your data plane runs in your own cloud account) is the default at every tier including Free: eBPF sensors, ingestion endpoints, ClickHouse, VictoriaMetrics, and optional cold storage on S3, Google Cloud, or Azure Blob all run in your account, while groundcover manages the control plane for the hosted UI, APIs, authentication, and orchestration. The documentation states the SaaS UI stores only account and user access data plus general Kubernetes metadata such as node counts and cluster names, and groundcover has no access to collected telemetry; on-premises adds a self-hosted control plane, and the air-gapped model keeps sensors, the data plane, the control plane, and authentication inside your environment with no outbound connections.

Compliance badges diverge sharply from residency. FedRAMP authorized Dynatrace at the Moderate level on July 27, 2020, New Relic at the Moderate level on March 2, 2020, and Coralogix U.S. GovOps at the Moderate level on August 14, 2026. Grafana Federal Cloud is FedRAMP High and DoD IL5. Chronosphere has no FedRAMP Marketplace record and groundcover has no FedRAMP status, though groundcover's trust center lists SOC 2 Type 2, a HIPAA BAA, ISO/IEC 27001:2022, and GDPR. New Relic's HIPAA BAA requires Enterprise plus Data Plus in the US region, and New Relic excludes FedRAMP and HIPAA customers from its AI features.

A team subject to FedRAMP therefore shortlists differently from a team subject to HIPAA or regional data residency, because the first needs an authorized SaaS boundary and the second needs the bytes to stay home. With the four dimensions established, the per-tool profiles below show how each vendor's architecture and pricing behave together.

Each tool in detail

Each profile below states the architecture, then the strengths and weaknesses documented sources support, then a verdict. This guide labels vendor-run benchmarks and unaudited savings figures as such.

groundcover

groundcover captures telemetry at the Linux kernel and stores it in your cloud account. eBPF deploys as a single DaemonSet and reads HTTP, gRPC, MySQL, PostgreSQL, Redis, DNS, Kafka, MongoDB (v3.6+), AMQP 0-9-1, GraphQL, AWS S3, and AWS SQS traffic at the protocol level, decrypting TLS through library-level uprobes on Go crypto/tls, OpenSSL, NodeJS, and Java SSL (Java 11+); groundcover leaves Java SSL tracing disabled by default until you set FLORA_NETWORKTRACER_JAVASSLTRACER_TRACINGENABLED='true'. Logs and traces land in ClickHouse. Kubernetes events land there as well, while metrics reside in VictoriaMetrics. Both run as StatefulSets in your VPC.

Every capability ships with the per-node license: APM, logs, infrastructure metrics, RUM, synthetic monitoring, dashboards, AI observability, and AI Agent Mode (Agent Mode). AI Agent Mode investigates in natural language across logs, traces, metrics, events, and entities. It pulls incident context from Slack and Jira, as well as GitHub, supports bring-your-own-LLM, and runs on Amazon Bedrock inside your AWS account for supported AWS deployments, so the telemetry it reasons over stays inside your security boundary. The groundcover MCP Server (MCP integration) exposes the same live data to any MCP-compatible client, IDE, or chat agent.

Named customer outcomes point at the mechanism rather than the discount. BigBasket extended coverage to development and testing environments and reported a 50% reduction in observability spend; Afida grew from 10 to approximately 100 users with no change in cost because there is no per-seat charge; FlipCX extended access beyond engineering to Customer Success, Sales, and Leadership on the same basis.

The published Datadog comparison is vendor-stated and should be read with its methodology. A groundcover LinkedIn post models roughly 700 GKE nodes at 5 TB/day of logs, 8 TB/day of traces, and 500K custom metrics: $2,536,000 a year on Datadog at Enterprise list price versus $297,000 on groundcover, an 87% difference. The assumptions behind those figures:

• The Datadog side uses list price with no enterprise discount.
• The groundcover side uses the $30 Pro rate plus BYOC hosting at a 35% savings plan. The LinkedIn post does not name the customer.
• A groundcover guide from September 2026 states that "no independent third party has audited the figure."

Better Stack's independent comparison puts typical Kubernetes-heavy savings in the 40–60% range with BYOC hosting on top.

Strengths and limitations supported by documented sources:

• Strength, kernel-level collection with no per-service agents: eBPF captures the full request and response for supported services on the node, including services nobody has instrumented, and the resource envelope for the high-throughput configuration is 160m CPU request / 800m limit and 300Mi memory request / 700Mi limit per node.
• Strength, vendor-run overhead benchmark: In groundcover's April 2023 test of a Go 1.19 HTTP server at 3,000 req/s, the eBPF sensor added 9% CPU and 0% memory versus baseline, Pixie added 32% and 9%, the OTel agent 59% and 27%, and the Datadog agent 249% and 227%. groundcover's own 2026 guide labels this "vendor-run with a single workload type" with "no independent replication," and no independent 2024–2026 head-to-head exists.
• Strength, data plane in your account at every tier: BYOC onboarding runs 20–30 minutes, AWS PrivateLink is enabled by default, and a proof of concept fits in a single day with full-cluster visibility within hours.
• Strength, procurement through cloud marketplaces: groundcover is listed on AWS Marketplace, Google Cloud Marketplace, and Microsoft Azure Marketplace, so eligible spend can draw against an existing cloud commitment.
• Strength, review signals: G2 shows 4.8/5 from 26 reviews and PeerSpot 8.0/10 with 100% willing to recommend.
• Limitation, Kubernetes and Linux only: Supported platforms are EKS, AKS, and GKE on Kubernetes 1.21 or later, and the eBPF sensor needs a kernel built with BTF enabled; AWS Fargate and Docker Desktop are not supported, and there is no documented coverage for Windows, macOS, AIX, mainframe, mobile, or serverless. A G2 reviewer called it "less suitable for non-cloud-native systems."
• Limitation, privileged DaemonSet: eBPF requires privileged containers and hostPID: true, which triggers Elastic Security runtime alerts in environments running Elastic Defend.
• Limitation, no FedRAMP authorization: Regulated US federal buyers need an authorized SaaS boundary that groundcover does not hold; BYOC residency does not substitute for a FedRAMP record.
• Limitation, missing modules: No continuous profiling is documented, no SIEM or SOAR suite, no network device monitoring (SNMP, NetFlow), no incident management or on-call scheduling. The AI observability evals capability is in development.
• Limitation, proprietary sensor and preview tooling: The eBPF sensor is groundcover's own collector, so it carries a collection-side switching cost, and the Datadog migration tool is in private preview. A PeerSpot reviewer noted that "Querying data from Groundcover is not easy if you do not have specific information."
• Limitation, thin review base: 26 G2 reviews against Datadog's 723 gives a buyer far less independent signal.

Best for: Kubernetes-native teams that want supported services visible without an instrumentation sprint, regulated or data-sovereign organizations that need the data plane in their own account, and teams running LLM workloads that need per-call telemetry captured at the kernel.

Dynatrace

Dynatrace uses OneAgent to inject into supported processes for PurePath code-level tracing, eBPF at the network layer via NetTracer, and the Grail data lakehouse for telemetry storage. Davis AI correlates events sharing a root cause into a single tracked problem.

The Davis Platform Subscription bills on separate meters that are hard to forecast in advance. The entry point is $7 a month per host for Foundation and Discovery.

Strengths and limitations:

• Strength, coverage breadth: Bare metal and VMs, 14+ Kubernetes distributions, AWS Lambda, Azure Functions, and mainframe z/OS, with Smartscape topology mapping across non-Kubernetes infrastructure.
• Strength, integrated runtime security: Runtime Application Protection, Runtime Vulnerability Analytics, and Security Posture Management run on the same agent, priced at $0.00225 per memory-GiB-hour for RVA and RAP and $0.007 per host-hour for SPM on the rate card.
• Limitation, cost unpredictability: DPS is a consistent criticism across review platforms, and Value for Money is the lowest sub-score where Capterra measures it (4.3/5).
• Limitation, agent overhead and complexity: Reviewers describe OneAgent as "resource-heavy" on lightweight nodes, and DQL carries a steep learning curve with a UI reviewers call "difficult/confusing to navigate."
• Limitation, residency and OTel gaps: Grail is SaaS-hosted, Dynatrace Managed is not equivalent to vendor-managed BYOC, and OTLP arrives over HTTP only.
• Limitation, no permanent free tier: Only a playground sandbox; small deployments face a $20K–$24K annual minimum.

Best for: Large enterprises with hybrid estates spanning mainframe, VMs, and Kubernetes, and teams that need causal AIOps and runtime security from one agent.

New Relic

New Relic bundles a broad integration catalog with a pricing model that charges twice: once for data and once for the people who look at it. The free tier includes 100 GB of ingest a month, one full platform user, and unlimited basic users, and ingest stops at 100 GB until you upgrade or the calendar month resets. Instrumentation arrives through Pixie eBPF (a CNCF Sandbox project), language agents, a standalone eBPF APM agent, or OTel.

New Relic placed a compute-based model in Public Preview as of September 2026. Data + Core Compute meters compute capacity units per customer-initiated action, is available for Pro and Enterprise only, publishes no CCU rate ("Contact Sales"), and still bills ingest separately; practitioners quoted in the record complain that under CCUs "You can't calculate if adding a new dashboard will increase your bill by $50 or $500."

Strengths and limitations:

• Strength, integration depth: 792 quickstarts across infrastructure, cloud, application, and SaaS sources, plus mobile (iOS, Android, React Native, Flutter), network performance, and SAP monitoring.
• Strength, free tier generosity: One r/sre poster wrote, "It's remarkable that Basic (free) users have access to all data."
• Strength, AI roadmap: iRCA and SRE Agent both announced in February 2026 in preview, alongside AI Monitoring for LLM token usage, latency, cost, and response quality.
• Limitation, billing opacity: One SRE on LinkedIn wrote: "We spend millions a year on observability. Every month we get one charge. No breakdown. No invoice. Just a number."
• Limitation, seat-gated access: A SigNoz analysis of New Relic pricing observed that "Companies respond by limiting who gets access. Junior developers often don't get accounts."
• Limitation, no BYOC or on-premises: SaaS only, with HIPAA gated behind Enterprise plus Data Plus in the US region and AI features withheld from FedRAMP and HIPAA customers.
• Limitation, ownership and renewals: Francisco Partners and TPG took the company private in 2023, followed by two undisclosed layoff rounds in 2024; a TrustRadius reviewer in February 2026 wrote, "Their pricing is lazy and they default to higher priced terms at renewal."

Best for: Teams with non-Kubernetes and mobile workloads that need one vendor for all of it, and teams that want a no-credit-card evaluation on a real 100 GB a month of data.

Grafana / Prometheus

Grafana is the dashboarding standard, and the open-source stack behind it asks you to operate four storage systems. The LGTM stack (Loki for logs, Grafana for visualization, Tempo for traces, Mimir for metrics) plus Pyroscope for profiles, k6 for load testing, Alloy as the OTel Collector distribution, and Beyla for supplementary eBPF each carry their own deployment modes, configuration, and query language. Prometheus itself is pull-based, metrics-only, CNCF-graduated, and runs in 77% of CNCF production environments.

Grafana Cloud absorbs that operations burden at usage-based rates. The Free tier covers 10K active series, 50 GB of logs and traces, 3 users, and 14-day retention; Pro adds Kubernetes Monitoring at $0.01 per active host hour (capped at $7.20 a month) and $0.0007 per active container hour, Frontend Observability at $0.75 per 1,000 sessions, and IRM at $20 per active user.

Self-hosting at scale has a documented resource footprint. Pipedrive runs Mimir on roughly 600 GB of memory, 150 CPUs, and 5 TB of S3, CERN runs 49 Kubernetes nodes with 1.2+ TB of RAM and 730 cores for 30 million active series, and Zepto's legacy Prometheus failed at 8–9 million series on 180 GB of RAM before Mimir carried them past 40 million. Grafana deprecated Loki's Simple Scalable Deployment mode and plans to remove it in 4.0. Operators must run exactly one compactor replica because multiple replicas corrupt the shared index, and Grafana 13's unified-storage migration is irreversible on first boot.

Strengths and limitations:

• Strength, ecosystem: 67,563 GitHub stars, 150+ data sources, and 344 plugins.
• Strength, coverage breadth in one vendor: Continuous profiling (Pyroscope), load testing (k6), database observability, and incident management alongside the core signals; Mimir has been tested at 1 billion active series.
• Strength, federal authorization: Grafana Federal Cloud is FedRAMP High and DoD IL5 as of April 2025.
• Strength, Prometheus economics: Zero license cost under Apache 2.0, and a pull model that requires no kernel-level privileges. Teams document replacing $40K–$100K a year of SaaS tooling with Prometheus stacks at $200–$1,250 a month of compute.
• Limitation, usage-based bill shock: Metrics bill on 95th-percentile active series, and a Hacker News poster reported, "We stood up a brand new EKS cluster, and it came in at 50k metrics... It felt intentional." Grafana's own messaging concedes that "Send more, charge more is broken."
• Limitation, deprecation churn: OnCall OSS archived in March 2026, Grafana Agent deprecated within 2–3 years of release, AngularJS removal in v11 broke dashboards, and Mimir 3.0 now requires Apache Kafka.
• Limitation, quality regression complaints: A community forum post describes Grafana as having "degraded to the point where it is unusable... a bloated, rage inducing amalgamation of half broken features."
• Limitation, Prometheus ceilings: Local TSDB is not clustered, OOM crashes at high cardinality occur without graceful degradation (documented on 768 GB instances), WAL replay can take 40+ minutes, and remote-write data is lost if the endpoint is unreachable for more than 2 hours. Every service must expose a /metrics endpoint, and there is no log, trace, or Kubernetes event support in Prometheus itself.

Best for: Open-source-first teams with the engineering capacity to operate LGTM, teams already standardized on PromQL and Grafana dashboards, and federal buyers who need FedRAMP High.

SigNoz

SigNoz is open-source, OTel-native APM with a hosted tier priced per GB. The Teams tier starts at $49 a month with $49 of usage credit (about 163 GB of logs or traces, or 490 million metric samples), includes unlimited teammates and hosts, SOC 2 Type II, and HIPAA, and runs in US, EU, and India data centers; a startup program prices it at $19 a month for 12 months for companies under 3 years old, under 30 employees, and under $6M raised. Enterprise starts at $4,000 a month and comes as SigNoz Cloud Dedicated, BYOC managed by SigNoz in your cloud, or Self-Hosted Enterprise operated by you.

Instrumentation runs entirely through OpenTelemetry. SigNoz documents OTel instrumentation for Node.js, Python, Java, Go, PHP, .NET, Ruby, Elixir, Rust, C++, Swift, Android, iOS, Flutter, NGINX, eBPF via OBI, and Cloudflare Workers, and its Kubernetes OTel Operator guide covers auto-instrumentation for Apache HTTPD, .NET, Go, Java, Nginx, Node.js, and Python through pod annotations such as instrumentation.opentelemetry.io/inject-java: "true".

Strengths and limitations:

• Strength, open standards end to end: OTLP in, OTel Collector configuration you already know, and no proprietary agent to remove later.
• Strength, deployment choice: Cloud, BYOC, or fully self-hosted, which is rare among OTel-native vendors.
• Strength, retention control: Logs and traces from 15 days to 1 year, metrics from 1 to 13 months, selectable per plan.
• Limitation, instrumentation is your job: Coverage is only as complete as the OTel SDKs and Operator injections you deploy, and OTel logs SDKs for Python and JavaScript remain in development.
• Limitation, no published Enterprise rate: Self-hosted Enterprise has no numeric per-GB price; volume discounts and SLAs are negotiated.
• Limitation, per-GB exposure on the hosted tier: The same volume-based dynamics that inflate Datadog bills apply at $0.30 per GB, only at a lower rate.

Best for: OTel-first teams that want open-source APM with the option to self-host or run BYOC without a five-figure minimum.

Dash0

Dash0 is the purest OpenTelemetry-native SaaS on this list and the one with the clearest cost-control tooling. Founded by Mirko Novakovic and Ben Blackmore, who built Instana before IBM acquired it for roughly $500M, Dash0 runs no proprietary agents, configures through a Kubernetes Operator with PersesDashboard and PrometheusRule CRDs, and removed its $50 base fee on February 7, 2025 to bill purely on consumption. Dash0 acquired Lumigo in February 2026 for AWS Lambda and LLM observability.

Spam Filters are the cost lever. They drop individual spans, logs, metric data points, and web events at the ingestion pipeline using only attributes present in the transmitted data, and SignalControl runs them either cloud-side (Managed) or in an OTel Collector inside your cluster (Edge) so filtered data never leaves the network. Filtered telemetry still incurs the ingest charge but not the storage charge. A new filter takes up to 5 minutes to activate, dropped data cannot be recovered, and filtering individual spans can leave traces incomplete.

SIFT is Dash0's AIOps framework: Spam removal, Improve telemetry, Filtering and grouping, and Triage. The Triage button on a span highlights the attribute values correlated with an outlier, and Agent0 (GA June 2026) extends this into hypothesis-driven investigation that "forms hypotheses, tests them against live telemetry, and produces a hypothesis tree," billed at $0.60 per credit with a full RCA or PR generation costing 1–2 credits. Automations time out at 10 minutes and default to a 250-credit weekly budget.

Strengths and limitations:

• Strength, zero lock-in by construction: Switching backends is a URL change, dashboards and alerts use CNCF formats, and raw OTLP is exportable at any time.
• Strength, environment breadth: AWS Lambda, Cloud Run, Fargate, Heroku, Vercel, Cloudflare Workers, and standalone Linux, most of which eBPF-only tools do not reach.
• Strength, real-time cost visibility: Monthly hard budget caps and live cost dashboards, which G2 reviewers contrast favorably with end-of-month surprises; G2 shows 4.8/5 across 42 reviews.
• Strength, Darkplane: AI coding tool usage and cost tracking for Claude Code, Cursor, and Windsurf at $10 per user per month, with no groundcover equivalent.
• Limitation, SaaS only: EU and US regions, no BYOC, on-premises, or air-gapped option, and ISO 27001, HIPAA, and PCI DSS still "coming 2026."
• Limitation, consumption exposure: Per-million span billing in high-throughput microservice environments requires active Spam Filter management, and Dash0 has introduced a fair usage policy.
• Limitation, instrumentation required: No zero-code path for application telemetry; Go needs elevated privileges or compile-time changes.
• Limitation, trust surface: 14-day trial only with no permanent free tier, 42 G2 reviews and no Capterra, TrustRadius, or StackShare presence, a transparently disclosed June 2026 incident in which ingest-only tokens had unintended read/write access to tenant configurations, and no session replay.

Best for: Developer teams standardized on OpenTelemetry who run serverless and edge workloads alongside Kubernetes and want the shortest possible exit path from any vendor, including Dash0.

Chronosphere

Chronosphere treats metrics volume as the problem to solve and shapes data before it is stored. Palo Alto Networks closed its $3.35B acquisition on January 29, 2026, so buyers are now evaluating a subsidiary of a security vendor. Gartner's 2025 Magic Quadrant cited its "cost optimization capabilities with its control plane that closely manages the ingestion, storage, and retention of incoming telemetry using granular policy controls", and the company's own control plane page claims an 89% reduction in data volume, which is vendor-stated and unverified.

The shaping rules are the product. Drop rules remove incoming metrics by label or value about a minute after creation and act prospectively only. Rollup rules aggregate across time and labels at 15-, 30-, or 60-second resolution but stop accepting new input series once one output series exceeds 10 million inputs, and automatic long-term downsampling rewrites everything to 5-minute windows after roughly 5 days and deletes the raw data. Metric quotas allocate data points per second by pool with High, Default, and Low priorities, dropping low-priority data first when a pool exceeds capacity.

Strengths and limitations:

• Strength, Prometheus-native cost control: Every rule operates on Prometheus semantics, and the Telemetry Usage Analyzer shows 30 days of utility data per metric and label and models the impact of a proposed rule before you apply it. Chronosphere translates OTel metrics into Prometheus format for analysis.
• Strength, trace shaping: The Trace Analyzer shows ingested, dropped, and persisted traces in real time, and tail-sampling rules run in precedence order with rates from 0 to 1.
• Strength, compliance basics: SOC 2 Type 2 (most recent period September 1, 2023 to August 31, 2024) and ISO 27001 covering the Observability Platform and Telemetry Pipeline.
• Limitation, no public pricing: Credit-based, quote-only, with rate limits expressed as data points per second and active time series under capacity licensing.
• Limitation, SaaS-only platform: Raw telemetry lives in Chronosphere's cloud; only the pipeline product runs a data plane in your environment. Chronosphere Support sets retention policies according to your contract.
• Limitation, shaping is irreversible: A rule permanently removes data that it drops or downsamples, and a rule mistake surfaces as a missing series during an incident.
• Limitation, no federal authorization: Chronosphere holds no FedRAMP Marketplace record and no confirmed HIPAA BAA.

Best for: Prometheus-heavy organizations whose primary cost problem is metrics cardinality and who have the discipline to own shaping policy as code.

Coralogix

Coralogix is a logs-first platform that ships no collection agent and asks you to run the OpenTelemetry Collector yourself. For Kubernetes, its OpenTelemetry Integration Chart deploys an OTel Agent DaemonSet for node-local collection and an OTel Cluster Collector for cluster metrics and events, scrapes the API Server and Kubelet cAdvisor through the Prometheus receiver at a 30-second default interval, and depends on Kube State Metrics and Node Exporter for APM correlation. Fluent Bit v2.0.7+ is also supported as a standalone log router.

Pricing is unit-based with tiers that reward deprioritizing logs. Metrics cost 30 GB per unit (an effective $0.05 per GB, with 1 GB defined as 750 active series counted per rolling hour), traces are listed at $0.16 per GB on the public pricing page, and pay-as-you-go ingestion above your contractual quota bills at 25% over the standard rate. Coralogix requires annual, prepaid, non-cancellable and non-refundable contracts, and it expires unused units at the end of the term with no carry-forward.

Strengths and limitations:

• Strength, compliance depth for a SaaS vendor: ISO/IEC 27001, 27017, 27018, 27701, and 42001, PCI DSS v4.0.1, a HIPAA BAA published March 1, 2025, and a FedRAMP Moderate GovOps offering.
• Strength, storage in your bucket: Logs and traces compress roughly 5× and metrics 30× into your own S3, with an effective storage cost of $0.003 per GB for logs and traces.
• Strength, OTLP without a vendor agent: Nothing proprietary to remove if you leave, and the same Collector configuration ports to any OTLP backend.
• Limitation, Kubernetes coverage gaps: Kubernetes events are available only for one hour after generation, APM correlation fails if k8s.pod.name or k8s.node.name is unset on a span, and CloudWatch Metric Streams cannot deliver metrics older than two hours.
• Limitation, steep eBPF prerequisites: Its OBI-based auto-instrumentation needs kernel 5.8+ with BTF for basics, 5.17+ for network-level context propagation, and 6.0+ for trace-log correlation, plus CAP_SYS_ADMIN, kernel lockdown set to [none], and no serverless support.
• Limitation, time to value: A Gartner Peer Insights reviewer from October 10, 2025 who rated it 5.0 still noted "it took almost a year to bring the system online at-scale"; a 2.0 review the day before cited "Lack of Accountability and Complex Integrations."

Best for: Logs-first teams that already operate the OTel Collector and want tiered log pricing with data stored in their own S3 bucket.

Cloud-native monitoring tools as alternatives

CloudWatch, Azure Monitor, and Google Cloud Operations price competitively for a single-cloud, single-region estate with modest cross-service correlation needs. Each becomes expensive and structurally limited the moment telemetry originates outside its own platform.

CloudWatch prices logs at $0.50 per GB for standard ingestion, custom metrics at $0.30 per metric per month for the first 10,000, Container Insights for EKS at $0.08 per GB, and Application Signals at $0.35 per GB for the first 10 TB. The structural limits are regional: cross-account observability works within a single AWS Region only, metrics do not aggregate across Regions, sub-minute data is retained for only 3 hours, and the default OTLP sampler of parentbased_always_on sends 100% of traces, up to 20× the ingestion cost of the recommended 5%.

Azure Monitor prices Log Analytics in three tiers: Analytics Logs at $2.30 per GB, Basic Logs at $0.50, and Auxiliary Logs at $0.05, with commitment tiers taking Analytics down to $1.472 at 50,000 GB a day. Basic and Auxiliary tiers do not support join, find, search, or externaldata and cap queries at 30 days, the Azure Monitor Agent requires Azure Arc for on-premises and other-cloud machines and Arc does not support disconnected or short-lived servers, and Application Insights limits each metric to 5,000 time series per 24 hours with ingestion sampling that gives you no control over which traces survive.

Google Cloud Operations charges $0.50 per GiB for logs after 50 GiB a month, $0.20 per million spans after 2.5 million, and $0.06 per million samples for Managed Service for Prometheus. Multi-cloud support has gone backward: Cloud Monitoring ended ingestion of AWS CloudWatch metrics via connector projects and now recommends the Prometheus CloudWatch Exporter instead, metrics scopes perform well only up to 375 projects, and upgrading a log bucket to Observability Analytics cannot be undone.

Multi-cloud estates hit egress before they hit query limits. InfoQ reported a JPMorgan Chase case in which centralizing logs from GCP, AWS, and on-premises into S3 produced "massive egress costs, noisy data, and SREs stuck correlating timestamps across three browser windows during a 2 AM incident," and JPMorgan Chase's fix was OTel Collectors filtering 60–80% of log volume at the edge before it crossed a network boundary. The FinOps Foundation's 2026 program notes that observability can consume up to 30% of total cloud spend in mature environments, which is the number a native-tools strategy has to beat once cross-cloud correlation enters the requirements. General-purpose platforms cover the multi-cloud case; the next section covers the workloads where general-purpose design itself is the limitation.

Specialized alternatives: LLM observability, security, and MLOps

LLM workloads, security analytics, and ML pipeline monitoring each strain an APM built for request-response services, and Datadog sells a separately priced SKU into each of those markets.

LLM observability has an unfinished standards problem underneath it. As of semantic-conventions v1.42.0 (June 12, 2026), all gen_ai.* attributes moved to a dedicated repository with no published releases and a Development (not Stable) status, and attribute names are churning: gen_ai.usage.input_tokens and gen_ai.usage.output_tokens replace the deprecated prompt_tokens and completion_tokens, and gen_ai.provider.name replaces gen_ai.system. Two tools tracking different semconv revisions will disagree on what a token is called.

The LLM-native tools differentiate on evaluation rather than tracing:

• Arize Phoenix: Phoenix computes cost automatically via OpenInference, runs RAG evals for retrieval relevance, faithfulness, and hallucination, supports LLM-as-judge experiments, and measures embedding drift by Euclidean centroid distance. It accepts gen_ai.* attributes and normalizes them to OpenInference.
• Langfuse: Langfuse infers per-call cost from model definitions and has applied tiered pricing for Claude and Gemini since December 2025. It integrates RAGAS and has supported versioned datasets with observation-level evals since February 2026. One practitioner comparison on dev.to reported roughly 15% latency overhead.
• LangSmith: LangSmith computes cost automatically for major providers, auto-versions datasets for offline and online evals, and accepts OTLP ingest with fanout export. One practitioner comparison on dev.to described its "heaviest gravity toward LangChain applications."
• Braintrust: Braintrust reports token usage and cost per LLM span, ships RAGAS-based ContextRecall and AnswerCorrectness scorers, runs CI-first autoevals, and tracks GenAI semconv at OTel v1.44.0.
• W&B Weave: Weave computes cost automatically for OpenAI, Anthropic, Cohere, and Mistral, provides HallucinationFreeScorer and RAGAS scorers, and versions prompt objects.
• Helicone: Gateway architecture with 100% accurate cost via its Model Registry, but the proxy sees only HTTP traffic, so there is no span-level view of internal agent steps, and its Experiments feature was deprecated September 1, 2025.

Datadog's Agent Observability records input, output, and total tokens and dollar costs, supports a hallucination template and retrieval span kind, and tracks GenAI semconv v1.37+, with the advantage that LLM traces sit beside infrastructure metrics in one pane. The friction is billing: agentic workloads emit thousands of spans per user request and every one of them hits the per-span meters.

groundcover's AI observability module takes two instrumentation paths at once. The eBPF sensor auto-detects model calls at the kernel with zero code changes, capturing model, latency, prompt and response content, and token cost at span level, and OpenTelemetry instrumentation layers on the full agent-level trace of tool invocations with arguments and reasoning path; privacy controls strip content where policy requires it, and the per-node license means span volume from agentic workloads does not move the bill. An evals capability is in development.

SIEM and SOAR remain the province of security vendors, and groundcover does not compete there. Splunk holds 11 consecutive Gartner Magic Quadrant SIEM Leader placements and the number one SIEM market share for five consecutive years (IDC), Elastic combines SIEM, XDR, and Elastic Defend endpoint protection and was a Forrester Leader in Security Analytics (Q2 2025), and Sumo Logic's Cloud SIEM ships 900+ rules covering roughly 80% of MITRE ATT&CK. Datadog's Cloud SIEM bills $5–$7.50 per million analyzed events, and Dynatrace folds runtime protection and vulnerability analytics into its agent as described in its profile above.

ML pipeline monitoring, meaning feature and prediction drift on classical models, is covered by none of the general-purpose APM vendors on this list. Phoenix's embedding and prediction drift detection is the only capability among the tools profiled here that addresses it, and Dash0's Darkplane sits adjacent by tracking AI coding tool usage rather than model behavior. Having mapped the specialized markets, the next section returns to the question every persona shares: what each billing model does to the invoice as the estate grows.

Pricing model breakdown

Each billing model exposes a different workload behavior to the invoice, and the right choice depends on which behavior your estate exhibits. Per-host models expose node-count spikes, ingestion models expose cardinality and duplication, retained-series models expose rule misconfiguration, and per-user models expose headcount.

Per-host and per-node models turn autoscaling into a billing event, and vendors handle the spike differently. LogicMonitor counts 7 Kubernetes pods as 1 Hybrid Unit so cost scales with pod density, and SolarWinds applies a 10:1 container-to-node counting ratio; Dynatrace's 15-minute rounding and 4 GiB minimum bill a burst of small pods at the full rate for the interval. groundcover bills on the monthly average number of nodes Flora monitors, so a two-hour scale-out for a load test moves the average by a fraction of a node rather than setting a high-water mark; that averaging is the mechanism that lets you leave development and staging clusters under observation.

Under ingestion pricing, vendors charge teams for the extra telemetry produced by instrumentation mistakes. Elastic's serverless tier meters on "uncompressed, normalized, fully enriched data volume," which is much larger than wire size, and users have documented $520 for fewer than 25 requests and $700 on an idle project; Sumo Logic adds a 10% automatic annual escalator to a credit model reviewers call "very complex and frustrating to manage." The behavioral consequence is the one the Hacker News poster described about Datadog: "I HATE that we have told devs 'don't log so much' -- that misses the entire point of building out a haystack."

Retained-series models move the risk into your rule configuration. Chronosphere's mapping rules downsample through label manipulation but require a paired rule to delete the raw metric; without it, both raw and downsampled series persist and the bill doubles. Dash0's spam filters carry the mirror-image risk: a filter written too broadly drops spans you needed for a complete trace, and the drop is permanent.

Teams facing per-user charges ration access instead of data. New Relic's seat prices are laid out in the pricing comparison above; Better Stack charges $29 a month per responder with non-responders free, and Sentry bundles unlimited users at $26–$80 a month base but bills its Seer AI add-on at $40 per active contributor. Engineering leaders end up choosing which engineers get to see production.

Total cost of ownership for self-hosting is mostly engineering time.

• Third-party estimates put Prometheus scaling solutions (Thanos, Mimir, or VictoriaMetrics) at $25K–$63K a year plus $20K–$60K a year in engineering overhead.
• One team cut an $18K-a-month Datadog bill to $340 in compute.
• Jonas Scholz at Sliplane replaced a roughly $25,000-a-year Grafana Cloud quote with a single bare-metal NVMe machine at about $100 a month while stating he would not make the same choice for customer-facing databases.
• One organization reported $1.9M a year saved after leaving managed Elasticsearch, and ClickHouse benchmarks show 12–19× storage reduction versus Elasticsearch for equivalent OTel log data, which is the same storage engine groundcover's BYOC data plane runs on. A third-party estimate puts BYOC hosting plus license for a 450-node groundcover deployment at roughly $23K a year, though that hosting line lands on your cloud bill rather than the vendor's.

Mapping model to profile:

• High node count, high telemetry volume, Kubernetes-native: Flat per-node removes the volume variable; a 700-node cluster emitting 13 TB a day is the canonical case.
• Low node count, sparse instrumentation: Volume-based free tiers fit; Grafana Cloud Free and New Relic's 100 GB a month cost nothing until you grow into them.
• Enterprise security plus observability in one contract: Splunk or Sumo Logic bundle SIEM with observability at the price of committing to GB-per-day tiers, where Splunk reports 62% of enterprise customers over-committed and paying roughly 24% more than needed.
• Open-source-first with engineering capacity: Prometheus plus Grafana OSS at compute cost, accepting the operational load documented in the Grafana profile.
• Non-Kubernetes hybrid infrastructure: LogicMonitor, SolarWinds, or Dynatrace, because eBPF-on-Kubernetes tools do not reach SNMP devices or mainframes.

The model you choose also shapes the migration, because a per-node license lets you run the new stack in parallel across every cluster without a second volume bill. The next section walks through that cutover.

How to migrate from Datadog

A Datadog migration fails most often at the cutover, not the install. The r/kubernetes community documented a team that lost visibility mid-migration because they cancelled Datadog before Grafana was production-ready, and the fix is a phased plan in which both systems receive the same telemetry until dashboards, monitors, and on-call habits have moved.

Start with Datadog's compatibility constraints. Datadog's compatibility docs state that running the Datadog Agent and a separate OTel Collector on the same host is advised against, and mixing Datadog and OTel SDKs in one application "leads to undefined behavior in most cases," so every service needs a single instrumentation owner during the transition.

1. Inventory what Datadog holds. Export monitors (conditions, thresholds, evaluation windows), dashboards, integrations, and the list of SKUs in use. Note every monitor that depends on a Datadog-only metric name or tag, because those are the ones translation tools will flag.
2. Stand up the replacement collection path in parallel. For an OTel-based target, the official Kubernetes guidance requires two Collector installations: a DaemonSet with the kubernetesAttributes, kubeletMetrics, and logsCollection presets, and a single-replica Deployment with clusterMetrics and kubernetesEvents (more than one replica duplicates events). In the agent-to-gateway pattern, memory_limiter goes first in every pipeline, k8sattributesprocessor adds pod and node metadata, and host_metrics runs only in the DaemonSet. For groundcover, the parallel path deploys Flora as a single DaemonSet; supported services on the cluster are visible within hours without touching application code.
3. Dual-ship during the overlap. Two patterns have documentation behind them. The DDOT Collector's default component set includes both datadogexporter and otlpexporter, so one Agent can export to Datadog and any OTLP backend at once (Agent v7.65+, Kubernetes v1.29+, no EKS Fargate). The contrib datadogreceiver accepts Datadog's native trace endpoints (/v0.3 through /v0.7) at alpha stability and metrics and logs at Development stability; ClickHouse's July 21, 2026 write-up on it concluded "There is still work to do before we recommend it as the basis for large-scale production migrations."
4. Translate dashboards and monitors. OTel attributes map to Datadog tags through opentelemetry-mapping-go: service.name becomes service, deployment.environment becomes env, service.version becomes version. Watch for the JVM metric naming lag, where Datadog's translator still uses pre-stabilization names and applications vanish from built-in dashboards, and for the hostname exporter setting behaving only as a fallback. groundcover's One-click automated migration tool transfers monitors, dashboards, and data sources and performs metric name mapping, label translation, and query syntax conversion automatically; it is in private preview, with New Relic and Grafana support on the roadmap.
5. Cut over by cluster, then by environment. Move non-production clusters first, run production on both systems through at least one full on-call rotation, and keep Datadog read access until every runbook link points at the new tool. Airbnb's InfoQ-reported metrics migration dual-emitted StatsD and OTLP from a shared library until the new pipeline handled over 100 million samples a second and JVM metrics CPU dropped from 10% to under 1%; the legacy there was StatsD and Veneur, but the dual-emission discipline transfers.
6. Decommission. Remove Datadog SDKs and Single Step Instrumentation, delete the Agent DaemonSet, and confirm the last host-hour has billed before ending the service.

If you want to validate the architecture on your own cluster, the free plan includes BYOC and requires no credit card. Deploy Flora on one cluster and evaluate full-cluster visibility within hours.

How to choose the right Datadog alternative

Your team can narrow the shortlist faster by starting with its workload profile. The right Datadog alternative for a 40-node fintech cluster is not the one a mainframe-plus-Kubernetes enterprise should shortlist.

• Cost-constrained Kubernetes teams: Shortlist groundcover, Grafana OSS plus Prometheus, and SigNoz. Flat per-node pricing absorbs log and trace volume that volume-priced vendors meter. Exclude Dynatrace (enterprise minimums), New Relic (seats), and Splunk ($70 per host for infrastructure plus APM before log storage).
• Regulated and data-residency teams: Shortlist groundcover (BYOC at every tier, on-premises, air-gapped), Grafana Enterprise BYOC at its $25K minimum, and Elastic self-managed. Exclude New Relic, Dash0, and Better Stack (SaaS only; Better Stack is explicitly not HIPAA compliant), and remember that FedRAMP buyers need Dynatrace, New Relic, Grafana Federal Cloud, or Coralogix GovOps instead.
• Open-source-first teams: Shortlist Prometheus plus Grafana OSS, SigNoz, and Elastic self-managed under the AGPL v3 license re-added in 2024, which the community received skeptically after the 2021 SSPL change. Budget for the LGTM operations load and Prometheus's metrics-only scope.
• AI and LLM teams: Shortlist groundcover for kernel-captured per-call telemetry with AI investigation inside your security boundary, Dash0 for Lumigo-derived LLM tracing plus Darkplane, and a dedicated eval platform such as Phoenix, Langfuse, or Braintrust for RAG evaluation and datasets until groundcover's evals capability ships. Exclude New Relic if you are FedRAMP or HIPAA (AI features withheld) and treat Dynatrace's AI observability page as thin on specifics.
• Enterprise AIOps teams: Shortlist Dynatrace plus IBM Instana or Splunk. All three carry documented pricing unpredictability, so negotiate the meters before the demo.

Engineering leaders on any of these paths should check marketplace availability, since groundcover, Dash0, and Dynatrace all list on AWS Marketplace and drawing observability spend against an existing cloud commitment avoids a separate procurement cycle.