Prometheus vs Datadog: cost, residency, and operational trade-offs

Teams weigh Prometheus against Datadog because the trade is stark: Prometheus exchanges engineering labor for full data control and residency, while Datadog exchanges usage-based billing exposure for vendor-managed ingestion and storage while customers still manage agents, integrations, monitors, tagging, and billing controls. Prometheus is the CNCF-graduated, Apache 2.0-licensed standard for Kubernetes metrics: self-hosted, metrics-only, operator-controlled. Datadog is a managed SaaS platform covering metrics, traces, logs, RUM, synthetics, and security. First, compare architecture, data collection, and Kubernetes integration. Next, evaluate signal coverage, querying, alerting, storage, operational overhead, cost, and residency and lock-in. Finally, assess OpenTelemetry and ML before applying the decision framework and FAQ.

Prometheus vs Datadog at a glance

The core differences are:

How they compare

Every Prometheus vs Datadog decision reduces to the tension named in the intro: who runs the system, and who controls the bill and the data. Prometheus wins on license cost and data residency. It also provides Kubernetes-native metrics. Datadog wins on signal breadth and onboarding speed. It includes built-in anomaly detection.

Open-source vs SaaS architecture

Prometheus has no commercial entity behind it. It graduated from the CNCF in August 2018, the second project ever after Kubernetes. You deploy it, you scale it, you own every byte, and nobody sends you an invoice or an SLA.

Datadog uses the opposite operating model. You install an agent, and Datadog runs ingestion, storage, querying, and retention as a managed service.

The verdict splits by team type: platform teams with dedicated infrastructure engineers get flexibility from Prometheus, while teams without self-hosting capacity buy back much of that labor from Datadog. That architectural split drives the first mechanical difference, how each system collects data.

Data collection: pull vs push

Prometheus scrapes targets over HTTP on a schedule, using service discovery for Kubernetes, Consul, EC2, Azure, GCE, DNS, and more. The pull model requires scrape targets to be reachable from the Prometheus server, which creates friction in firewalled environments and for short-lived jobs. The Pushgateway exists as a workaround for ephemeral workloads, but it adds another component to run.

The Datadog Agent runs on each host and pushes telemetry to Datadog’s cloud, requiring only outbound HTTPS. That suits firewalled environments and ephemeral workloads: the agent reports before a container terminates, with no reachability requirement in the other direction.

In practice, Kubernetes service discovery neutralizes most of the pull model’s weakness inside a cluster, because Prometheus auto-discovers pods as they scale. The gap reappears across serverless workloads and network boundaries. Both models converge on Kubernetes as the main battleground, which is the next comparison.

Kubernetes integration

Prometheus integrates with Kubernetes through the Prometheus Operator (v0.93.1 as of August 2026). The Operator provides the ServiceMonitor and PodMonitor CRDs, plus PrometheusRule. The kube-prometheus-stack Helm chart bundles the full monitoring stack. The official compatibility matrix requires Kubernetes 1.25.0 or later for Operator releases from v0.84.0 onward. Basic setup is one Helm command; production-grade setup means configuring exporters per service, long-term storage, and HA.

Datadog ships a Kubernetes Operator, Helm chart, and DaemonSet deployment, with Autodiscovery that polls the Kubelet /pods endpoint every 10 seconds and regenerates check configurations as containers start and stop. Setup effort is lower, but per-pod versus per-node agent misconfiguration is a documented billing trap that produces unexpected spikes.

Prometheus demands more upfront Kubernetes work; Datadog demands ongoing billing vigilance. What each one collects once deployed is the next question.

Metrics, logs, and traces

Prometheus covers metrics and nothing else. The official FAQ states “Don’t use Prometheus for logs!”, and there is no native tracing; exemplars link trace IDs to an external system. Full-stack coverage on the open-source path means assembling Prometheus and a collector. Grafana Loki (v3.7.6) handles logs, while Grafana Tempo (v3.0.3) handles traces. Each component brings separate deployment and query concerns, and cross-signal correlation requires exactly matching, case-sensitive labels across all three according to Grafana’s documentation.

Datadog unifies metrics, traces, logs, RUM, and security signals in one platform with cross-signal navigation built in. A February 2026 CNCF survey found 46.7% of organizations run two to three observability tools in parallel and only 7.4% have a single unified experience, which is exactly the fragmentation Datadog sells against.

If your requirement is metrics-first, Prometheus alone is complete. If you need all three signals, compare Datadog against the full LGTM assembly, not against Prometheus by itself. Signal coverage shapes how you query what you collected.

Querying and visualization

PromQL is the industry-standard query language for cloud-native metrics, expressing rates, percentiles, ratios, and predictions in single expressions, and it transfers across every Prometheus-compatible backend. Visualization is a different story: the built-in Prometheus UI is minimal, and Grafana is the de facto standard dashboard layer nearly every Prometheus deployment adds.

Datadog ships pre-built dashboards that appear the moment an integration is enabled, plus a GUI query builder that lets engineers who never learned a query language build views. The trade is skill portability against onboarding speed: PromQL knowledge follows you anywhere, while Datadog’s query layer stays inside Datadog.

Alerting

Alertmanager (v0.34.0, August 2026) handles Prometheus alerting with a hierarchical routing tree and label-based grouping. It also provides silences and inhibition rules that mute downstream alerts when an upstream cause fires. Its 18 built-in receiver integrations include Slack, VictorOps, OpsGenie, and generic webhooks. HA comes from gossip-based clustering that fails open: during a network partition it prefers duplicate notifications over missed alerts.

Datadog Monitors route through notification rules with tag-based logic and six direct @-mention integrations: Jira, PagerDuty, Slack, webhooks, Microsoft Teams, and ServiceNow. Downtimes provide muting, capped at 32 tags, and conditional template variables control notification content. Two documented gaps versus Alertmanager: notification rules support only key:* wildcards, not partial patterns like key:prod-*, and there is no documented equivalent of inhibition.

Alertmanager gives more routing control at the cost of running it yourself; Datadog gives managed delivery with somewhat coarser matching. Alerting depends on the data still being there, which raises storage.

Long-term storage and scalability

Prometheus’s local TSDB is deliberately limited: not clustered, not replicated, 15-day default retention, and according to official documentation not arbitrarily scalable or durable. Prometheus permanently discards unsent WAL data when a remote-write endpoint remains unreachable for more than two hours. High cardinality causes out-of-memory crashes with no graceful degradation.

Scaling past those limits means adding one of three current remote-storage systems:

• Thanos (v0.42.4, CNCF incubating, Apache 2.0): sidecars upload TSDB blocks to object storage, with query-time deduplication across replicas.
• Cortex (v1.21.1, CNCF incubating, Apache 2.0): horizontally scalable multi-tenant storage with write-path HA deduplication; a third party completed a security audit in April 2026, and the Cortex maintainers fixed all seven findings in v1.21.1.
• Grafana Mimir (3.2.0, AGPL-3.0, not a CNCF project): tested at 1 billion active series; its preferred ingest-storage architecture since 3.0 requires Apache Kafka, which adds an operational dependency, and the AGPL license deserves legal review for SaaS providers.

Datadog operates the storage layer for customers: 15-month metric retention and 15-day default trace retention, extendable to 30 days, are vendor-managed. Customers still manage agents, integrations, monitors, tagging, and billing controls. That operational boundary is the core of the next comparison.

Operational overhead and maintenance

Self-hosted Prometheus at scale costs real engineering headcount, and named cases quantify it. Pipedrive needed two engineers for roughly two to three months to implement and tune Grafana Mimir after hitting scaling problems around 8 million active series. Salesforce Commerce Cloud, running 27 million active series on Thanos across six EKS clusters, reported that updates occupied one engineer for a full day each month per team before moving to a managed service. InfoQ, quoting Colin Douch, puts self-hosted observability at “at least an extra 2-3 full-time engineers and significant money.”

Datadog’s operational surface centers on the agent fleet, integrations, monitors, tagging, and billing controls, while the vendor handles downstream ingestion and storage. Customers avoid storage clusters, HA-pair deduplication, compactor maintenance, and WAL management.

The labor asymmetry is the honest core of the TCO debate, so put numbers on both sides next.

Cost and total cost of ownership

As of August 2026, Datadog’s official pricing list charges per host and per unit of usage: Infrastructure Monitoring at $15/host/month (Pro, annual) or $23 (Enterprise), APM at $31–$40/host/month, logs at $0.10/GB ingested plus indexed-event fees, and custom metrics at 100 included per Pro host with overage at $5 per 100 custom metrics per month. Datadog’s billing documentation counts each unique metric name plus tag-value combination as a distinct custom metric, which makes cardinality the dominant cost lever.

Named accounts show what that mechanism does in production:

• Wolt documented a single custom metric exploding into nearly 2 million unique time series from an entity_id tag. In the broader pre-remediation scenario, the team estimated ~$457,500/month for 9.15 million metrics at list pricing.
• Jack Jiang, SRE at Indeed, cut roughly $100,000 in annual Datadog metric costs by removing unqueried tags from metrics with cardinalities above 200,000.
• Coinbase paid approximately $65M for 2021. Datadog’s CFO confirmed the customer relationship on the Q1 2023 earnings call, and Gergely Orosz’s investigation identified Coinbase.

Prometheus’s license cost is zero, but the full bill includes infrastructure and labor. Pipedrive’s two-engineer implementation and Salesforce Commerce Cloud’s recurring update work show how that labor enters the total. The honest comparison is Datadog’s meters against Prometheus’s headcount, and which side wins depends on scale and how much cardinality your workloads emit. Cost is one axis of control; where the data physically lives is the other.

Vendor lock-in, data ownership, and residency

Prometheus data stays wherever you deploy it, in an open TSDB format you control, with no vendor in the path. The corresponding obligation: there are no vendor compliance certifications, so SOC 2, ISO 27001, or HIPAA posture is entirely your organization’s responsibility to build and audit.

Datadog stores telemetry in one of nine sites: US1, US3, US5, EU1 in Germany, UK1, AP1 in Japan, AP2 in Australia, and two US-FED GovCloud sites. Customers choose the site when they create the account, and moving to another site requires a new account. Certifications are strong: SOC 2 Type 2, ISO 27001, a HIPAA BAA, and FedRAMP High authorization for US1-FED as of May 5, 2026. The structural gap: BYOC covers logs only, so metrics and both trace and RUM data always leave your environment.

Exit friction is documented and material:

• The Master Subscription Agreement gives customers 30 days after termination to download their data.
• Datadog provides no bulk raw-metrics export API.
• Query rollup intervals coarsen to 4-hour buckets over a month and 1-day buckets over a year.
• Log portability depends on configuring archives in your own cloud storage before leaving.

The consistent practitioner pattern, documented in the Stack Pulsar migration playbook, is to accept the loss of historical metrics and run dual stacks while new history accumulates.

groundcover’s BYOC architecture (Bring Your Own Cloud, where your data plane runs in your own cloud account) takes a different position on this trade. The data plane uses ClickHouse for logs and both traces and events, while VictoriaMetrics stores metrics. Both systems run inside your VPC for every signal type and every pricing tier, so residency and exit look like Prometheus while groundcover manages the control plane. Residency settled, one comparison remains: how each platform handles OpenTelemetry and machine learning.

OpenTelemetry and ML/anomaly detection

Prometheus 3.0, released November 14, 2024 as the first major release in seven years, added a native OTLP receiver at /api/v1/otlp/v1/metrics (enabled with --web.enable-otlp-receiver) and UTF-8 metric names so OpenTelemetry metrics store without renaming. The project has publicly committed to becoming the default store for OTel metrics, and OTLP handling has been actively refined through the current release, v3.14.0; teams should test their translation-strategy configuration, since 3.7.0 shipped an OTLP breaking change reverted in 3.7.1.

Datadog supports OTel through the DDOT Collector, a distribution of the upstream Collector, GA since May 2025, plus community-Collector export and direct OTLP agent ingest. The compatibility matrix shows the catch: applications instrumented with OTel lose access to Continuous Profiler, RUM, and App and API Protection. The Register reported in 2023 that “Datadog has been telling users they can use OTEL to get data in, but not get data out.”

On ML, the platforms diverge completely. Datadog ships Watchdog, an always-on anomaly engine included in both Pro and Enterprise infrastructure tiers. It also provides anomaly monitors with three documented algorithms (basic, agile, robust), plus outlier and forecast monitors. Prometheus has no native ML or anomaly detection; you write PromQL threshold and prediction expressions yourself.

Which should you choose?

The decision framework follows from the mechanisms above: team capacity, signal requirements, budget model, and residency mandate.

Choose Prometheus if:

• Full data control is non-negotiable. Self-hosting keeps every byte in infrastructure you operate, in an open format with no exit window.
• You can tolerate zero license cost with real labor cost. Budget for external scaling storage plus the engineering work documented by Pipedrive, Salesforce Commerce Cloud, and InfoQ.
• You have in-house DevOps capacity. Someone must own HA, upgrades, cardinality limits, and the Thanos/Cortex/Mimir layer.
• Your workloads are metrics-focused. Prometheus alone is complete for metrics; logs and traces mean adopting the wider Grafana stack.
• You operate under a data residency mandate that no vendor-site menu satisfies, including air-gapped or sovereign-cloud environments.

Choose Datadog if:

• You want unified signals in one platform. Metrics, traces, logs, RUM, and security correlate natively without label-matching gymnastics across three systems.
• You want vendor-managed ingestion and storage. Datadog handles storage clusters, compactors, and WAL operations, while your team still manages agents, integrations, monitors, tagging, and billing controls.
• You need built-in ML. Watchdog and anomaly/outlier/forecast monitors have no Prometheus-native equivalent.
• You have budget headroom for usage-based billing and the FinOps discipline to police custom-metric cardinality and per-pod agent configuration.
• You have no self-hosting capacity and need 1,000+ integrations across a stack broader than Kubernetes.

There is a third path for teams who want Prometheus-grade residency without Prometheus-grade operations. groundcover provides unified telemetry through a BYOC data plane and the Flora eBPF sensor, with zero application instrumentation.

• Architecture: ClickHouse stores logs, traces, and Kubernetes events, while VictoriaMetrics provides PromQL-compatible metric storage and Prometheus remote-write ingestion inside your cloud account.
• Data collection: Flora deploys as a single DaemonSet, one pod per node, and captures telemetry directly from the Linux kernel without SDKs or per-service agents.
• Billing: Flat per-node pricing is $30/host/month for Pro and $35 for Enterprise, according to groundcover, with no per-GB, per-metric, or per-seat charges.

groundcover’s own published comparison estimates that a team running ~700 Kubernetes nodes with 5 TB/day of logs and 500K custom metrics reduced annual cost from $2.54M on Datadog to $297K on groundcover, an 87% reduction. groundcover published the estimate using stated architectural and pricing assumptions, but no independent source has audited or reproduced the calculation. Better Stack reports that savings for Kubernetes-heavy environments commonly fall in the 40–60% range and cautions that workload variation and BYOC infrastructure costs affect the result.

If you want to validate the architecture on your own cluster, the free plan includes BYOC and requires no credit card. Deploy Flora on one cluster and evaluate full-cluster visibility within hours.

FAQ

What does each option cost at scale?

Prometheus costs $0 in licenses, but named production cases document substantial implementation and maintenance labor. On Datadog’s list prices, infrastructure monitoring alone for 500 Enterprise nodes is $11,500/month before APM, logs, or custom-metric overages, and one published 200-host model with those meters included totals roughly $17,380/month. High-cardinality workloads move the Datadog number far more than node count does.

How much Kubernetes configuration effort does each require?

Prometheus basic setup is one kube-prometheus-stack Helm command; production-grade setup adds per-service exporters, remote storage, HA pairs, and separate log and trace systems. Datadog deploys via Operator, Helm, or DaemonSet with automatic pod discovery, but you must configure the agent correctly, since per-pod deployment mistakes inflate host-based billing.

Does Prometheus need Grafana and Alertmanager?

Grafana is optional in theory: Prometheus has a built-in UI, but it is minimal, and Grafana is the standard visualization layer in practice. Alertmanager is effectively required for production alerting, because deduplication, grouping, silencing, and notification routing live there rather than in Prometheus core.

When does Datadog pricing become prohibitive?

When cardinality escapes control. Dynamic Kubernetes labels and identifiers such as UUIDs or container IDs multiply one metric into thousands or millions of billable series at $5 per 100 per month, the mechanism behind the Wolt outcome covered above. Another documented trigger is per-pod agent misconfiguration.

What are the Prometheus long-term storage options?

Thanos (object-storage-backed, Apache 2.0), Cortex (multi-tenant, Apache 2.0), and Grafana Mimir (highest tested scale at 1 billion active series, AGPL-3.0, Kafka required in its preferred 3.x architecture). Managed alternatives include AWS Managed Service for Prometheus at $0.90 per 10M samples ingested, and VictoriaMetrics as a PromQL-compatible backend.

How does pull vs push play out in practice?

Inside a Kubernetes cluster, the difference mostly disappears because Prometheus service discovery scrapes pods automatically as they scale. Pull hurts with firewalled targets, NAT, serverless, and very short-lived jobs; push handles all of those with outbound HTTPS but requires managing an agent on every host.

Can either handle logs and tracing natively?

Datadog can: logs, traces, metrics, and RUM are native to one platform. Prometheus cannot, by explicit design; its FAQ rules out logs, and tracing requires Tempo or another external system, so the open-source equivalent is a three-plus-component stack with separate query languages.

When should I choose each?

Choose Prometheus for full data control, metrics-focused workloads, a strict residency mandate, and a team with self-hosting capacity. Choose Datadog for unified signals, vendor-managed ingestion and storage, built-in anomaly detection, and a budget that absorbs usage-based billing. If your requirement is data staying in your own cloud account plus flat, forecastable pricing, evaluate groundcover’s BYOC model as the third option.