What Datadog is and how it works

Datadog is a cloud-scale monitoring and observability SaaS platform that collects metrics and logs alongside traces from servers and containers as well as applications, then unifies them in one hosted interface. Engineering and DevOps teams use it to detect anomalies, trace a slow request down to the host and code path that caused it, and replace a stack of single-purpose monitoring tools with one platform.

Whether it fits your stack depends on details the marketing page skips. You need to know what the agent installs on every node and which products require SDKs. You also need to understand what the billing meters do at scale. This article covers, in order: what Datadog is, how the Datadog Agent and data flow work, its core products, when to use it, its integrations and OpenTelemetry support, how pricing works, and how it compares to alternatives including groundcover.

What is Datadog

Datadog is a SaaS observability platform that unifies the three pillars of observability across infrastructure and applications, plus security, in a single hosted backend. Those pillars are metrics and logs alongside traces. Its catalog has since grown far beyond that core.

Olivier Pomel (CEO) and Alexis Lê-Quôc (CTO) founded the company in 2010 after working on opposite sides of the dev and ops divide at Wireless Generation. Their S-1 founder letter states the founding thesis directly: “We started Datadog to fix this by breaking down silos across systems, teams and functions.”

Datadog went public on Nasdaq as DDOG on September 19, 2019, pricing at $27 per share for $648 million in gross proceeds. Its current scale includes $3.427 billion in FY2025 revenue and roughly 33,400 customers as of mid-2026. Gartner named Datadog a Leader in the Magic Quadrant for Observability Platforms for the sixth consecutive year and positioned it highest in Ability to Execute. That scale is the context for everything below, starting with the mechanism that feeds the platform.

How Datadog works

The Datadog Agent is a lightweight process installed on every host or node that collects telemetry and forwards it to Datadog’s cloud. The architecture documentation describes Agents 6 and 7 as one main process with three components:

• The Collector: runs integration checks every 15 seconds and gathers metrics from the host.
• The Forwarder: sends payloads to Datadog over HTTPS.
• DogStatsD: a Go implementation of StatsD that receives custom metrics over UDP port 8125.

Optional subprocesses extend the core Agent. The trace-agent receives APM data on TCP port 8126, while the process-agent collects live process information. The system-probe and security-agent run as root for eBPF-based network and security monitoring. On Kubernetes, the Agent deploys through Operator or Helm, with DaemonSet deployment also available, and a separate Cluster Agent proxies the Kubernetes API server to reduce load.

Data flows one way. The Agent always initiates outbound traffic over SSL on TCP port 443, and an API key authenticates each Agent. Datadog never opens sessions back to the Agent. All telemetry lands in Datadog’s SaaS backend: BYOC storage is available for logs only, so metrics and traces, RUM sessions, and every other signal exit your environment.

Collection effort varies by pillar. Host-level infrastructure metrics and logs can come from the Agent, while cloud integrations also collect metrics and logs from supported services. Datadog disables log collection by default and ships logs as compressed HTTPS once enabled. Traces require a per-language SDK across nine supported languages; Single Step Instrumentation reduces friction but still installs an SDK. Datadog uses eBPF only in scoped products such as Universal Service Monitoring and Network Monitoring, plus Cloud Security, rather than for universal telemetry collection.

Footprint matters if you run the Agent on hundreds of nodes. Datadog’s vendor-stated baseline is about 0.08% CPU and 130 MB RSS for Agent 7.34.0 on a 4 vCPU host, and the Kubernetes Helm chart requests 200m CPU and 256Mi memory for the core Agent alone, with additional requests for the trace, process, and system-probe containers. Having established how telemetry gets in, the next question is what the platform does with it.

Core features and products

Datadog’s catalog is broad, but six capability areas carry most evaluations.

Infrastructure monitoring

Infrastructure monitoring covers servers and containers, cloud hosts, Kubernetes, serverless runtimes (AWS Lambda, Azure App Service, Azure Container Apps, Google Cloud Run), bare metal, Windows, macOS, and AIX. Host Maps, Container Maps, and the Orchestrator Explorer visualize fleet state, and paid tiers retain full-resolution metrics for 15 months.

Application performance monitoring (APM)

APM surfaces code-level latency and errors alongside request flows and auto-generated service maps from SDK-instrumented services. Sampling is head-based: the default sampler targets 10 traces per second per Agent, with separate error and rare samplers on top. Cross-signal navigation from trace to host to log supports the troubleshooting workflow described by practitioners.

Log management

“Logging without Limits” decouples ingestion from indexing: you pay to ingest everything, then choose which logs to index for search. Flex Logs adds a lower-cost storage tier for 1 to 15 month retention, and archives with rehydration cover long-term compliance needs. Logs correlate with APM traces and infrastructure metrics through shared tags, which is the mechanism behind the single-pane workflow.

RUM and synthetic monitoring

Real User Monitoring measures actual traffic. A browser or mobile SDK passively captures sessions, views, resources, and errors. It also records Core Web Vitals (LCP, INP, CLS), while Session Replay records DOM events for playback.

Synthetic Monitoring is the proactive counterpart: scripted API and browser tests, plus mobile tests, run on a schedule or in CI/CD from managed global locations or private workers inside your network. RUM tells you what real users experienced; synthetics catches regressions before a user ever hits them.

Cloud security and compliance

Cloud Security Management bundles CSPM and CIEM alongside vulnerability management, with over 1,000 out-of-the-box compliance rules mapping to frameworks including SOC 2, HIPAA, PCI DSS v4.0, NIST 800-53, and CIS cloud benchmarks. Cloud SIEM provides threat detection, Workload Protection adds kernel-level runtime threat detection, and a Sensitive Data Scanner redacts data in flight. Datadog’s US1-FED site holds FedRAMP High certification.

AI-powered features

Watchdog is Datadog’s longest-standing AI engine: it computes baselines of expected behavior, flags anomalies across APM and infrastructure as well as logs, and automates preliminary root cause analysis for APM users. Bits AI is the newer agentic umbrella: Bits Investigation (generally available December 2, 2025) autonomously investigates production issues, Bits Code creates fix PRs in GitHub, and Bits Chat and Bits Security Analyst reached GA at DASH 2026, with several more agents in preview. For teams running LLM workloads, Agent Observability (GA June 2025) traces multi-agent workflows and tool calls alongside handoffs, free up to 40,000 LLM spans per month.

When to use Datadog

Troubleshooting across signals is the strongest use case. A Hacker News practitioner described the workflow: “See a slow request? Click into the APM trace. Notice a service on that trace being slow? Click onto it, see what host it was running on.” When metrics and traces share a backend with logs and common tags, that pivot takes seconds.

The other established use cases follow the same consolidation logic:

• Alerting: Watchdog generates anomaly alerts without hand-tuned thresholds across billions of data points.
• Capacity planning: 15-month metric retention across multi-cloud and hybrid environments, plus on-premises hosts, supports trend analysis.
• Compliance: the CSM rule library maps cloud configuration against the regulatory frameworks named above.
• Single pane of glass: the product catalog spans infrastructure and APM, logs, security, digital experience, software delivery, AIOps, and AI observability.

That breadth can also compound the cost outcomes covered in the pricing section, but first, the integration surface.

Integrations and supported platforms

Datadog reached 1,000 integrations in October 2025. The AWS integration alone pulls logs and events alongside metrics from CloudWatch for over 90 AWS services, with equivalent coverage for Azure and GCP, plus Alibaba Cloud, Oracle Cloud Infrastructure, and Red Hat OpenShift. Database integrations span PostgreSQL and MySQL, MongoDB, Redis, SQL Server, Cassandra, Elasticsearch, Snowflake, and ClickHouse, though the deeper Database Monitoring product supports a narrower set: Postgres and MySQL, Oracle, SQL Server, MongoDB, Amazon DocumentDB, and ClickHouse.

OpenTelemetry support is genuine but tiered. Datadog offers four ingestion paths: OTLP ingest in the Agent, the recommended DDOT Collector embedded in Agent v7.65+, a standalone OTel Collector with the Datadog Exporter, and a direct OTLP intake endpoint that went GA in July 2026.

The tiers matter for lock-in. Datadog’s advanced-feature requirements still include its own agent or its own OTel distribution for advanced features such as database monitoring and cloud network monitoring, and Omdia analyst Torsten Volk put it plainly: “There are degrees of lock-in. [Datadog] having [its] own OpenTelemetry distribution means that customers would only get base functionality with the upstream OpenTelemetry collector, and all the good stuff is only available when you run it with the Datadog agent.” Exit friction is measurable too: Datadog migration translations included over 300 predefined metric translations to map its naming conventions to Prometheus and OTel formats. Lock-in and cost compound each other, which brings us to the billing model.

How Datadog pricing works

Datadog bills each product on its own meter, so a full deployment stacks per-host and per-GB charges alongside per-event, per-metric, and per-session charges. Key rates from the official pricing list, annual billing:

The perceived expense comes from how those meters compound with workload activity rather than headcount. On Datadog’s Q1 2023 earnings call, a JPMorgan analyst calculated one customer’s bill at “about $65 million,” and The Pragmatic Engineer reported that customer as Coinbase. Datadog’s own earnings calls from 2022 through 2025 repeatedly disclosed customers running “tighter optimization cycles” to shrink observability spend.

Smaller-scale accounts show the same mechanics. A Reddit sysadmin thread documents a $30,000 custom-metric overage from high-cardinality URL tags with no warning before the account manager called, and a Hacker News user reported $6,500 in unexpected Cloud SIEM on-demand charges atop a $600/month commitment. These incidents illustrate how custom metric cardinality and on-demand product usage can produce cost surprises. That cost structure is the main reason teams evaluate alternatives.

Datadog vs. alternatives

Datadog’s competitors differ on collection model, pricing model, and breadth. Figures below come from each vendor’s official pricing page:

Each carries a distinct trade-off. New Relic’s per-seat pricing restricts who gets access; Grafana Cloud meters active series, so higher cardinality raises the bill; and Prometheus is metrics-only with local storage that is, per its own docs, “not arbitrarily scalable or durable in the face of drive or node outages,” so scaling means assembling Thanos, Mimir, or VictoriaMetrics yourself.

groundcover takes a different architectural position on all three dimensions. The Flora eBPF sensor deploys as a single Kubernetes DaemonSet, one pod per node, and captures metrics and traces, logs, Kubernetes events, and HTTP requests directly from the Linux kernel. No SDKs. No per-service agents. No instrumentation sprint. Full-cluster visibility arrives within hours of deployment, and OpenTelemetry data coexists with Flora-captured signals in the same interface.

Two more structural differences follow from that design. Where Datadog restricts eBPF to scoped products, Flora uses kernel-level capture across its telemetry collection. Where Datadog stores every signal except BYOC logs in its own cloud, groundcover defaults to BYOC (Bring Your Own Cloud), where your data plane runs in your own cloud account.

ClickHouse stores logs and traces. It also stores Kubernetes events, while VictoriaMetrics stores metrics. groundcover manages only the control plane for UI and orchestration.

Pricing is flat per node, $30/host/month on Pro and $35 on Pro+/Enterprise, with no per-GB and per-seat charges or per-metric charges. Data volume does not change groundcover’s per-node vendor price, although customer-owned storage and compute costs can still scale with retained telemetry. The unit economics show up in a documented customer outcome: BigBasket reported a 50% observability cost reduction while expanding coverage across production, development, and testing environments. That result follows from the same mechanism: the vendor meters nodes rather than bytes, while customer-owned storage and compute costs can still scale with retained telemetry.

If you want to validate the architecture on your own cluster, the free plan includes BYOC and requires no credit card. Deploy Flora on one cluster and evaluate full-cluster visibility within hours.

FAQ

These answers summarize Datadog’s collection model and product scope, integrations, security coverage, and main cost drivers.

How does the Datadog Agent collect data?

A per-host Agent process runs integration checks on a 15-second interval, accepts custom metrics through DogStatsD, and forwards everything to Datadog’s SaaS backend over outbound TLS on port 443. Traces require installing a language-specific SDK in each service, and eBPF collection applies only to Universal Service Monitoring and Network Monitoring, plus Cloud Security.

What are Datadog’s core products?

The catalog spans infrastructure monitoring and APM, log management, RUM and synthetics, security capabilities including CSPM and Cloud SIEM as well as workload protection, software delivery, AIOps via Watchdog, and AI observability through the Bits AI agent family and Agent Observability.

What are common Datadog use cases?

Teams adopt it for cross-signal incident troubleshooting and anomaly-based alerting, long-horizon capacity planning, compliance posture monitoring, and consolidating separate metrics, logging, and tracing tools into one vendor.

What security and compliance support does Datadog offer?

Cloud Security Management checks cloud configuration against benchmarks spanning SOC 2 and HIPAA, PCI DSS, NIST, and CIS, while Cloud SIEM handles threat detection and a scanner redacts sensitive data in flight. As a vendor, Datadog holds SOC 2 Type 2 and ISO/IEC 27001 certifications, plus FedRAMP High certification for its US1-FED site.

Which clouds does Datadog integrate with?

AWS and Azure, plus GCP, are the primary targets, with additional coverage for Alibaba Cloud and Oracle Cloud Infrastructure as well as IBM Cloud, plus serverless runtimes including AWS Lambda and Google Cloud Run. The total integration count passed 1,000 in late 2025.

Why is Datadog considered expensive?

Every product bills on its own usage meter, and usage scales with workload activity, so costs are hard to predict and compound quickly. Documented incidents range from a $6,500 Cloud SIEM surprise to a bill reported at roughly $65 million per year, with custom metric cardinality and on-demand product usage among the documented triggers. Flat per-node models such as groundcover’s remove data volume from vendor pricing, although customer-owned storage and compute costs can still scale with retained telemetry.