How to choose

Which observability setup? Five questions

1. How much will you send? Estimate hosts, gigabytes of logs a day, metric series and spans, then price each against the vendor's units. The same telemetry on the same vendor can cost three times more depending on how much you index, so model the indexing share before the contract.
2. Who will run it? Self-hosted open source has no licence fee, but at 500 hosts it usually takes two to five platform engineers, who cost more than the software saves until you're very large.
3. How portable must you be? If you might switch vendors or run two, instrument with OpenTelemetry and keep a full copy of logs in storage you own. Dashboards, alert rules and query history won't move either way, so keep them as code.
4. Who else wants the data? If the security team needs the same logs for its SIEM, a pipeline that routes one stream to both is cheaper than two collectors.
5. Which rules apply? Card data, health data, US federal customers and EU residents each change retention, region and certification needs. Region is usually fixed when the account is created, so decide it first.

My defaults: for a B2B software company of a few hundred hosts, instrument new code with OpenTelemetry, use one commercial platform for breadth, and put a pipeline in front of it once logs pass about a terabyte a day. Index errors and the logs you search weekly; send the rest to cheap storage you own. Alert on SLO burn rates for user-facing services and review every page that wasn't actionable. And read the overage rates and the custom-metric definition before the headline price.