Costs and pricing

How the money moves

The customer pays almost everyone, mostly by volume. The app teams who decide what to log rarely see the bill; the platform team owns it.

Enterprise contracts are discounted from list, often a lot, and nobody publishes by how much. Overage is the opposite: above the commitment, Datadog's on-demand rates run 20-50% higher than its annual rates.

Gartner's research, as summarized by others, puts its median client's spend with a single observability vendor above $800,000 a year. At the top end, OpenAI was reported in 2025 to spend about $170 million a year on Datadog.

The vendors' growth model is the customer's bill seen from the other side. Datadog, Dynatrace and Elastic report net retention between about 110% and the low 120s, meaning existing customers spend that much more each year, and in Grafana's 2026 survey most respondents expecting higher spend blamed broader adoption more than price rises.

How companies of different sizes use it

Nobody publishes observability spend by company size, so the spend figures here are my rough estimates from vendors' filings, startup programs and one procurement broker's data. Scale-up is a stage more than a size, and the ladder fits a software company growing up; a regional insurer usually enters at mid-market with an IT-monitoring vendor and skips the startup stack.

A startup (under 50 people, up to Series A) runs a handful of hosts or containers, often serverless, on one cloud. It lives on free tiers and credits: Datadog and Grafana Labs each offer startups up to $100,000 of credit for a year, New Relic has its own program, and cloud credits pay for the cloud's built-in monitoring. Add an error tracker such as Sentry and a free paging tier from PagerDuty or incident.io. The founders or the CTO own it, and my rough estimate of cash spend runs from nothing to $50,000 a year. It moves on when the credits run out, when free-tier caps on hosts, retention and users bite, or when a big customer asks for SOC 2 evidence and an uptime commitment.

A scale-up (roughly 50 to 500 people, Series B to pre-IPO) runs tens to hundreds of hosts or Kubernetes nodes, mostly on one cloud; the dispatch company sits at the top of this band. It usually settles on one SaaS platform such as Datadog, Grafana Cloud or New Relic, bought self-serve and later on an annual commitment, plus Prometheus for Kubernetes metrics and a paid incident tool. The owner is the company's earliest SRE hire or a small platform team, and the app teams rarely see the bill. My rough estimate is $150,000 to $2 million a year; the low end matches the median Datadog contract in one procurement broker's data. The bill is what pushes it on, as tags and chatty logs outgrow traffic (more on that just below) and the annual commitment brings overage at on-demand rates.

A mid-market company (roughly $50 million to $1 billion of revenue) is often not a software company. Picture a manufacturer running hundreds of hosts across a cloud and its own data centers, with packaged apps next to custom code and several monitoring tools picked up along the way: an application-monitoring vendor such as Dynatrace or Datadog, the cloud's own monitoring, some open source. IT operations owns them, procurement starts reading the contract, and the goal is fewer tools. My rough estimate is $100,000 to $1.5 million a year across vendors. Cloud commitments start to matter here. A company that has promised AWS, Microsoft or Google a set amount of spend over a few years, in exchange for a discount, can count the cloud's own tools and many marketplace purchases toward it, which is why teams pick CloudWatch even though Gartner's clients complain about its cost. Consolidation, compliance audits and an acquisition that brings another stack push it on.

An enterprise (over $1 billion of revenue) runs thousands to tens of thousands of hosts across several clouds and its own data centers. It standardizes on one or two platforms (Dynatrace, Datadog, Splunk, New Relic or Elastic), keeps Prometheus and Grafana inside Kubernetes, adds a pipeline such as Cribl and runs a SIEM on many of the same logs. A central observability team owns it, with FinOps charging costs back to teams and the CISO increasingly sharing the log pipeline. My rough estimate is $1 million to $10 million a year across vendors. Commitments shape the buying. Contracts go multi-year, often as a minimum annual spend across a vendor's whole platform, which is how Dynatrace sells, and they're bought through the cloud's marketplace so the same dollars retire the cloud commitment. A vendor missing from the right marketplace competes against money that's effectively already spent. Next come consolidation programs, a pipeline to control log cost, and at the largest scale building its own; Dynatrace's CEO has called do-it-yourself its biggest competitor.

A Fortune 500 company (the largest US companies by revenue) runs tens of thousands of hosts or more across clouds and data centers, often with a different platform in each business unit. Datadog says its median Fortune 500 customer pays it under $500,000 a year, so even the biggest buyers spread their spend. A central platform organization runs it, alongside procurement, the CISO and the finance team that holds the cloud commitments. Microsoft and Google say eligible marketplace purchases count in full toward a commitment; AWS hasn't published its rule, and the caps quoted secondhand vary, so I'd read the contract. My rough estimate is $5 million to $50 million or more a year. The largest tech companies build their own core: Airbnb reportedly cut its metrics cost by about an order of magnitude by moving to OpenTelemetry and open-source storage. For the rest, the next step is leverage: showing up at renewal with a credible alternative stack, as Coinbase did with Datadog.

What changes as a company grows (spend is my rough estimate):

Why the bill grew 47% when traffic grew 10%

Picture the dispatch company on Datadog, indexing about 15% of its logs and sending the rest to cheap storage it owns. At list prices that comes to about $66,000 a month; indexing everything instead would cost roughly three times as much for the same telemetry. Then traffic grows 10% in a quarter.

None of those drivers shows up on a traffic dashboard. A smaller company, at 200 hosts and 1.5 TB of logs a day, comes out at +39% on the same mechanics, so I'd tell a CFO "40-50%" and explain the four causes.

The fix is mostly in the pipeline and the tag allow-list: drop debug logs before ingest, index less, keep the customer tag ingested but unindexed, or move per-customer detail into traces. For the smaller company those moves bring the bill back to about 6% above baseline. The pipeline itself cost about 15% of the bill there. At index-heavy prices it pays for itself many times over if it cuts what gets indexed; cutting ingest alone barely covers its cost.

What the pipelines are worth

Cost control is a funded category, and it's being bought: Palo Alto, Dynatrace, CrowdStrike and SentinelOne all bought pipelines in 2025-2026 (see The main players). The platforms ship their own cost tools too, such as Grafana's Adaptive Metrics and Adaptive Logs, which Grafana says cut series by up to 80% and logs by up to 50%. Cribl's secondary-market value of about $3 billion in September 2026 sits below its 2024 round. The buyers seem to treat pipelines as a feature of a SIEM or a platform, and I'm not sure cost control survives as a standalone category.