Field Guide
Observability: metrics, logs and traces
06
Market and trends
4 min read · Chapter 6 of 10
Who holds the power
Power in observability follows whoever controls the meter, the history and the pipeline.
- Platform vendors hold the meter and the unit definitions, years of history, dashboards and alert rules written in their query languages, multi-product bundles (58% of Datadog's customers used four or more products by mid-2026) and an agent on every host. Each makes a partial exit harder.
- Customers gain power through OpenTelemetry, a pipeline they control, an archive in their own bucket, PromQL-compatible backends and the renewal date. In Grafana's survey, 37% of OpenTelemetry adopters cite freedom to switch vendors. The power shows up mostly at renewal and mostly for large buyers who can afford to run two stacks.
- Cloud providers hold the default, the invoice and the commitment. Their tools are one click away, their charges count toward commitments customers already signed, and AWS gives DevOps Agent credits worth 30-100% of a customer's support spend, which specialists can't match.
- Security vendors hold the CISO's budget and the detection content, and they're buying pipelines to control what reaches any SIEM.
- OpenTelemetry's maintainers, many of them vendor employees, decide what attributes are called. A rename costs everyone downstream.
- Coding-agent vendors are a new channel. Whoever feeds production context into Claude, Copilot, Cursor or AWS's Kiro gets embedded in how code is written.
- Regulators hold little direct power. They set retention floors for some buyers and data rules for what's inside the logs.
Tailwinds and headwinds
These are the forces I'd expect anyone in observability to be watching as of October 2026, and each one helps some players and hurts others. A couple of them are the same force seen from two sides: AI companies are both the biggest new buyers and the biggest risk, and cheap storage and pushback on volume bills both pull down the price per gigabyte.
Tailwinds:
| What's changing | Who gains | Who loses |
|---|---|---|
| AI companies are the fastest-growing buyers, and their workloads produce far more telemetry; Datadog counts more than 750 of them as customers. | Datadog, Grafana Labs, Chronosphere (Palo Alto), ClickHouse | Vendors that miss the AI customers, such as Splunk (Cisco), whose observability business is growing only in single digits |
| Buyers are cutting the number of tools and buying more products from one platform, and one in eight Datadog customers now uses ten or more of its products. | Datadog, Dynatrace, Grafana Labs, Palo Alto | Single-product tools such as PagerDuty, slower incumbents, mid-size independents that become acquisition targets |
| Security teams now pay for the same telemetry, and security vendors have bought three telemetry pipelines since 2025. | Palo Alto, CrowdStrike, SentinelOne, Cribl, AWS | Observability-only vendors with no security story, such as Honeycomb, Dash0 and groundcover; Splunk's volume-priced SIEM |
| AI agents are becoming heavy users of telemetry, which makes rich, well-labelled data worth more and adds a metered AI line to the bill. | Datadog, Dynatrace, AWS, Microsoft | AI SRE startups that don't hold the data (Resolve AI, Traversal, Cleric) once platforms and clouds bundle their own agents |
| Columnar databases and object storage hold telemetry for a fraction of indexed SaaS prices, and ClickHouse's cloud revenue more than tripled in a year. | ClickHouse, Snowflake, AWS, Grafana Labs, large buyers | Per-gigabyte indexed log pricing (Datadog, Splunk, New Relic); pipelines whose pitch is savings, such as Cribl |
Headwinds:
| What's changing | Who gains | Who loses |
|---|---|---|
| The biggest AI customers are large enough to justify cheaper vendors or their own stack, and Datadog's largest customer is using less after renewing in 2026. | Chronosphere (Palo Alto), ClickHouse, open-source stacks, in-house platform teams | Datadog most; any vendor whose growth leans on a few AI customers |
| Buyers push back on volume bills, and in June 2026 Datadog launched a metrics option billed per metric name instead of per tag combination. | Pipelines (Cribl, Bindplane, Datadog Observability Pipelines); vendors pricing per gigabyte or event, such as Grafana Labs, Coralogix and Honeycomb; buyers | Incumbents' revenue per unit of data (Datadog, Splunk, New Relic) |
| Cloud providers are moving up the stack with unified data stores and SRE agents, and AWS offsets its DevOps Agent with credits worth up to the customer's whole support spend. | AWS, Microsoft, Google; buyers drawing down a commitment | Datadog and Dynatrace in single-cloud accounts; AI SRE startups; pipelines |
| Leaving a vendor is getting cheaper through OpenTelemetry, AI tools that help rebuild dashboards and alerts, and an EU ban on switching fees from January 2027. | Grafana Labs, Chronosphere, Dash0, ClickHouse, Coralogix; buyers at renewal | Incumbents' leverage at renewal (Datadog, Dynatrace, Splunk, New Relic) |
| AI agents that investigate on their own may shrink revenue priced per seat or per responder, and PagerDuty's net retention has slipped below 100%. | Usage-priced platforms, the clouds, AI investigation priced per run | PagerDuty and other incident tools, New Relic's per-user pricing |
If I could watch only one thing, it would be the price of indexed logs per gigabyte at renewals over the next year, because cheap storage, pushback on volume bills and cheaper switching all show up there first.