Observability Cost
Why Your Datadog Bill Will Double Next Year — And How to Stop It
The three pricing mechanisms that make Datadog spend grow faster than engineering headcount — and the policy changes that stop them without a migration.
For engineering leaders with $200K+ observability spend
Your Datadog bill scales
Your Datadog bill scales
with hosts.
Not with value.
SAB Consulting helps CTOs and VP Engineering reduce Datadog, Elastic, and Splunk spend by 40–60% — without losing the production visibility their teams depend on.
Observability cost outcomes
Reduce telemetry spend
Datadog, Elastic, OpenSearch, Splunk — logs, metrics, traces, and retention waste
Keep production visibility
No signal loss during cost reduction. No big-bang cutovers.
One consulting philosophy
Cost reduction starts with understanding what telemetry is actually used during incidents — and what is habit. Technology decisions come after.
Elastic Certified Engineer · LVMH · TotalEnergies · Safran · Hitachi
Production observability at enterprise scale, across luxury, energy, aerospace, and manufacturing.
40–60%
Average observability cost reduction across migration engagements
€75K+
Minimum annualized savings guaranteed before audit fee is kept
8–16 wks
Typical migration timeline using parallel-run methodology
The problem
Observability spend grows silently until it becomes a platform-level business problem.
Teams keep too much low-value telemetry. Retention policies are rarely reviewed. Logs, metrics, and traces grow faster than business value. Engineers still miss the right signals during incidents because volume is not the same as visibility.
Common patterns
Platform teams inherit the bill
Application teams create telemetry volume, but platform or cloud teams are left explaining the spend to finance.
Dashboards multiply, signal does not
More dashboards and alerts do not guarantee better incident response or faster decision-making.
Vendor pricing becomes the architecture
Datadog, Elastic, and Splunk costs shape engineering behavior when ownership and policy are unclear.
The engagement
A structured path from cost audit to production migration — with no big-bang risk.
Every engagement starts with a fixed-fee observability audit. No architecture change happens before the cost driver analysis is complete. The audit fee is refunded if identified savings fall below €75K annualized.
Phase 01 — Observability Audit
Find where the money is going — and what can change safely.
A 3–4 week deep review of telemetry volume, retention policy, indexing strategy, agent deployment, cost allocation, and vendor contract leverage. The output is an executive-ready decision pack with a 30/60/90-day implementation roadmap.
View offer details →Phase 02 — Migration & Architecture
Move to a lower-cost stack without operational risk.
Fixed-price migration from Datadog, Elastic, or Splunk to a self-managed OpenSearch or hybrid stack. Uses a parallel-run methodology: new stack ingests production data alongside the existing one for 4–6 weeks before any cutover decision.
View offer details →What the audit covers
Telemetry volume
Where logs, metrics, and traces grow faster than production usefulness.
Retention policy
Which data deserves long retention, short retention, or no retention.
Indexing strategy
How indexing choices affect cost, search speed, storage, and incident response.
Dashboards & alerts
Which dashboards support action, and which create noise.
Cost allocation
How to show teams the full cost of the telemetry they generate.
Vendor lock-in
Where Datadog, Elastic, Splunk, or cloud-native costs limit negotiating leverage.
Team ownership
Who owns volume, retention, signal quality, and cleanup decisions.
Optimization paths
Where to optimize, migrate, renegotiate, or change policy first.
Why SAB Consulting
A senior advisor for observability systems — not another implementation shop.
The work starts with the business constraint: rising observability spend, poor cost ownership, and platforms that grow faster than the value they create. Technology decisions come after the problem is understood.
Understands both the engineering and the economics of observability at scale.
Connects executive trade-offs with production engineering constraints.
Brings evidence from environments where cost, security, and reliability all matter.
Enterprise
Experience across global organizations where observability quality directly affects operations and financial reporting.
Production
Systems that must operate under access, reliability, scalability, and hard cost constraints — not just demo environments.
Insights
Executive analysis for
observability economics.
Migration
Datadog vs OpenSearch: Real TCO Comparison for a 50-Engineer Team
A side-by-side total cost of ownership analysis — infrastructure, operational overhead, and engineering time — across a 12-month production migration window.
Observability FinOps
What Is Metric Cardinality Bloat — and Why It Explains Your Datadog Invoice
Cardinality bloat is the single largest driver of unexpected Datadog cost growth. This is how it compounds, and how to measure it in your own environment.
Architecture
OpenSearch Is Not a Degraded Elasticsearch — Here Is Why I Use It in Production
After running OpenSearch at LVMH-scale across 12TB/day of telemetry, this is a direct comparison across performance, feature parity, and operational cost.
Observability FinOps
Why Platform Teams Inherit an Observability Bill They Didn't Create
The organizational pattern that splits cost ownership from cost generation — and how to fix it without a platform rewrite.
Migration
How to Run a Parallel-Run Migration from Datadog to OpenSearch
The methodology that eliminates big-bang cutover risk: running both stacks in production simultaneously until the team has operational confidence in the new one.
Questions
Frequently asked questions
How much can a company reduce its Datadog bill by switching to OpenSearch?
+
Based on production migrations at enterprise scale, companies typically reduce observability spend by 40–60% when migrating from Datadog to a self-hosted OpenSearch stack. The exact savings depend on current metric cardinality, log volume, agent deployment density, and retention policies. The upfront audit quantifies the savings before any architecture change is committed.
What are the main reasons Datadog costs keep increasing?
+
Datadog pricing scales with three variables: host count (agent deployments), custom metric volume, and log ingestion and retention. In most engineering organizations, all three grow silently as teams add services without a defined telemetry ownership model. Metric cardinality bloat, agent over-deployment, and unconfigured retention policies are the three most common cost drivers — and none of them require a migration to partially fix.
Is the audit fee refunded if the savings target is not reached?
+
Yes. The audit fee is fully refunded if the identified annualized savings fall below €75K. This structure aligns the engagement with the client outcome rather than billing hours. If the audit does not identify a credible savings path, the client owes nothing. If it does, the fee is retained and applied against the total engagement cost.
How long does a Datadog to OpenSearch migration take?
+
A production migration typically takes 8–16 weeks depending on cluster size, data volume, and team structure. The migration uses a parallel-run methodology: OpenSearch ingests production data alongside Datadog for 4–6 weeks before any cutover decision is made. Rollback criteria are defined before any infrastructure change begins.
Who is this engagement designed for?
+
SAB Consulting works with CTOs, VP Engineering, Heads of Platform, and SRE leads at companies spending $200K+ per year on observability tooling. The typical trigger is a Datadog renewal with a 30%+ year-over-year price increase, a CFO mandate to audit infrastructure spend, or a platform team that cannot explain the monitoring bill to leadership.
Start here
Ready to understand where your observability spend is going?
The discovery call is 30 minutes. Bring your Datadog invoice. Leave with a clear read on whether the audit makes sense for your situation.
Book a Discovery Call →CTO · VP Engineering · Head of Platform · SRE Manager · FinOps Lead