Why the Datadog bill changed in 2026
Datadog bills per host, per GB of ingested logs and per APM span. In 2026, renewals incorporated annual increases of 5 to 10% on each of these axes — and for teams that had enabled several modules (infrastructure, logs, APM, security), the cumulative effect produced effective increases of 30 to 50% from one renewal to the next, according to data published by several SaaS negotiation firms.
The most widely cited case is that of Gabriel Anhaia (dev.to, April 2026): a team whose Datadog bill crossed $50,000 annually, triggering the audit that led to the migration to Prometheus + Grafana + Loki. Net savings in software licences: 100%. Replacement cost: a VPS dedicated to the observability stack.
Datadog vs Prometheus / Grafana / Loki stack
| Criterion | Datadog | Self-hosted stack |
|---|---|---|
| Software cost | $15 to $150 / host / month depending on modules | $0 (open source licences) |
| Infrastructure cost | Included in billing | 99 DH/month / month (2 vCPU / 4 GB VPS) |
| Metrics | Datadog Agent | Prometheus + Node Exporter |
| Logs | Datadog Logs (per GB) | Loki + Promtail (local storage) |
| Dashboards | Integrated Datadog UI | Grafana (thousands of templates) |
| Alerts | Datadog Monitors | Alertmanager + Grafana Alerting |
| APM / traces | Datadog APM (native) | Tempo + OpenTelemetry (requires setup) |
| Log-metrics correlation | Automatic | Manual via Loki / Prometheus labels |
| Ops maintenance | None (managed SaaS) | Your responsibility (updates, storage) |
Replacement components
The stack covers the three pillars of observability: metrics (Prometheus), logs (Loki), and visualisation + alerts (Grafana + Alertmanager). For traces, Tempo completes the picture via OpenTelemetry — but that is a fourth component, covered in the dedicated article opentelemetry-grafana-tempo-vps.
Prometheus collects metrics by HTTP scraping: exporters expose /metrics endpoints, Prometheus polls them at regular intervals and stores the time series. Node Exporter replaces the Datadog agent for system metrics (CPU, RAM, disk, network). Loki stores logs with a minimal index (labels only, no full text) — that is what allows it to run on little RAM. Promtail collects log files and sends them to Loki, just as the Datadog Logs agent does. Grafana visualises both Prometheus metrics and Loki logs in the same dashboards, and drives alerts. Alertmanager receives alerts from Prometheus and routes them to your notification channels (email, Slack, PagerDuty).
Migration in 6 steps
Install Prometheus and Node Exporter
Start with system metrics: this is the most direct replacement for the Datadog agent. Deploy Prometheus and Node Exporter via Docker Compose. The article installer-prometheus-vps covers this step in detail. Verify that Prometheus is scraping Node Exporter before continuing: open http://your-ip:9090/targets and confirm the state is UP. Run both systems in parallel for at least one week before cutting Datadog — compare CPU and RAM values between the two sources to validate consistency.
Deploy Loki and Promtail
Loki receives logs, Promtail collects them from your server's log files. Add both services to your docker-compose.yml. Configure Promtail to point to your log files (/var/log/syslog, application logs). Verify ingestion in Grafana (Explorer section, Loki source) before disabling log collection in the Datadog agent. The article loki-grafana-logs-centralises-vps details the Promtail configuration and processing pipelines.
Configure Grafana
Grafana is the hub of the stack: it connects Prometheus (metrics) and Loki (logs) as data sources. Once both sources are added, import community dashboards from grafana.com/grafana/dashboards — the Node Exporter Full dashboard (ID 1860) is the reference for system metrics. Recreate in Grafana the Datadog dashboards your team consults daily: this is the longest step if your Datadog dashboards are numerous and specific.
Migrate alerts to Alertmanager
Export the list of your Datadog monitors (via the Datadog API or interface). Recreate critical alerts in Prometheus (PrometheusRule rules) or in Grafana Alerting. Alertmanager handles routing to your notification channels: configure receivers (email, Slack, PagerDuty) in alertmanager.yml. Composite alerts with multiple conditions and suppression windows are harder to port — allow extra time for complex cases.
Validate in parallel over two weeks
Do not cut Datadog until you have two weeks of data in your self-hosted stack. Compare key metrics between the two sources. Manually trigger a few test alerts in Alertmanager. Verify that Loki is correctly receiving production logs and that LogQL queries return what you expect. Identify Datadog monitors that do not yet have an equivalent in the new stack.
Cut Datadog and reclaim the bill
Once validation is complete, disable the Datadog agent on each host, then cancel Datadog modules in reverse order of criticality (start with accessory modules, finish with infrastructure). Keep historical Datadog data accessible for 30 days after cancellation (standard contractual delay) — export critical dashboards and reports before that deadline. Note the effective cut-off date for your accounting.
Prerequisites and VPS resources
The complete stack (Prometheus + Node Exporter + Loki + Promtail + Grafana + Alertmanager) runs on a 2 vCPU / 4 GB RAM VPS to monitor one to five hosts with 15 days of metrics retention. That is the minimum recommended configuration: below that, Prometheus starts paging under Grafana query load.
For longer retention (30 to 90 days) or high log volume (more than 10 GB per day), plan for 4 vCPU / 8 GB and an additional SSD storage volume. Loki compresses logs efficiently, but unfiltered production log volume can grow quickly.
Software required: Docker and Docker Compose (recent version), a reverse proxy (Nginx or Caddy) to expose Grafana over HTTPS, and a domain or subdomain for Grafana. Open only the HTTPS port to the outside — Prometheus, Loki and Alertmanager must not be publicly exposed.
Checklist before starting
- VPS with at least 2 vCPU / 4 GB RAM, with Docker and Docker Compose installed.
- Additional storage volume sized for the desired retention (minimum 15 GB for 30 days of metrics + moderate logs).
- Full list of active Datadog monitors, exported before any cut-off.
- List of Datadog dashboards used by the team, with reference screenshots.
- Notification channels (Slack webhook, email addresses, PagerDuty key) available for configuring Alertmanager.
- Write access to application log files on each monitored host (for Promtail).
- Two-week migration window planned with the team — the self-hosted stack runs in parallel with Datadog during this period.
What the self-hosted stack does not do
Three trade-offs to accept before migrating.
No native APM correlation. Datadog automatically correlates a slow trace with the host metrics and associated logs. With the open source stack, this correlation is done manually via shared labels (trace ID in logs, same host label) — it is achievable, but requires configuration work. Tempo + OpenTelemetry cover APM, but add a fourth component to operate.
Maintenance is your responsibility. Updates to Prometheus, Loki and Grafana, storage management as Loki grows, alerts on the stack itself (who alerts you if Prometheus is down?). Budget two to four hours per month of routine operations for a stable stack.
Less integrated interface. Datadog is a single product with a unified UX. The open source stack is an assembly: Grafana for visualisation, Alertmanager for routing alerts, separate interfaces for each component. For a team used to Datadog, onboarding takes a few days.
Troubleshooting common issues
Prometheus is not scraping Node Exporter. Verify that the Docker network between the two containers is correct (same Docker Compose network) and that port 9100 is not blocked by ufw. Open http://node-exporter:9100/metrics from inside the Prometheus container to confirm accessibility.
Loki receives logs but Grafana shows nothing. Loki exploration in Grafana requires a minimum label filter — a {} query with no label returns a quota error. Use {job="varlogs"} as a starting point, then refine.
Grafana is slow on long time ranges. Prometheus stores time series in memory before writing to disk (--storage.tsdb.retention.time). On a 2 GB RAM VPS, limit retention to 15 days and reduce resolution on long-range queries with the step parameter in Grafana panels.
Alertmanager is not sending notifications. Prometheus alerts must reach the firing state before being routed to Alertmanager. Check the Alerts tab in the Prometheus UI (http://prometheus:9090/alerts) and confirm that alert rules are loaded (http://prometheus:9090/rules).
