Log Management
Datadog Log Management is a cloud-based observability service that ingests, analyzes, and archives log data from applications, infrastructure, and security events.
Publisher review
Datadog Log Management is a cloud-based observability service that ingests, analyzes, and archives log data from applications, infrastructure, and security events. It is designed for DevOps, SRE, and security teams who need a unified platform to correlate logs with metrics, traces, and real-user data. Founded in 2010 and headquartered in New York, Datadog targets organizations that already use its APM or Infrastructure Monitoring and want to centralize log analysis without managing their own Elasticsearch cluster. The service is particularly suited for teams that value integrated SIEM and automated root-cause analysis over a standalone log search tool.
The platform uses a proprietary agent that requires explicit configuration to collect logs — unlike Elastic Stack, which auto-ingests application logs without separate setup. Once configured, Datadog ingests logs at a rate of $0.10 per indexed GB and $1.27 per million ingested events. It supports real-time streaming, faceted search, and log rehydration from archived cold storage for audits or historical analysis. Key capabilities include error grouping that clusters similar errors into a single issue, automated alerting via error tracking monitors, and correlation of logs with APM traces and infrastructure metrics. The service also includes Cloud SIEM with user and entity behavior analytics (UEBA), integration with third-party EDR tools, and synthetic monitoring for API tests.
Datadog competes directly with Splunk and Elastic (ELK Stack). It has been named a Leader in the Gartner Magic Quadrant for SIEM for ten consecutive years and ranked first in every use case in the Gartner Critical Capabilities for SIEM report. Unlike Splunk, which requires significant customization for machine learning features, Datadog offers built-in AIOps and automated anomaly detection. Compared to Elastic, Datadog provides more detailed error monitoring with grouping and tracking monitors, but lacks Elastic's open-source version and native OpenTelemetry support. Its unified view of synthetics for API tests and APM for code traces is a differentiator, but the Elastic Stack offers stronger search capabilities via KQL syntax.
The honest trade-offs: Datadog's billing model is complex and can cause costs to explode if custom metrics and log indexing are not carefully managed. The agent does not collect logs by default, requiring extra setup steps that Elastic users may find cumbersome. Scaling the platform across large, multi-cloud environments is non-trivial and often demands dedicated administrative overhead. Finally, while the 14-day free trial is generous, the per-GB indexing cost can quickly surpass a flat-rate alternative like Splunk for high-volume log shippers.
How it works
-
APM Integration
Correlates log events with application traces and code-level performance data for end-to-end troubleshooting.
-
Infrastructure Monitoring
Ingests logs from hosts, containers, and cloud services alongside CPU, memory, and network metrics.
-
Synthetic Monitoring
Runs automated API and browser tests, linking synthetic check failures to underlying log entries.
-
Real User Monitoring
Captures browser and mobile session logs, enabling correlation of user experience with backend errors.
-
Search Capabilities
Provides faceted search and filtering, but lacks the KQL syntax and full-text search depth of Elastic Stack.
-
Application Security
Detects threats in log data using built-in rules and integrates with third-party EDR tools for incident response.
-
Cloud SIEM
Delivers automated threat detection, UEBA, and compliance monitoring with a ten-year Gartner SIEM Leader track record.
Strengths and trade-offs
Strengths
- Unified view of synthetics for API tests and APM for code traces allows teams to correlate synthetic check failures with application errors in a single dashboard.
- Advanced, automated SIEM with user and entity behavior analytics (UEBA) reduces manual threat hunting effort compared to Splunk's more customizable but labor-intensive approach.
- Error grouping and error tracking monitors automatically cluster similar errors into one issue and trigger alerts when a problem starts, reducing noise by up to 90% in high-volume environments.
- Ten-year Leader in Gartner Magic Quadrant for SIEM and ranked first in every use case in the Gartner Critical Capabilities for SIEM report, validated by independent analyst evaluations.
Trade-offs
- Billing model is complex, with separate charges for indexed logs ($0.10/GB), ingested events ($1.27/million), and custom metrics, making total cost difficult to predict.
- Cost can explode if custom metrics and log indexing are not carefully managed, as each indexed GB and event carries a per-unit fee that scales linearly with volume.
- Agent does not collect logs by default and requires separate setup, unlike Elastic Stack which automatically ingests application logs without additional configuration.
- Scaling across large, multi-cloud environments is complex and often requires dedicated administrative overhead to manage agent deployment, retention policies, and index management.
Pricing context
Log Management: $0.10 per indexed GB and $1.27 per million ingested events. Infrastructure Monitoring: $15/host/month (annual) or $18/month (monthly). APM: $31/host/month (annual) or $36/month. Security Monitoring: starts at $10/host/month (Pro, annual) or $25/host/month (Enterprise, annual). 14-day free trial available.
Getting started with Log Management
-
Sign up for Datadog
Go to the Datadog website and start a 14-day free trial. Provide your email address and create an account. Verify your email to activate the account and access the Datadog dashboard.
-
Install the Datadog Agent
Download and install the Datadog Agent on your hosts, containers, or cloud services. Follow the platform-specific instructions in the Datadog documentation to complete the installation.
-
Enable log collection
Edit the Agent configuration file to enable log collection. Set `logs_enabled: true` in the `datadog.yaml` file. Then, create a log configuration file specifying the log sources and paths to collect.
-
Search and filter logs
Navigate to the Logs section in the Datadog dashboard. Use the search bar to query logs with faceted filters. Apply time range and attribute filters to narrow down results for troubleshooting.
-
Set up an error tracking monitor
Go to Monitors and create a new Error Tracking monitor. Define the error pattern and alert conditions. Configure notification channels like email or Slack to receive alerts when error thresholds are exceeded.
Frequently Asked Questions
What is Datadog Log Management and how does it work?
Datadog Log Management is a cloud-based service that ingests, analyzes, and archives log data from applications, infrastructure, and security events. It uses a proprietary agent requiring explicit configuration to collect logs, then enables real-time streaming, faceted search, and correlation with metrics and traces.
How much does Datadog Log Management cost?
Datadog Log Management costs $0.10 per indexed GB and $1.27 per million ingested events. Additional charges apply for Infrastructure Monitoring at $15/host/month and APM at $31/host/month. A 14-day free trial is available, but costs can escalate if log indexing is not carefully managed.
How does Datadog Log Management compare to Splunk and Elastic Stack?
Datadog offers built-in AIOps and automated anomaly detection, unlike Splunk which requires customization for machine learning. It provides more detailed error monitoring than Elastic but lacks Elastic's open-source version and native OpenTelemetry support. Datadog's billing is complex, while Splunk offers flat-rate pricing for high volumes.
What is Datadog Cloud SIEM and what features does it include?
Datadog Cloud SIEM provides automated threat detection, user and entity behavior analytics (UEBA), and compliance monitoring. It integrates with third-party EDR tools and has been named a Leader in the Gartner Magic Quadrant for SIEM for ten consecutive years, reducing manual threat hunting effort.
How do you set up log collection with the Datadog agent?
The Datadog agent does not collect logs by default and requires explicit configuration. You must enable log collection in the agent's configuration file and specify log sources. This extra setup step contrasts with Elastic Stack, which auto-ingests application logs without separate configuration.
What are the main strengths and weaknesses of Datadog Log Management?
Strengths include unified APM and synthetic monitoring integration, automated error grouping that reduces noise by up to 90%, and a ten-year Gartner SIEM Leader record. Weaknesses are complex billing that can cause cost explosions, agent setup requirements, and scaling challenges across multi-cloud environments.
Alternatives
How Log Management compares
Direct head-to-head against 3 competitors. Picked by 7wData.
Log Management
- Pricing
- Log Management: $0.10 per indexed GB and $1.27 per million ingested events. Infrastructure Monitoring: $15/host/month (annual) or $18/month (monthly). APM: $31/host/month (annual) or $36/month. Security Monitoring: starts at $10/host/month (Pro, annual) or $25/host/month (Enterprise, annual). 14-day free trial available.
- Target
- Datadog Log Management is a cloud-based observability service that ingests, analyzes, and archives log data from applications, infrastructure, and security events.
- Strength
- Unified view of synthetics for API tests and APM for code traces allows teams to correlate synthetic check failures with application errors in a single dashboard.
- Watch for
- Billing model is complex, with separate charges for indexed logs ($0.10/GB), ingested events ($1.27/million), and custom metrics, making total cost difficult to predict.
Datadog
- Pricing
- Usage-based; free trial available. Log management starts at $0.10/GB ingested.
- Target
- Cloud-native teams needing unified observability across logs, metrics, and traces.
- Deployment
- SaaS
- Strength
- Unified observability platform with deep APM and infrastructure monitoring integrations.
- Watch for
- Costs can escalate unpredictably with high log volumes; complex pricing model.
Splunk
- Pricing
- Quote-based; free trial and limited free tier available. Licensed per GB ingested.
- Target
- Regulated enterprises requiring heavy log analytics, security, and compliance features.
- Deployment
- SaaS, on-premises, hybrid
- Strength
- Mature search language and rich app ecosystem for security and observability.
- Watch for
- High cost at scale; complex setup and steep learning curve for new users.
Grafana Loki
- Pricing
- Open source (free); Grafana Cloud paid plans start at $49/month for 50GB logs.
- Target
- Teams already using Grafana for metrics who want cost-effective log storage.
- Deployment
- Self-hosted, SaaS (Grafana Cloud)
- Strength
- Low-cost log storage designed to integrate natively with Grafana dashboards.
- Watch for
- Limited query capabilities vs. Elasticsearch; no built-in alerting in open-source version.
User reviews
No user reviews yet. Be the first to write one.
Sources
Reporting on this tool draws on these publicly available sources.