Datadog Pricing: Estimate Your Bill From AWS Before You Sign

The Datadog quote arrives as a table. One row per product, a committed quantity, a contract price and, in a narrower column most people skip, an on-demand price. The quantities were chosen on a sales call, from numbers somebody guessed. A year later the invoice is double the quote and the explanation is "usage".

Datadog pricing is not complicated. It is easy to sign without having measured anything. The two numbers that decide the bill are the commitment and the rate for whatever runs over it, and both can be worked out before signing, from data your AWS account already holds.

Our position: build the estimate from EC2 and CloudWatch before the second sales call, commit below what you measured rather than above it, and put a hard stop on the one line that can run away. The sales calculator will not do this for you; it asks you for the numbers.

What is a Datadog quote actually made of?

A commitment per product for a term, and a higher rate for usage above it. Datadog's billing documentation says the Subscription Details section of your account "includes the quantity, contract price, and on-demand price for all committed products", and that the billing cycle "begins the first of the month (UTC) regardless of when you sign up". Those three columns are the contract.

Each product is measured differently; the pricing definitions page says how. Hosts are counted every hour and billed on "the maximum count (high-water mark) of the lower 99 percent of usage for those hours", the ninth-busiest hour from the post on cutting an existing Datadog bill. Custom metrics are "the monthly average of unique custom metrics submitted" per hour. Logs are two totals: gigabytes ingested and events indexed. A peak, an average and two totals, and the quote asks you to commit to each.

What does on-demand cost compared with the commitment?

It depends on the row. At list prices an Infrastructure Pro host is $15 a month "billed annually or $18 on-demand": 20 percent more. Standard log indexing at 15 days is $1.70 per million events on an annual plan and $2.55 otherwise, and the log billing page says it plainly: "on demand usage is charged with a 50% premium".

That asymmetry is the point. Ten hosts over your commitment cost $30 a month. A hundred million indexed events over it cost $85. Hosts are forgiving; the log index is not, and it is also the line that moves fastest when somebody turns on debug logging on a Friday.

Which hosts will Datadog count that you did not plan for?

The ones the AWS integration finds. The AWS integration billing page is direct: "Datadog bills for AWS hosts running the Datadog Agent and all EC2 instances picked up by the Datadog-AWS integration." You are not billed twice for an instance that has both, but every running instance the integration can see is billed, agent or no agent. The bastion, the Jenkins box, the dev instances nobody has stopped since March: all hosts, from the day the integration is connected.

The control is a tag filter on the Metric Collection tab of the integration tile. The docs give !datadog:no as an exclusion and datadog:monitored,env:production as an allowlist; use the allowlist, because a new instance then costs nothing until someone tags it on purpose. RDS, ELB and DynamoDB "are not part of monthly infrastructure billing", so leave those on.

Kubernetes is the other surprise. The pricing page defines a host as "a server, VM, or node (in the case of Kubernetes)", so every node is a host with 5 containers included on Pro. Twelve nodes running 300 pods is 240 containers over, at "$0.002 per container per hour". Small per container. Not small per cluster.

What comes free with a host, and what does not?

Datadog calls it an allotment, and the product allotments page is the reference. A Pro host carries 5 containers and 100 custom metrics; an APM host carries 150 GB of ingested spans and 1 million indexed spans a month; the allotments pool across the account. Whether the pool helps you depends on the metering option, and "organizations can opt for a monthly or hourly on-demand option". Monthly metering computes the overage once, at month end. Hourly metering computes it each hour, with "the monthly allotment annualized and then divided by the number of hours in a year", so a 2am spike of containers is over the allotment for those hours whatever the month's average is. Ask which one is on your order form; the quote will not say. Ask, too, for the custom metrics overage rate, which the custom metrics billing page gives only as "an amount that is specified in your current contract" per 100. If it is not on the quote, it is not in your estimate.

How do you estimate Datadog pricing from your AWS account?

Two commands, in every region you use. The first counts running instances; run it at your busiest hour, or read the autoscaling maximum instead, because the bill is set by the peak. The second sums CloudWatch's IncomingBytes and IncomingLogEvents over the last 30 days, the uncompressed bytes and the event count. Ingestion is priced on gigabytes and indexing on events, so you need both.

REGION=ap-south-1
START=$(date -u -d '30 days ago' +%Y-%m-%dT%H:%M:%SZ)
END=$(date -u +%Y-%m-%dT%H:%M:%SZ)

aws ec2 describe-instances --region "$REGION" \
  --filters Name=instance-state-name,Values=running \
  --query 'length(Reservations[].Instances[])' --output text

for m in IncomingBytes IncomingLogEvents; do
  aws cloudwatch get-metric-statistics --region "$REGION" \
    --namespace AWS/Logs --metric-name "$m" \
    --start-time "$START" --end-time "$END" \
    --period 86400 --statistics Sum \
    --query 'sum(Datapoints[].Sum)' --output text
done

Now the arithmetic, at list prices on an annual plan, for a shape we see often: 40 hosts at the ninth-busiest hour, 20 of them running traced services, a 12-node cluster with 300 pods inside that 40, and 60 GB of logs a day of which a fifth is worth indexing for 15 days.

• Infrastructure Pro: 40 hosts at $15, $600.
• APM: 20 hosts at $31, $620.
• Containers: 300 pods less 200 allotted, 100 over, at $0.002 an hour for 730 hours, $146.
• Log ingestion: 1,800 GB at $0.10, $180.
• Log indexing: 1,800 GB at roughly a kilobyte an event is 1.8 billion events; a fifth is 360 million, at $1.70, $612.
• Custom metrics: 4,000 allotted; assume inside it, $0.

That is $2,158 a month, about $25,900 a year, before anyone negotiates. The same usage with hosts and index at the higher rate is $720 and $918, or $426 a month more: about a fifth of the bill, not the bill. One caveat: the agent tails files, not CloudWatch, so the log figure is an order of magnitude, not the number to commit to.

Should you commit high or low?

Low. Over-commit by ten hosts and you pay $150 a month for nothing. Under-commit by ten and you pay $30 more. Over-commit by 100 million indexed events and $170 is gone; under-commit by the same and it costs $85. In every row the unused commitment costs more than the overage on the same quantity, so commit at the floor you are certain of, the quietest of the last three months, and pay for the peaks at the higher rate.

The one thing that breaks this is the log index, because overage there has no ceiling of its own. So the index gets a daily quota, which stops indexing at the limit while logs still flow to the archive; the Terraform for it is in the first post. With the quota in place the worst month is the quota times $2.55, and you can write that number down before signing.

What we cannot see is your discount. Sales will offer a lower contract price for a larger commitment, and at some size that beats this arithmetic. Run both columns with the price on your quote.

What changes when the account is regulated?

The log rows get smaller, not larger. CERT-In's 2022 directions, paragraph (iv), require logs to be kept "for a rolling period of 180 days" and "within the Indian jurisdiction". Datadog has no Indian site, so a 180-day index satisfies neither the residency half nor your budget. The compliance copy belongs in an S3 bucket in ap-south-1, filled by a log archive, and the Datadog index covers only the days on-call actually searches. Whether payment data may transit Datadog's site on the way to that bucket is the analysis in the data localisation post; for card and account data the answer is usually to strip it before the agent sees it.

When is on-demand the honest answer?

For the first quarter, if you have no history. Three months on the monthly plan costs 20 percent on hosts and 50 percent on the index, and buys the usage graphs to commit against. It is also the answer for a team of three with no platform engineer yet, and for an account under ten hosts, where the honest question is whether CloudWatch alone would do.

And sometimes the commitment should be high. A payments team whose fraud analysts search 30 days of everything, every month, should commit to that and take the discount. The test is whether someone can say what each row is for.

The short version

Read the quote as three columns: quantity, contract price, on-demand price. Run the two commands in every region and turn the output into hosts, gigabytes and events at the price on your quote. Commit at the floor of the last three months and put a daily quota on the index before the contract starts. Put an allowlist tag filter on the AWS integration. Ask which metering option you are on and what the custom metrics rate is. Then sign, and put the estimated-usage metrics on a dashboard on day one, so the first invoice is not the first time anyone looks.

If the quote in front of you has quantities nobody can trace to a command, that is the finding. Send it back with the sheet.

This is engineering guidance, not legal advice. Regulations and their annexures are amended over time; read the current text and take your compliance position from counsel.