Datadog

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Do not rebuild this — but do check the bill, because this is the subscription most likely to be several times what anybody expected.

**Correlated signals at scale** is the product: metrics, traces and logs from everything, on one page, retained for as long as you pay. That correlation is what shortens an incident from an hour to five minutes, and it is genuinely hard to reproduce.

FIRST, THE BILL
- Priced by host, by ingested gigabyte, by custom metric and by indexed span, and the last two are where the surprise lives
- One high-cardinality tag — a user id, a request id — on a metric creates a new time series per value, and the invoice reflects it. Audit your custom metrics for cardinality before anything else
- Sample traces rather than indexing everything, and set a retention per log source instead of one policy for all
- That audit often saves more than any migration would

WHEN TO KEEP PAYING
- More than a handful of services, where correlation across three signal types is what actually resolves incidents
- A team on call, where the time saved during an outage is worth more than the invoice

WHEN TO SELF-HOST
- A small number of services on a few machines. Then Prometheus, Loki and Grafana do the job for the cost of one modest box, and the shape of that stack is covered under Grafana Cloud elsewhere in this catalogue

WHAT TO DO WHATEVER YOU CHOOSE
- **Structured logs**: one JSON object per line with a level, a timestamp, a service and a request id. A log line that is a sentence cannot be queried, and this is the biggest single lever on usefulness
- **A request id threaded through everything**, so one identifier joins a log line to a trace to a metric. That thread is the correlation, and it is yours regardless of vendor
- **Labels are dimensions, not identifiers.** Never a user id, an email or a full parameterised path. This is the rule that decides both your bill and whether a self-hosted stack survives
- Alert on symptoms with an action attached, and delete any alert nobody acts on
- Secrets and personal data redacted at the point of logging, by key and by pattern. A log store is where data leaks to and stays

AND THE RULE THAT OUTRANKS THE TOOL
Whatever watches your infrastructure must not run on it. Put it elsewhere, and keep one external check that tells you the whole thing is unreachable.

THE ONE-LINE VERSION
Audit cardinality and retention before deciding anything. Half the people who think they need to leave just need to stop paying for a tag.