DEV Community

Cover image for Log Management Pricing in 2026: Four Rate Cards, One 500 GB Workload
Moksh Gupta
Moksh Gupta

Posted on Originally published at devtoollab.com

Log Management Pricing in 2026: Four Rate Cards, One 500 GB Workload

#devops #opensource #programming #webdev

Metrics roll up. Traces sample. Logs do neither, which is why they are the telemetry bill that keeps climbing in a quarter where nothing shipped. Add a service, add a retry storm, hire two more engineers who each want their own debug lines, and the invoice moves without traffic moving.

I priced 500 GB of monthly log ingest against four vendor rate cards as published on September 23, 2026. Cheapest was $43.50. Most expensive was $1,360.72. Same bytes.

Log management tools compared

This is the condensed version. The full breakdown on DevToolLab carries the per-vendor detail, including the three open source engines I only summarize here.

Where Teams Say They Actually Are

Grafana Labs ran its 4th Annual Observability Survey on March 18, 2026, with 1,363 responses from engineers, SREs and technology leaders in 76 countries.

The top concern for 2026 was not cost. Complexity and overhead took it at 38%, with signal-to-noise at 34% and cost third at 31%. SaaS is now at half of all respondents in some capacity, up from 43% the year before.

The number worth planning around is OpenTelemetry adoption for logs specifically: 48%, against 57% for metrics and 50% for traces. Broader context: 77% say open source or open standards matter to their strategy. An OTel collector sitting in front of your backend is what turns a backend swap into a config edit instead of a quarter of work.

The Arithmetic

You cannot compare these vendors on a per-GB number, because they do not meter the same object. Datadog bills ingestion by GB and indexing by million events, tiered on retention. Grafana Cloud splits one pipeline into three GB meters: Write, Process, Retain. Elastic and Better Stack separate ingestion from retained GB-months. A dollar figure per GB with no unit attached is marketing, not a price.

So here is one workload against four rate cards:

const GB = 500
const KB_PER_LINE = 1
const MEVENTS = (GB * 1024 ** 2) / KB_PER_LINE / 1e6   // 524.288M lines at 1 KB each

const plans = {
  'Datadog, standard 30d index': { ingest: GB * 0.10, index: MEVENTS * 2.50 },
  'Datadog, Flex Logs Starter':  { ingest: GB * 0.10, flex: MEVENTS * 0.60 },
  'Grafana Cloud Logs Pro':      { platform: 19, write: (GB - 50) * 0.400, process: (GB - 50) * 0.050 },
  'Elastic Serverless, Logs Essentials': { ingest: GB * 0.07, retain: GB * 0.017 },
}

const usd = (n) => '$' + n.toLocaleString('en-US', { minimumFractionDigits: 2, maximumFractionDigits: 2 })
const rows = Object.entries(plans).map(([name, meters]) => ({
  name,
  total: Object.values(meters).reduce((a, b) => a + b, 0),
  breakdown: Object.entries(meters).map(([k, v]) => `${k} ${usd(v)}`).join(' + '),
}))

for (const r of rows.sort((a, b) => a.total - b.total))
  console.log(usd(r.total).padStart(10), ' ', r.name.padEnd(36), r.breakdown)

const totals = rows.map((r) => r.total)
console.log(`\nspread: ${(Math.max(...totals) / Math.min(...totals)).toFixed(1)}x on ${MEVENTS}M log lines`)
Enter fullscreen mode Exit fullscreen mode

Output:

    $43.50   Elastic Serverless, Logs Essentials  ingest $35.00 + retain $8.50
   $221.50   Grafana Cloud Logs Pro               platform $19.00 + write $180.00 + process $22.50
   $364.57   Datadog, Flex Logs Starter           ingest $50.00 + flex $314.57
 $1,360.72   Datadog, standard 30d index          ingest $50.00 + index $1,310.72

spread: 31.3x on 524.288M log lines
Enter fullscreen mode Exit fullscreen mode

Read the Datadog row again. Ingesting 500 GB costs $50. Indexing it costs $1,310.72, which is 96% of the bill. Every conversation about a Datadog invoice is secretly a conversation about what you agreed not to index.

The assumption doing the most work here is 1 KB per line. If your logs are structured JSON averaging 2 KB, you have half as many events and roughly half that indexing charge. Measure yours before you trust anyone's model, including mine.

The Managed Three

Datadog is the reference price everyone else quotes against. Logging without Limits decouples ingestion from indexing on purpose, so sending everything and indexing a slice is the intended design rather than a workaround. Correlation is the actual product: logs next to APM traces and metrics in one pane, with Watchdog flagging error outliers unprompted. Flex Logs at $0.60 per million events against $2.50 for 30-day standard indexing is a real answer to archive-versus-search, and CloudPrem now covers keeping logs on your own infrastructure. The catch is predictability. Two meters in different units, index pricing that varies by retention tier, and regional ingest variation ($0.10 in the US, $0.12 in the EU) mean the bill moves when traffic shape changes, not just when volume does.

Datadog log management and Log Explorer with Watchdog Insights

Better Stack sells the inverse: bundled plans with one predictable number, aimed directly at Datadog invoices. The "30x cheaper than Datadog" line is plausible against standard indexing, though not verifiable like for like. Packaging is the real strength, since logs, traces, metrics, uptime monitoring and incident response come together, and the free tier is a tier rather than a trial. It does not scale down in a log-only shape: plans bundle three signals at equal volume, so 300 GB of logs and almost no metrics still pays for metrics.

Elastic Cloud Serverless took the cheapest slot because Logs Essentials prices ingestion and retention separately and low. Search is the reason to be here. This is the lineage that made full-text log search ordinary, and if debugging means arbitrary substring queries over unstructured output, nothing below beats it. Serverless also deletes the cluster-sizing exercise. Simplicity ends above Essentials, where Complete moves ingest to $0.09 and retention to $0.019 and adds separate metrics meters. One note: the $95/month entry price that circulates in third-party comparison posts does not appear on Elastic's own pricing page.

The Self-Hosted Four

Grafana Loki is the architectural odd one out, and its docs say why without hedging: it does not index log contents, only a label set per stream. That is the entire cost story. Labels in the index, bulk in object storage at S3 prices. If Prometheus and Grafana are already running, LogQL reads like PromQL's sibling. What you give up is fast arbitrary full-text search, since a query that cannot be narrowed by label turns into a scan, and a badly chosen label set gives you either unusable cardinality or streams too coarse to be useful. AGPL-3.0, v3.7.8 on September 17, 2026, 25,217 stars.

Grafana Loki project page, 25,217 GitHub stars

OpenSearch is the Apache-2.0 route to an Elasticsearch-shaped stack, and if your objection to Elastic is the license rather than the technology, this is the destination. Being unsurprising is the feature: the query DSL, index lifecycle management and dashboards all behave the way an ELK veteran expects. 3.8.0 landed August 5, 2026. It does not escape the operational weight of an inverted index, and its own install docs are honest about that, wanting vm.max_map_count at 262144 or higher, half of system RAM for the Java heap, and swap disabled.

Graylog sits in between: pipelines, streams, role-based access control and multi-tenancy shipped as a platform on top of OpenSearch and MongoDB, rather than parts you assemble. It supplies the operations layer raw engines omit, which is why it shows up wherever who-can-see-which-logs is the binding requirement. One correction worth repeating, because it is widely misreported: Graylog is not open source under the OSI definition. It ships under Server Side Public License v1, which is not OSI-approved, and GitHub's license detection returns NOASSERTION rather than an SPDX identifier. If your policy allows only OSI-approved licenses, this does not clear it. 7.1.9 was tagged September 2, 2026.

Graylog SIEM and log management homepage

VictoriaLogs is the newest credible option and competes on resource efficiency rather than feature count. It claims up to 30x less RAM and up to 15x less disk than Elasticsearch and Loki. Treat that as a vendor claim, because it appears in VictoriaLogs' own docs with named comparison targets but no workload definition and no methodology I could find. What is checkable is the shape: one zero-config Apache-2.0 binary the docs say runs on a Raspberry Pi with no flag tuning. What it lacks is ecosystem, meaning a thin plugin catalog, little community troubleshooting material, and a query language nobody on your team has used. v1.52.0 shipped July 16, 2026.

Side by Side

Tool Metering model Entry price Self-host License
Datadog Logs Ingest GB + index per M events $0.10/GB + $2.50/M events CloudPrem Proprietary
Better Stack Bundled plan by volume Free 3 GB, then $350/mo No Proprietary
Elastic Serverless Ingest GB + retained GB-month $0.07/GB Yes, self-managed Elastic License
Grafana Loki Write + Process + Retain GB $0 self-host, Cloud free 50 GB Yes AGPL-3.0
OpenSearch Infrastructure only $0 Yes Apache-2.0
Graylog Infrastructure only $0 Open edition Yes SSPL v1
VictoriaLogs Infrastructure only $0 Yes Apache-2.0

Full per-vendor pricing lines, including Better Stack's plan ladder and Grafana Cloud's three meters, are in the original article.

Five Checks Before You Commit

  1. Measure your average log line. Pipe a day of production output through wc -c, divide by line count. Every per-event price above moves inversely with that one number, and most people guess it wrong by 2x.
  2. Split what you search from what you keep. What share of your logs gets queried during an actual incident? Under a fifth, and an ingest-cheap, index-selective model wins. That ratio decides more of your bill than the vendor choice does.
  3. Test the query you run at 2am, not a benchmark. If your reflex is grepping unstructured stack traces for a substring, Loki's label model fights you no matter how good the price looks.
  4. Check the license before the trial, not after. SSPL and the Elastic License are not OSI-approved, and AGPL-3.0 stops some legal teams cold. Finding this out in week three of a migration is expensive.
  5. Ship through OpenTelemetry whoever wins. A collector in front of the backend makes the next migration a config change.

Two things make step 1 and step 5 concrete: the Grok Pattern Tester builds the patterns that turn unstructured lines into the fields every backend here bills you to index, and the OTel Config Generator writes the Collector YAML.

Picking One

Already deep in Datadog for APM. Stay, and move everything you do not query into Flex Logs. On this workload that is $1,360.72 down to $364.57 a month, no migration required.

Kubernetes with Prometheus and Grafana already running. Loki. Self-hosted if you have platform capacity, Grafana Cloud if not, where the free 50 GB tier covers a small cluster outright.

Full-text search over unstructured logs is the requirement. OpenSearch self-hosted if you have the operations budget for it, Elastic Cloud Serverless if you would rather pay $0.07 per GB than tune a cluster.

Small team, one bill, no platform work. Better Stack. One number to defend beats four meters to model.

Access control is the hard requirement. Graylog, assuming SSPL survives legal review. If it does not and the hardware is modest, VictoriaLogs is the Apache-2.0 fallback.

Conclusion

Log tools did not get cheaper in 2026. The cost of full-text indexing got explicit enough to shop around, which is a different thing. Datadog's Flex tier, Elastic's serverless retention pricing and Loki's label-only index are three implementations of one argument: stop indexing what you will never search.

Before the next renewal, get one number. What percentage of the logs you paid to index last quarter did anyone actually query? If nobody in the room can answer, that silence is your negotiating position.

References

Top comments (0)