Datadog is a SaaS observability platform that collects metrics, logs, traces, and more behind a single host agent, then ties them together in dashboards and monitors. A team installs the Datadog Agent on each host or as a Kubernetes DaemonSet, the agent ships data to Datadog's backend, and engineers query it through the web app. Its breadth is the reason it dominates: more than 800 integrations cover databases, queues, cloud services, and runtimes, so the same pane shows your Postgres connection count next to your application's p99 latency next to the AWS bill.

How the agent collects data

The agent runs checks - small Python or Go collectors - on an interval and forwards the results. Each integration ships as a check with its own YAML config under conf.d/. A Postgres check, for example, names the host, credentials, and the custom queries to run, and the agent turns the results into metrics tagged by host, database, and any tags you add. Tagging is the organizing principle of the whole platform: every metric, log, and span carries key-value tags, and you slice dashboards and alerts by them.

# conf.d/postgres.d/conf.yaml
init_config:

instances:
  - host: db-primary.internal
    port: 5432
    username: datadog
    password: "ENC[postgres_password]"
    dbname: app
    tags:
      - "env:production"
      - "service:checkout"
    custom_queries:
      - metric_prefix: app.orders
        query: "SELECT count(*) FROM orders WHERE status = 'pending'"
        columns:
          - name: pending
            type: gauge

Monitors and the cost of logs

Monitors are Datadog's alerting primitive - a metric monitor watches a query like avg:trace.http.request.duration{service:checkout} by {resource} and fires when it crosses a threshold for a chosen window. Log monitors and anomaly monitors extend the same idea to log volume and learned baselines. The recurring surprise on the invoice is log ingest and indexing, billed by volume; the lever is to ingest broadly but index selectively, keeping high-cardinality debug logs out of the indexed (searchable) tier unless an investigation needs them. APM trace retention and custom-metric counts are the other two line items that grow quietly.

Frequently asked questions

What does the Datadog Agent actually send? Metrics from its checks, plus logs it tails, plus traces from instrumented applications via the bundled trace library - all tagged and forwarded to Datadog's backend over an API key.

Why is the Datadog bill hard to predict? Logs are priced by ingested gigabytes and separately by indexed (searchable) events, custom metrics are counted per unique tag combination, and APM is priced per host plus retained spans. High cardinality multiplies all three.

How does Datadog differ from Grafana Loki? Datadog is a managed all-in-one platform that indexes full log content; Grafana Loki is self-hosted and indexes only labels, trading query flexibility for much lower storage cost.

Is the agent required? For host and integration metrics, yes. Logs and traces can also arrive through agentless paths (cloud log forwarders, the API), but the agent is the standard collector.

See the monitoring & logging overview and compare with New Relic.