Comparisons
How 10x uses Datadog Flex Logs to cut the bill, how it compares to Log Rehydration and exclusion filters, how it differs from Observability Pipelines, and where CloudPrem fits.
Comparisons
How 10x uses Datadog Flex Logs to cut your bill
10x's primary Datadog lever is automatic Flex Logs down-tiering. It decides per pattern which logs are safe to move and routes the marked slice (@routeState:drop) into a Flex Logs index, cutting the dominant index cost (roughly 70% on the down-tiered slice) while those logs stay queryable in Datadog's Log Explorer with no rehydration. Datadog markets Flex itself; the 10x value is the per-pattern decision of which logs are safe to down-tier, not the route.
How Flex pricing works
- $0.10/GB ingestion: charged on all data regardless of tier; tier_down does not change this meter
- Standard indexing (per million events): the dominant charge that Flex Logs replaces on the down-tiered slice
- $0.05/million events: Flex storage (annual commit; $0.075 on-demand)
- $0.60/million events: Flex Starter with compute bundled (annual; $0.90 on-demand)
- Compute is sold as flat-rate tiers (Starter, XS, S, M, L), each roughly twice the capacity of the previous; the larger tiers add a large compute charge
- Monitors and Watchdog are not supported on Flex Logs. To alert on that data, keep a subset in a Standard index
Honest caveat: Flex Logs must be enabled on the account first (pick a Compute size on the Flex Logs page, or the index apply is rejected). Lead with Flex Starter; the larger compute tiers add a large compute charge on top of storage.
For patterns you want out of Datadog entirely: Retriever offloads them to your own S3 at $0.023/GB-month, queries in-place via Bloom filter indexes, and streams specific time ranges and log types back on-demand, paying Datadog ingestion only on what you fetch. Or aggregate high-volume repetitive S3 events into metric data points on Datadog's time-series API, for dashboard visibility at metric pricing.
Datadog pricing as of Jan 2026
How 10x compares to Datadog Log Rehydration
Rehydration charges you to index a second time. Datadog rehydration scans your archives at $0.10 per compressed GB scanned, then charges indexing at your contracted rate (per million events) on the events it actually indexes, and it only covers what you archived. Retriever keeps the offloaded slice in your own S3 and fetches it in-place, so the cheap data stays reachable without paying Datadog to re-index it.
| Rehydration | Retriever | |
|---|---|---|
| Cost | $0.10/compressed GB scanned + per-million-event indexing | $0.023/GB-month stored in your S3 |
| Data scope | Only what you archived in Datadog | 100% of original logs in your S3 |
| Query | Full time-range re-index | Indexes locate events by app, timeframe, keywords |
| Output | Re-indexed into Datadog | Stream regulated events or aggregate into metrics |
| Control | All-or-nothing on time range | Cost-aware sampling per pattern |
Note: data excluded from a Datadog index can still be archived (ingestion is decoupled from indexing), so it is rehydratable. Data is only unrecoverable if it was never ingested. The 10x contrast is keeping the slice in your own S3 versus Datadog's archive plus a re-index charge.
Datadog pricing as of Jan 2026
Decision Guide
Should I use 10x + Datadog or just Datadog exclusion filters
Start with 10x. The non-destructive levers cut the bill while keeping the data reachable. tier_down moves noisy patterns into Datadog's cheaper Flex Logs index (still queryable in Datadog) and offload relocates the rest to your own S3. Datadog exclusion filters drop matched logs from an index at a sampling rate you set per query, and the dropped slice is only recoverable if you also archived it.
| Factor | Datadog Exclusion Filters | 10x |
|---|---|---|
| Mechanism | Query/facet rule, configurable 0-100% sampling rate | Per-pattern tier_down + offload |
| Effect | Drops matched logs from an index (still ingested) | Down-tier to Flex (still queryable) or move to your S3 |
| Data kept in Datadog | Excluded slice removed from the index | Down-tiered slice stays queryable in Flex |
| Setup | Native to Datadog | Receiver sidecar |
Choose 10x first: down-tier and offload lower the bill while keeping the data queryable.
Add exclusion filters after only if you still need to cut what gets indexed further.
How does 10x differ from Datadog Observability Pipelines
OP requires your team to write and maintain VRL routing rules for every log format your applications produce.
10x learns your log formats automatically, no rules to write, no regex to maintain. It cuts the Datadog bill through:
- tier_down: auto-move low-value patterns into Datadog Flex Logs, cutting the dominant index cost on that slice while they stay queryable in Datadog
- Receiver Filter mode: cap noisy events with rate policies you set once
- Retriever: offload patterns to your own S3 and fetch back only what you query
Compaction applies to the S3/Splunk/Elasticsearch/ClickHouse paths, not the Datadog bill.
What about Datadog CloudPrem
CloudPrem handles sovereignty; 10x cuts the cost. CloudPrem (announced DASH 2025) lets customers run Datadog's processing on their own infrastructure. It answers where data is processed, not how much you process. 10x reduces the bill regardless of where Datadog runs:
- tier_down: routes low-value patterns to a Datadog Flex Logs index (cheaper queryable tier) and Filter mode caps noisy events before they reach the Standard index
- Retriever: offloads patterns to your own S3 and fetches back only what you query
CloudPrem + 10x is complementary: CloudPrem for data sovereignty, 10x for cost reduction. One addresses compliance, the other addresses your bill.