Comparisons
How 10x uses Datadog Flex Logs to cut the bill, how it compares to Log Rehydration and exclusion filters, how it differs from Observability Pipelines, and where CloudPrem fits.
Comparisons
How 10x uses Datadog Flex Logs to cut your bill
10x's primary Datadog lever is automatic Flex Logs down-tiering. It caps each pattern and routes the excess over each cap, marked @routeState:tier_down, into a Flex Logs index, cutting the dominant index cost on that slice while those logs stay queryable in Datadog's Log Explorer with no rehydration. The action is set per service and applies to every pattern over its cap in that service. Datadog markets Flex itself; the 10x value is choosing the excess per pattern, not the route.
How Flex pricing works
- $0.10/GB ingestion: charged on all data regardless of tier; tier_down does not change this meter
- $1.70/million events: Standard indexing at 15-day retention (annual; $2.55 on-demand), the dominant charge that Flex Logs replaces on the down-tiered slice
- $0.05/million events: Flex storage (annual commit; $0.075 on-demand)
- $0.60/million events: Flex Starter with compute bundled (annual; $0.90 on-demand)
- Compute is sold as flat-rate tiers (Starter, XS, S, M, L), each roughly twice the capacity of the previous; the larger tiers add a large compute charge
- Monitors and Watchdog are not supported on Flex Logs. To alert on that data, keep a subset in a Standard index
What a 10x plan reports for a Flex move: Flex is the first lever the MCP plans on Datadog, ahead of offload, because the moved logs stay searchable in Datadog. The plan states the events and GB moved out of the Standard index, the Standard indexing line that move avoids at Datadog list, and the Flex storage line it adds at list (held 30 days unless a retention is set), and names Flex compute as unpriced and excluded from both figures. It states no percentage of the Datadog bill: compute is sized and quoted per account, so the net rests on a figure only Datadog can give. On Flex Starter, the bundled rate replaces the storage and compute lines.
Honest caveat: Flex Logs must be enabled on the account first (pick a Compute size on the Flex Logs page, or the index apply is rejected). Lead with Flex Starter; the larger compute tiers add a large compute charge on top of storage.
For patterns you want out of Datadog entirely: Retriever offloads them to your own S3 at $0.023/GB-month, queries in-place via Bloom filter indexes, and streams specific time ranges and log types back on-demand, paying Datadog ingestion only on what you fetch. Or aggregate high-volume repetitive S3 events into metric data points on Datadog's time-series API, for dashboard visibility at metric pricing.
Datadog pricing as of Jan 2026; Standard indexing, Flex storage and Flex Starter re-read 2026-09-30
How 10x compares to Datadog Log Rehydration
Rehydration charges you to index a second time. Datadog rehydration scans your archives at $0.10 per compressed GB scanned, then charges indexing at your contracted rate (per million events) on the events it actually indexes, and it only covers what you archived. Retriever keeps the offloaded slice in your own S3 and fetches it in-place, so the cheap data stays reachable without paying Datadog to re-index it.
| Rehydration | Retriever | |
|---|---|---|
| Cost | $0.10/compressed GB scanned + per-million-event indexing | $0.023/GB-month stored in your S3 |
| Data scope | Only what you archived in Datadog | 100% of original logs in your S3 |
| Query | Full time-range re-index | Indexes locate events by app, timeframe, keywords |
| Output | Re-indexed into Datadog | Stream regulated events or aggregate into metrics |
| Control | All-or-nothing on time range | Cost-aware sampling per pattern |
Note: data excluded from a Datadog index can still be archived (ingestion is decoupled from indexing), so it is rehydratable. Data is only unrecoverable if it was never ingested. The 10x contrast is keeping the slice in your own S3 versus Datadog's archive plus a re-index charge.
Datadog pricing as of Jan 2026
Decision Guide
Should I use 10x + Datadog or just Datadog exclusion filters
Start with 10x. The non-destructive levers cut the bill while keeping the data reachable. tier_down moves noisy patterns into Datadog's cheaper Flex Logs index (still queryable in Datadog) and offload relocates the rest to your own S3. Datadog exclusion filters drop matched logs from an index at a sampling rate you set per query, and the dropped slice is only recoverable if you also archived it.
| Factor | Datadog Exclusion Filters | 10x |
|---|---|---|
| Mechanism | Query/facet rule, configurable 0-100% sampling rate | Per-pattern caps; tier_down or offload set per service for the excess |
| Effect | Drops matched logs from an index (still ingested) | Down-tier to Flex (still queryable) or move to your S3 |
| Data kept in Datadog | Excluded slice removed from the index | Down-tiered slice stays queryable in Flex |
| Setup | Native to Datadog | Receiver sidecar |
Choose 10x first: down-tier and offload lower the bill while keeping the data queryable.
Add exclusion filters after only if you still need to cut what gets indexed further.
How does 10x differ from Datadog Observability Pipelines
Observability Pipelines runs a Worker in your infrastructure that processes logs before they reach Datadog or another destination. Its processors include Filter, Quota, Sample, Dedupe, Throttle and Grok Parser, each set with filter queries, and a Custom Processor that takes VRL. Quota and Sample key on field values you choose, such as service, env or status; none of the processors keys on a stable pattern ID.
10x keys on the pattern: it names each log line from a symbol library compiled from your code, the same on every pod. On Datadog it uses that key for:
- tier_down: mark low-value patterns for the Flex Logs index, cutting the dominant index cost on that slice while they stay queryable in Datadog
- Receiver Filter mode: cap noisy events with rate policies you set once
- Retriever: offload patterns to your own S3 and fetch back only what you query
Compaction applies to the S3/Splunk/Elasticsearch paths, not the Datadog bill.
What about Datadog CloudPrem
CloudPrem handles sovereignty; 10x cuts the cost. CloudPrem (announced DASH 2025) lets customers run Datadog's processing on their own infrastructure. It answers where data is processed, not how much you process. 10x reduces the bill regardless of where Datadog runs:
- tier_down: routes low-value patterns to a Datadog Flex Logs index (cheaper queryable tier) and Filter mode caps noisy events before they reach the Standard index
- Retriever: offloads patterns to your own S3 and fetches back only what you query
CloudPrem + 10x is complementary: CloudPrem for data sovereignty, 10x for cost reduction. One addresses compliance, the other addresses your bill.