DASH 2026
Observability Migrations & Telemetry Costs
Onto Datadog in weeks.Clean data in, controlled cost, no 18-month rebuild.
Logmetry is a team of vendor-agnostic observability and security architects. We move your telemetry onto Datadog the way it should land, high-signal traces, logs, and metrics flowing in clean and normalized, the rest tiered to low-cost storage. We know where Datadog cost actually hides, custom-metric cardinality and the ingest-plus-index meter, and we build the control layer that keeps it in check. Migrations run in weeks because we fork at the source and cut over by routing change.
The problem
Why does getting onto Datadog feel like an 18-month project?
Because the data feeding it was never built for it. The Datadog bill climbs with every new source, telemetry is fragmented across a dozen agents, and migrations drag for 12 to 18 months. Fix the collection layer first and the platform decision gets a lot easier.
The bill climbs with every new source
Datadog meters ingest and indexing separately, so every new host, container, and log source adds to the run rate. Volume grows each quarter and the budget conversation never ends.
Telemetry is fragmented across a dozen agents
Forwarders, collectors, and agents each send overlapping data their own way. No one can see what is generating what, and the noise crowds out the signal that detection and dashboards actually need.
Migrations drag for 12 to 18 months
Moving onto a new platform usually means re-onboarding every source by hand. That turns a platform decision into a multi-quarter rebuild, so teams stay where they are even when it costs them.
The approach
A vendor-agnostic pipeline in front of Datadog gets you there faster and keeps the bill in check.
The control layer sits between your sources and your platforms. It decides what flows into Datadog, what goes to cheap storage, and how every event is shaped on the way. That is the pipeline as insurance, one foundation that survives the next migration, destination swap, or compliance ask.
Clean, normalized, high-signal into Datadog
We normalize fragmented multi-agent data and route the high-signal events to Datadog. The rest goes to low-cost open-format storage you can replay on demand, so Datadog holds what your teams actually query.
Reduce before ingest
Filtering and tiering happen before data reaches the platform. A typical deployment cuts 30-70% of ingest volume. That is a range, not a promise. Your number depends on your environment and how much low-value data you carry today.
Fast migration by parallel run
We fork data at the source, write to your old platform and Datadog at once, and prove the new setup on real production traffic. Cutover is a routing change, so the next move is never another full rebuild.
We build the layer on the right platform for your environment. We are expert across four: Splunk, Microsoft Sentinel, Datadog, and Cribl. For DASH, Datadog is the destination. See how the same idea drives cost optimization and fast migrations.
Proof
High-volume logs off Splunk and onto Datadog, at Fortune 500 scale.
A Fortune 500 healthcare and life-sciences data organization, 20,000+ servers across 100+ countries. Telemetry had sprawled across a dozen tools and agents into a Splunk estate priced per gigabyte ingested. Cost climbed with every source, and no one could see what was generating what.
- 1
Architecture review. We mapped every source, agent, and data flow, and where the volume and cost actually sat.
- 2
A control layer in front. We re-pointed the Splunk forwarders to a vendor-neutral pipeline, changing where they send, not what they collect. A safe, reversible parallel run to both at once.
- 3
Clean, normalized, tiered. We normalized the fragmented multi-agent data, dropped the noise, and tiered full fidelity to low-cost storage.
- 4
Onto Datadog, off Splunk. High-volume operational logs moved to Datadog. Security-scoped data stayed on Splunk, where its SIEM still wins.
37%
less log volume into Splunk
61%
reduction on Palo Alto traffic logs
$192K
budget savings, year one
~30%
ongoing license and storage savings
Led by Zbigniew Gajuk, our Co-Founder and Chief Observability and Security Architect. The same method gets you onto Datadog fast, with clean, normalized data and a bill that makes sense.
Published outcomes from a pipeline-first approach
Reported publicly by other organizations, not Logmetry customer results. They show the pattern holds across environments.
40%
SIEM spend cut at Yale New Haven Health. 30,000+ endpoints migrated in 2 weeks.
93%
data-cost savings reported by Autodesk.
85%
reduction at TransUnion, 1 TB to 150 GB per day.
Your number depends on your environment.
Free for DASH 2026 attendees
A free system and architecture review.
With Zbigniew Gajuk, Co-Founder and Chief Observability and Security Architect, 26+ years at Fortune 500 scale. He maps your full environment, how you ingest, your patterns, and where the waste is, then turns it into a modernized collection layer that feeds Datadog clean, normalized data. That is future-proof observability, the new way.
Free of charge. The expert read is fully yours.
- An architect reads your real environment, not a product demo
- A modernized collection layer feeding Datadog clean data
- The expert read is yours, whether or not we work together
Request your review
Tell us where you are today. The architect follows up within one business day.
Frequently asked questions
How fast is a Splunk to Datadog migration?
Faster than the 12 to 18 months most teams plan for. With a control layer in front of your stack, we fork data at the source, write to Splunk and Datadog in parallel, prove Datadog on real production traffic, then cut over by routing change. Full migrations typically run in under three months.
Will Logmetry replace my SIEM?
No. We sit in front of your SIEMs and APMs as a control layer, never in place of them. We govern what flows into Datadog, Splunk, or Microsoft Sentinel, cut the noise, and route full fidelity to low-cost storage. Your platforms stay. The pipeline makes each one cheaper and cleaner.
How much can a pipeline layer cut my Datadog bill?
A typical deployment reduces ingest volume by 30 to 70 percent before it reaches the platform, so high-signal data goes to Datadog and the rest to cheap storage. That is a range, not a promise. Your number depends on your environment, your sources, and how much low-value data you carry today.
What is the free architecture review?
An architect maps your full environment, how you ingest, your patterns, and where the waste is, then shows you a modernized collection layer that feeds Datadog clean, normalized data. It is free for DASH 2026 attendees. No product pitch. The expert read is fully yours, whether or not we work together.
Which platforms does Logmetry work with?
We are expert across four platforms: Splunk, Microsoft Sentinel, Datadog, and Cribl. We are vendor-agnostic, so we recommend what fits your environment rather than what we are paid to sell. For DASH, Datadog is the destination. The control layer in front stays neutral, so you are never locked in.
Book your free architecture review.
Scan, visit logmetry.io/dash, or book directly. An architect looks at your real environment and shows you the fast path onto Datadog. The expert read is yours.