Datadog for Cloudflare Logs: What It Really Costs
“Just send the Cloudflare logs to Datadog” is common advice. It’s a good product, and the per-unit prices look small.
The trouble is that Cloudflare logs are one event per HTTP request. Small prices times a lot of requests add up fast. Here’s the math.
First: you need Enterprise to get the logs
Sending Cloudflare HTTP request logs to Datadog uses Logpush, and Logpush is an Enterprise-only feature (the only exception is Workers Trace Events on Workers Paid).
If you’re on Free, Pro, or Business, the real price of this route is an Enterprise contract plus Datadog.
Datadog’s log pricing
From Datadog’s public pricing page (annual billing, at the time of writing):
| Item | Price |
|---|---|
| Ingestion | $0.10 per GB |
| Standard indexing, 15-day retention | $1.70 per million events per month |
| On-demand indexing | $2.55 per million events |
| Flex Logs storage | $0.05 per million events stored per month |
| Rehydration from archive | $0.10 per compressed GB scanned, plus indexing |
Standard indexing for more than 30 days is “contact us” pricing.
Worked example: three traffic levels
Assumptions: one log event per request, about 1 KB per event, and every event indexed with 15-day retention. Your event size depends on which fields you enable in Logpush, so measure yours.
| Monthly requests | Ingest (GB) | Ingestion | Indexing (15 days) | Monthly total |
|---|---|---|---|---|
| 10 million | 10 | $1 | $17 | ~$18 |
| 100 million | 100 | $10 | $170 | ~$180 |
| 1 billion | 1,000 | $100 | $1,700 | ~$1,800 |
At small volumes, this is cheap. The problem starts at scale, and with retention. That ~$1,800/month only buys 15 days of searchable history.
What about keeping a year?
To go past 15 days, you have three options:
- Longer standard retention. Beyond 30 days, you have to contact sales for a price.
- Flex Logs. $0.05 per million events per month, up to 15 months. At 1 billion events a month, holding 12 months means ~12 billion stored events, or ~$600/month at steady state, on top of ingestion. Flex has separate compute charges for querying, so check the current pricing page.
- Archives + rehydration. Store cheaply in your own S3 bucket, then pay to rehydrate and re-index when you need old data. That’s cheap until an incident, when you pay again under time pressure.
The costs that don’t show up on the invoice
- Exclusion filters. Teams cut costs by dropping “boring” requests like 200s and static assets. Those are often exactly the requests you need later.
- Sampling decisions. Indexing only a sample saves money but weakens forensic answers.
- Budget alerts. A DDoS attack is also a log volume spike. Your observability bill spikes along with it.
Rule of thumb: Datadog is excellent for live observability across your whole stack. As a long-term archive for high-volume edge logs, you’re paying search-engine prices for data you rarely search.
When Datadog makes sense
- You’re already on Cloudflare Enterprise and Datadog
- You need Cloudflare events correlated with APM and infrastructure data
- Short retention (15 days) is enough for your use case
When it doesn’t
- You’re not on Enterprise
- You mostly need history — trends, investigations, audits — rather than live alerting
- Your volume is in the hundreds of millions of requests or more
For the do-it-yourself route, see S3 + Athena for Cloudflare logs. For the broader landscape, see Logpush vs. Logpull costs.
A flat-rate alternative for history
MetricKeeper archives the analytics Cloudflare exposes on your plan, with no Enterprise contract, per-event indexing fees, or pipeline to run. Connect a read-only token and your history starts building.