For a high-volume Datadog Logs alternative, the “best” choice depends heavily on whether you prioritize query power, cost, or managed simplicity. At scale, the winners are usually not traditional indexed log search engines because indexing everything gets expensive.

My shortlist:

Manvendra Rajpoot Alek's Blog## My top recommendation: ClickHouse-based logging

If you said:

“I need Datadog Logs, but I have hundreds of GB/day or TB/day and I still want expressive queries” I would pick ClickHouse.

Why:

• SQL is the query language — no proprietary query DSL to learn.
• Excellent for aggregations: ``` SELECT service, count() FROM logs WHERE level = 'error' AND timestamp > now() - INTERVAL 1 HOUR GROUP BY service ORDER BY count() DESC;

- Columnar storage makes it extremely efficient for analytics-style log workloads.
- You can retain huge volumes cheaply compared with indexed search systems. [Manvendra Rajpoot](https://blog.rajpoot.dev/posts/devops/log-aggregation-loki-clickhouse-2026/?utm_source=chatgpt.com) [ClickHouse](https://clickhouse.com/resources/engineering/datadog-alternatives?utm_source=chatgpt.com)

Good implementations:

- ClickHouse directly
- SigNoz (ClickHouse-backed observability)
- Grafana + ClickHouse datasource

The downside: you operate more of the stack yourself unless you use a hosted option.

## Best “drop-in Datadog-ish” experience: Grafana Loki

If your logs are mostly:

- Kubernetes
- microservices
- JSON structured logs
- debugging by service/environment/request ID

then Grafana Labs Loki is compelling.

Advantages:

- Very low storage cost because it indexes labels rather than every log token.
- Great Grafana integration.
- LogQL is reasonably expressive.

Example:

{app="checkout"} |= "payment failed" | json | duration > 1s

Tradeoff:

- It is not as good as SQL/ClickHouse for arbitrary analytics.
- High-cardinality labels can hurt you. [Manvendra Rajpoot](https://blog.rajpoot.dev/posts/devops/log-aggregation-loki-clickhouse-2026/?utm_source=chatgpt.com)

## Best if you need Elasticsearch-style searching: OpenSearch

OpenSearch is the safer choice if your users expect:

- full-text search
- Kibana-like workflows
- security analytics
- complex filtering

It has powerful query capabilities, but the operational cost is usually higher than Loki or ClickHouse because you are maintaining an indexing/search cluster. [Alek's Blog](https://blog.none.at/blog/2026/2026-05-14-es-os-loki-quickwit-clickhouse/?utm_source=chatgpt.com)

## What I would avoid for huge volumes

- **Elasticsearch-style stacks** if your primary concern is cost. They are excellent, but indexing everything gets expensive.
- **Datadog Logs at very large ingest volumes** unless the operational convenience is worth the premium.
- **Loki** if your team frequently asks questions like: - “Show me the 99th percentile latency grouped by customer over six months”
- “Find all errors matching this complex pattern across billions of events”

## Practical recommendation by scale

- **<50 GB/day:** stay with a managed product; Datadog may still be fine.
- **50 GB/day–1 TB/day:** Loki or ClickHouse.
- **1 TB+/day:** ClickHouse is usually the architecture I would investigate first.
- **Security/SIEM-heavy:** OpenSearch.

For a **Datadog Logs replacement specifically**, my ranking would be:

1. 🥇 **ClickHouse + Grafana/SigNoz** — best cost/query power ratio
2. 🥈 **Grafana Loki** — cheapest operational logging
3. 🥉 **OpenSearch** — best search-engine replacement
4. **Managed SaaS alternatives** — best if you want zero operations

If you share your approximate ingest volume (GB/day), retention period, and whether logs are mostly Kubernetes/app logs or security/audit logs, the recommendation can narrow considerably.

When moving away from Datadog for high-volume log management because of cost, the industry generally splits into two categories: managed, cost-optimized SaaS (predictable pricing, parsing/routing pipelines) and open-source/columnar engines (extremely cheap storage, powered by ClickHouse or object storage).

The top platforms fitting your criteria—high-volume capability, affordability, and a strong query experience—stand out for specific reasons:

1. Grafana Loki (Best Budget / Native Grafana Ecosystem)

• The Pitch: Loki is famously known as "like Prometheus, but for logs." Instead of indexing the full text of your logs, it only indexes metadata labels.
• Query Language: LogQL , which feels very familiar if you already use Prometheus/PromQL. It lets you extract metrics from logs on the fly and query streams efficiently.
• Why it’s affordable: Because it avoids full-text indexing, raw log chunks are compressed and pushed straight to cheap object storage like S3 or GCS. Ingestion and storage costs are a fraction of Datadog's.
• The Catch: Full-text keyword searches across massive, unindexed payloads can be slower than traditional engines if you don't structure your labels well. Available as self-hosted or via Grafana Cloud.

2. SigNoz (Best Open-Source / ClickHouse-Backed Alternative)

• The Pitch: An open-source, full observability suite designed specifically as a modern Datadog alternative. Under the hood, it uses ClickHouse as its datastore, making it blindingly fast for aggregations and text searches at high volumes.
• Query Language: Offers an intuitive advanced log query builder and SQL-backed querying power courtesy of ClickHouse's performance.
• Why it’s affordable: You can self-host it entirely for free, paying only for the underlying infrastructure. ClickHouse's columnar compression means you need significantly less disk space than traditional Elasticsearch setups. They also offer a managed cloud option.
• The Catch: Running ClickHouse at scale requires some operational maturity if you self-host.

3. Coralogix (Best Managed SaaS for Cost-Control & Routing)

• The Pitch: A heavily-praised enterprise alternative for teams leaving Datadog or Splunk due to runaway ingestion bills.
• Query Language: Standardized, lightning-fast search with robust querying capabilities and automated categorization/error grouping.
• Why it’s affordable: Coralogix uses a "DataFlow" pipeline approach that lets you dynamically block, route, or archive low-value logs before they hit your active tier (e.g., transforming high-volume info logs into cheap S3 metrics instead of paying full price for indexing). Their pricing model is transparent and structured to prevent bill shock.
• The Catch: It is a commercial SaaS, so while it is cheaper than Datadog at scale, it's not free like an open-source stack. You can check their model on the Coralogix Platform.

Summary Recommendation

• Choose Grafana Loki if your team already lives inside Grafana and you want rock-bottom storage bills by leveraging S3-compatible object storage.
• Choose SigNoz if you want an out-of-the-box open-source architecture that leverages ClickHouse for high-speed columnar querying without paying SaaS licensing fees.
• Choose Coralogix if you need a fully managed enterprise SaaS that actively slashes your log volume via intelligent pipelines rather than forcing you to manage infrastructure.

To help narrow this down, let me know:

• Is your preference to self-host (open-source) or use a managed SaaS?
• Roughly how many terabytes per day are you ingesting?

If your priority is high-volume logs + a good query language + materially lower cost than Datadog, my top pick in 2026 is OpenObserve.

My shortlist

🥇 OpenObserve — my recommendation

This is probably the closest match to what you're asking for.

• SQL querying rather than having to learn a proprietary log DSL.
• OpenTelemetry-native.
• Logs, metrics and traces in one platform.
• Cloud pricing currently lists $0.50/GB ingestion + $0.01/GB queried, with 30 days of log retention included.
• Self-hosted/open-source option if you want to push costs even lower.
• Uses object storage efficiently and is designed specifically for large log volumes.
• No per-host/per-user pricing, which is a major advantage over Datadog.
• The project reports deployments reaching 2+ PB/day.

The big attraction is that you can send all your logs rather than playing Datadog's game of deciding which logs are worth indexing.

I'd choose OpenObserve if you want a conventional SaaS product but don't want to operate Elasticsearch/Loki/ClickHouse yourself.

---

🥈 ClickStack — potentially the best technically

If your organization is comfortable with SQL and wants extremely high-volume analytics, I'd seriously investigate ClickStack.

It's built on ClickHouse, which is exceptionally good at scanning enormous volumes of columnar data. ClickStack supports Lucene-style search and full SQL, with 100+ built-in analytical functions. ClickHouse says it is designed to search terabytes of OTel data in seconds and ingest billions of high-cardinality events daily.

The particularly interesting part is the economics: Managed ClickStack is infrastructure-priced rather than event-priced, with ClickHouse claiming storage below $0.03/GB/month in certain configurations.

I'd choose this over OpenObserve if:

• You have TB/day rather than GB/day.
• Your engineers are comfortable with SQL.
• You want arbitrary analytical queries over logs.
• Query performance is extremely important.
• You already use ClickHouse.

---

🥉 Grafana Loki — cheapest if you accept LogQL

Loki is probably the option I'd investigate if cost is the overriding concern.

Its fundamental trick is different from Elasticsearch/Datadog: Loki primarily indexes labels/metadata, not the contents of every log line. That makes storage and ingestion dramatically cheaper at high volume. Grafana Cloud's current Pro pricing is $0.05/GB processed + $0.40/GB written + $0.10/GB retained, with a $19/month platform fee.

The downside is LogQL. It's powerful, but if your team is thinking:

SELECT service, count(*)
FROM logs
WHERE status >= 500
GROUP BY service

then ClickHouse SQL/OpenObserve will feel much more natural.

Loki is fantastic for:

"Show me all errors from this Kubernetes service over the last 30 minutes." It's less attractive for:

"Perform arbitrary analytics over 30 TB of historical logs."

---

Better Stack — best "just make it work" SaaS

Better Stack is another strong Datadog alternative. Its current log pricing is approximately $0.10/GB ingestion + $0.05/GB/month retention, and all ingested logs are searchable rather than having a separate indexing charge. It supports SQL + PromQL.

I'd pick Better Stack when developer experience and operational simplicity matter more than squeezing every possible dollar out of massive volumes.

At genuinely enormous volumes, though, I'd lean toward OpenObserve/ClickStack.

---

What I would not pick

Elasticsearch/OpenSearch wouldn't be my first choice for a new deployment unless you specifically need its ecosystem.

It's extremely capable, but the operational burden of running a large search cluster can erase the savings you're trying to get away from Datadog.

Splunk obviously has excellent querying, but if the objective is "Datadog but affordable at high volume," it isn't where I'd start.

SigNoz is worth considering, especially if you want open source and ClickHouse. It gives you ClickHouse SQL + PromQL and is a legitimate option. Better Stack But for log management specifically, I think OpenObserve and ClickStack are more compelling.

---

My ranking for your criteria

If I weight your requirements as high volume > cost > query language > ease of use:

1. 🥇 OpenObserve — best overall balance
2. 🥈 ClickStack — best raw performance/SQL option
3. 🥉 Grafana Loki — best cost structure
4. Better Stack — best turnkey SaaS experience
5. SigNoz — best open-source full observability alternative

If you tell me roughly how many GB/TB of logs you ingest per day, desired retention (e.g. 30/90/365 days), and whether you need SaaS vs self-hosted, I can calculate a realistic monthly cost for Datadog vs OpenObserve vs ClickStack vs Loki vs Better Stack at your volume.

Its fundamental trick is different from Elasticsearch/Datadog: Loki primarily indexes labels/metadata, not the contents of every log line. That makes storage and ingestion dramatically cheaper at high volume. Grafana Cloud's current Pro pricing is $0.05/GB processed + $0.40/GB written + $0.10/GB retained, with a $19/month platform fee.

The downside is LogQL. It's powerful, but if your team is thinking:

SELECT service, count(*)
FROM logs
WHERE status >= 500
GROUP BY service

then ClickHouse SQL/OpenObserve will feel much more natural.

Loki is fantastic for:

"Show me all errors from this Kubernetes service over the last 30 minutes." It's less attractive for:

"Perform arbitrary analytics over 30 TB of historical logs."

---

Better Stack — best "just make it work" SaaS

Better Stack is another strong Datadog alternative. Its current log pricing is approximately $0.10/GB ingestion + $0.05/GB/month retention, and all ingested logs are searchable rather than having a separate indexing charge. It supports SQL + PromQL.

I'd pick Better Stack when developer experience and operational simplicity matter more than squeezing every possible dollar out of massive volumes.

At genuinely enormous volumes, though, I'd lean toward OpenObserve/ClickStack.

---

What I would not pick

Elasticsearch/OpenSearch wouldn't be my first choice for a new deployment unless you specifically need its ecosystem.

It's extremely capable, but the operational burden of running a large search cluster can erase the savings you're trying to get away from Datadog.

Splunk obviously has excellent querying, but if the objective is "Datadog but affordable at high volume," it isn't where I'd start.

SigNoz is worth considering, especially if you want open source and ClickHouse. It gives you ClickHouse SQL + PromQL and is a legitimate option. But for log management specifically, I think OpenObserve and ClickStack are more compelling.

---

The best affordable, high-volume log management platform to replace Datadog is Grafana Loki if you want an industry-standard open-source ecosystem, or OpenObserve if you want a modern, ultra-low-cost platform utilizing familiar SQL querying.

Because Datadog's per-GB index pricing quickly compounds into unpredictable, massive bills at high volumes, leading alternatives decouple ingestion from storage by leveraging your own cloud object storage (like AWS S3). This architecture drastically drops storage costs while keeping data heavily compressed.

The top platforms for high-volume, cost-effective log management are outlined below, categorized by their structural approach.

Top Open-Source & Self-Hosted Alternatives

• Grafana Loki:
  • The Strategy : Often described as "Prometheus but for logs," Loki achieves affordability at scale by only indexing metadata labels (like app or environment ) rather than the full text of the log body.
  • Query Language : It utilizes LogQL , a highly powerful, grep-like query language that allows you to filter, aggregate, and format unstructured log streams directly in your dashboard.
  • Cost Advantage : Storing chunks directly in S3 or GCS makes it incredibly cheap to hold terabytes of high-volume data long-term.
• OpenObserve:
  • The Strategy : Built from scratch in Rust, OpenObserve is designed explicitly as a drop-in, cloud-native Datadog replacement. It claims up to a 140x lower storage cost footprint compared to traditional index-heavy tools.
  • Query Language : It features a robust, universal SQL-first engine (built on Apache DataFusion), meaning your team does not need to learn a proprietary syntax to filter high-cardinality logs. It also supports PromQL and Vector Remap Language (VRL).
  • Cost Advantage : Employs columnar storage optimization on top of object storage, allowing fast queries across massive volumes without the overhead of heavy indexing clusters.
• Parseable:
  • The Strategy : A lightweight, single-binary engine engineered specifically for high-volume logs. It formats your data natively into Apache Parquet before sending it to your S3 storage.
  • Query Language : Utilizes standard PostgreSQL-compatible SQL , making it immediately accessible to developers and data scientists alike.

Top Commercial & SaaS Alternatives

• Better Stack:
  • The Strategy : Built on top of ClickHouse, Better Stack is a highly optimized, lightning-fast SaaS logging solution tailored for teams that want managed infra without the Datadog premium.
  • Query Language : Features an intuitive web UI paired with standard SQL query inputs , allowing you to execute structural data analytics at scale without indexing bottlenecks.
  • Cost Advantage : Known for transparent, flat-rate volume pricing tiers that are explicitly predictable and significantly more affordable than Datadog's multi-dimensional billing model.
• Logz.io:
  • The Strategy : A fully managed SaaS wrapper around open-source frameworks like OpenSearch and Kibana. It eliminates the self-hosting operational burden while avoiding proprietary vendor lock-in.
  • Query Language : Uses Kibana Query Language (KQL) and Lucene syntax, providing highly mature text-search capabilities and deep analytical filter operators.
  • Cost Advantage : Includes features like data optimization tiers, allowing you to route low-priority logs to cold, inexpensive storage while maintaining real-time access to critical production streams.

Feature Comparison Matrix

To help narrow down the list, let me know:

• Would you prefer a fully managed SaaS or a self-hosted/open-source tool?
• What is your daily or monthly ingestion volume (e.g., in Gigabytes or Terabytes)?
• Are you heavily reliant on full-text search , or do you mostly filter by structured tags and JSON attributes?

If your main requirement is high-volume logs + a good query language + materially lower cost than Datadog, my first choice would be Better Stack. If you're willing to run more infrastructure yourself, ClickHouse/ClickStack is potentially even better at very large scale.

My shortlist

🥇 Best overall: Better Stack

Better Stack is probably the closest match to what you're describing.

The particularly attractive part is its pricing model: $0.10/GB ingested + $0.05/GB/month retained, with all ingested logs searchable. There isn't a separate Datadog-style "which logs do we index?" decision.

And the query language is SQL, which I would strongly favor over proprietary log DSLs if your team already knows SQL:

SELECT
  service_name,
  COUNT(*) AS errors
FROM logs
WHERE level = 'error'
  AND timestamp > NOW() - INTERVAL '1 hour'
GROUP BY service_name
ORDER BY errors DESC

Better Stack also supports PromQL and has live tail, dashboards, alerting, traces, etc.

Why I'd pick it: You get a fairly polished Datadog-like experience without paying Datadog prices, and SQL is a genuinely useful query language for arbitrary log analysis.

---

🥈 Best for really massive volumes: ClickStack / ClickHouse

If you're talking about multiple TB/day, I'd seriously investigate ClickHouse and its observability product, ClickStack.

The fundamental advantage is that ClickHouse is a columnar analytical database designed for extremely high-volume analytical workloads. ClickStack uses it underneath for logs, metrics, and traces and is designed to query enormous datasets quickly.

And you get SQL, rather than having to learn yet another log-search DSL.

This is the option I'd consider if your priorities are:

• 1+ TB/day of logs
• Long retention
• Lots of ad-hoc queries
• High-cardinality fields
• Wanting to avoid indexing everything
• Willing to operate infrastructure or manage a more technical platform

The tradeoff is that it's less turnkey than Better Stack.

---

🥉 Grafana Loki

Grafana Labs's Loki is another excellent choice, particularly if you're already a Grafana/Prometheus shop.

Its query language is LogQL, which is substantially nicer than many traditional log DSLs and integrates beautifully with Grafana.

Grafana Cloud's current pricing is $0.05/GB processed, $0.40/GB written, and $0.10/GB retained above the included tier; the free tier includes 50 GB/month.

The catch: Loki isn't a general-purpose analytical database in the same way ClickHouse is. It is optimized around its log-label architecture. If your users want to arbitrarily group/filter/aggregate dozens of high-cardinality fields, I'd lean toward ClickHouse or Better Stack.

---

What I'd choose based on volume

<100 GB/day: → Better Stack. The easiest answer.

100 GB/day – ~1 TB/day: → Better Stack vs ClickStack. Better Stack wins on simplicity; ClickStack wins if query performance/cost at scale is paramount.

1–10+ TB/day: → ClickStack/ClickHouse becomes very compelling.

Already running Grafana/Prometheus/Kubernetes: → Grafana Loki deserves serious consideration.

Want fully open-source/self-hosted: → ClickHouse/ClickStack, Loki, or VictoriaLogs.

One important distinction

If by "good query language" you mean "I want something as expressive as SQL", I'd narrow the field considerably:

ClickStack > Better Stack > OpenSearch > Loki > VictoriaLogs

If you mean "I want a really fast interactive log-search language", then LogQL/VictoriaLogs become more attractive.

My default recommendation for a company leaving Datadog would be Better Stack. It's the best combination of low operational overhead + excellent UX + SQL + predictable per-GB pricing. At truly huge volumes, I'd move the recommendation toward ClickStack/ClickHouse.

If you give me your approximate GB/day (or TB/day), retention period, and whether you need self-hosting, I can calculate the likely monthly cost of Datadog vs Better Stack vs Loki vs ClickHouse for your actual workload.

When moving away from Datadog’s notoriously expensive log ingestion and storage fees , finding a platform that handles high volume economically while maintaining a powerful query language (instead of forcing slow full-text regex scans) leads to a few standout options.

The best choices depend on whether you prefer a fully managed cloud service or an open-source/self-hosted stack backed by modern columnar storage.

1. VictoriaLogs (Best for Raw Performance & Storage Efficiency)

VictoriaLogs is purpose-built by the VictoriaMetrics team as a cost-effective, high-volume replacement for Elasticsearch and Grafana Loki. It uses a tiny fraction of the memory and disk space while offering a clean, intuitive query experience.

• Query Language: LogsQL . It is vastly superior and easier to read than Loki’s LogQL, supporting concise field filters, full-text token searches, and aggregations without the heavy indexing overhead of traditional ELK stacks.
• Volume & Cost: Columnar storage design provides incredible compression ratios (often using 5x–10x less storage than traditional setups). Extremely cheap to self-host or run via managed offerings.
• Best for: Teams drowning in multi-terabyte log volumes who want high-speed queries without massive hardware or cloud infrastructure costs.

2. OpenObserve (Best Lightweight, Cloud-Native & Open-Source)

OpenObserve is an ultra-fast, modern observability platform written in Rust. It is designed from the ground up to replace Datadog and Elasticsearch specifically by targeting storage economics and ease of use.

• Query Language: Supports both intuitive SQL (SELECT ... FROM ... WHERE ... ) and streamlined filter expressions out of the box, making it trivial for any engineer to query logs without learning an obscure proprietary syntax.
• Volume & Cost: Backed by object storage (like AWS S3) with aggressive compression. It handles high-volume ingestion smoothly and offers a generous free tier/self-hosted path.
• Best for: Teams wanting an all-in-one (logs, metrics, traces) cloud-native stack that can be deployed via a single binary or YAML file with minimal operational burden.

3. SigNoz (Best OpenTelemetry-Native APM & Log Suite)

SigNoz is widely regarded as the premier open-source application observability platform. While it handles full APM and metrics, its integrated log management leverages ClickHouse as its underlying database.

• Query Language: Uses a powerful UI-driven query builder that compiles down to ClickHouse SQL , allowing for deep, instantaneous filtering and analytical queries across high-cardinality log attributes.
• Volume & Cost: Self-hosted is free, and users regularly report saving 80%+ on observability spend compared to Datadog because ClickHouse scales efficiently on standard NVMe/cloud disks.
• Best for: Teams looking for a direct Datadog APM + Logs replacement built natively on OpenTelemetry.

4. Grafana Loki (Best Ecosystem Integration)

If your organization already relies heavily on Grafana for dashboards, Grafana Loki is a classic high-volume contender.

• Query Language: LogQL . While functional for basic tailing and metric extraction from logs, it can feel restrictive or cumbersome for complex analytical ad-hoc troubleshooting compared to LogsQL or SQL.
• Volume & Cost: Cheap indexing because it indexes labels rather than the full log content, though heavy full-text searches can become slow or expensive if not structured right.

Summary Recommendation

• Choose VictoriaLogs if your priority is maximum query speed and minimal storage footprint using a clean log-centric query language (LogsQL).
• Choose OpenObserve if you want an easy SQL-based interface with ultra-low S3-backed storage overhead.
• Choose SigNoz if you want a full Datadog-style UI experience with unified traces and metrics.

To help narrow down the ideal fit, let me know:

• Do you prefer a fully managed SaaS or a self-hosted open-source solution?
• Approximately how many gigabytes or terabytes of logs do you ingest per day?

Grafana Loki is widely considered the best affordable, high-volume log management platform alternative to Datadog, combining cost-effective label-based storage with the expressive LogQL query language.

Top Affordable High-Volume Alternatives

• Grafana Loki: Best for DevOps teams already using Grafana and Prometheus. It indexes only metadata (labels) rather than full log text, dramatically cutting storage costs at high volumes while using LogQL for powerful filtering and metrics extraction.
• SigNoz: Best open-source , OpenTelemetry-native platform. It provides an integrated APM and log experience with transparent, low-cost self-hosting or economical cloud options, avoiding Datadog's vendor lock-in.
• Elastic Stack (ELK): Best for deep text search and complete control. Using Elasticsearch and Kibana with Lucene/KQL syntax, it handles massive scale, though it requires operational overhead to self-manage or optimize.
• OpenObserve: Best ultra-lightweight cloud-native option. Designed for petabyte-scale performance with an intuitive SQL-compatible query interface and significantly lower storage footprints than traditional engines.

Feature & Query Comparison

If you can share your approximate daily log volume (in GB/TB) and whether you prefer a fully managed SaaS or self-hosted open-source setup, I can give you a more precise recommendation.

If your priorities are high log volume + low cost + a genuinely good query language, I’d shortlist Axiom, Better Stack, and ClickHouse/ClickStack rather than looking for a straight Datadog clone.

My ranking

🥇 Axiom — my first choice

For your exact wording, Axiom is probably where I'd start.

It is designed around ingesting large amounts of machine data and querying it cheaply. Its APL (Axiom Processing Language) is particularly good for log investigation: it uses a pipeline syntax where you filter, transform, aggregate, and project data sequentially. It's heavily inspired by KQL and has similarities to Splunk's SPL.

For example, the style is essentially:

logs
| where status >= 500
| summarize count() by service
| sort by count desc

The interesting part is that Axiom explicitly positions itself around petabyte-scale machine data, and its current pricing calculator shows extremely aggressive economics compared with Datadog.

Why I'd pick it:

• Excellent query experience
• Very good for raw/high-cardinality logs
• No need to decide which logs deserve indexing
• Fully managed
• APL is much nicer for log analysis than many SQL-only systems
• Particularly attractive when you're talking hundreds of GB → TBs/day

Downside: APL is another proprietary query language you have to learn.

---

🥈 ClickHouse / ClickStack — if SQL matters most

If your team says "we want SQL, period", I'd seriously investigate ClickStack, ClickHouse's observability stack.

ClickHouse is exceptionally good at high-volume analytical workloads. In 2026, ClickHouse introduced Managed ClickStack on ClickHouse Cloud, specifically targeting logs, metrics and traces. It is priced around infrastructure consumption rather than per-event/per-host observability SKUs. ClickHouse says its storage can be under three cents/GB/month in the relevant configuration.

This is compelling if you have something like:

5 TB/day of logs, 30–90 day retention, lots of ad-hoc queries. You get actual SQL:

SELECT service, status_code, count()
FROM logs
WHERE timestamp > now() - INTERVAL 1 HOUR
  AND status_code >= 500
GROUP BY service, status_code
ORDER BY count() DESC;

That's a huge advantage if your engineers already know SQL.

I'd choose ClickStack over Axiom when:

• Your organization is heavily SQL-oriented
• Logs are also used for analytical workloads
• You're dealing with truly enormous volumes
• You want maximum control over the data architecture
• You may eventually use ClickHouse for workloads beyond observability

Downside: the product experience is less "drop in Datadog and forget about it" than Better Stack.

---

🥉 Better Stack — easiest Datadog replacement

Better Stack is probably the safest recommendation for a normal engineering team.

Its current pricing is unusually straightforward: logs are $0.10/GB ingested + $0.05/GB/month retained, with standard querying included. It supports SQL and PromQL, and its telemetry product combines logs, traces and metrics.

For example, its current published plans include:

• 40 GB logs/month starting around $25/month when billed annually
• 160 GB at around $100
• 340 GB at around $210
• 700 GB at around $420

and its raw logs pricing is volume based rather than Datadog's collection of host/event/indexing charges.

The big advantage is developer experience. You get a polished hosted service without having to build your own observability infrastructure.

I'd choose it if your situation is:

"Datadog is getting ridiculous, but I don't want my engineers becoming experts in operating ClickHouse." That's exactly the sweet spot.

---

What about Loki?

Grafana Loki is potentially the cheapest option, particularly if you're already running Grafana/Kubernetes.

Its architecture is fundamentally different: Loki doesn't full-text-index log contents. It indexes labels/metadata and stores compressed log data, which makes it substantially cheaper than traditional indexed log systems.

The query language, LogQL, is good, particularly if you're accustomed to Prometheus.

But I'd rank it below Axiom/ClickHouse for your specific requirement of "good query language + high-volume logs."

The reason is that Loki's cost advantage comes partly from not indexing the contents. That can mean more work scanning log data when doing arbitrary searches.

It's fantastic for:

"Show me errors from these Kubernetes pods/services." Less fantastic for:

"Search 30 TB of arbitrary application logs for this weird string and then do complex analytical operations on the results."

---

One important distinction

I'd separate these into two categories:

"I want Datadog, but cheaper"

→ Better Stack

"I want a really good high-volume log analytics system"

→ Axiom

"I want SQL and enormous scale"

→ ClickStack / ClickHouse

"I want the cheapest/self-hosted Kubernetes solution"

→ Loki

"I want open-source Datadog with OpenTelemetry"

→ SigNoz

SigNoz is particularly interesting because it is OpenTelemetry-native and built on ClickHouse, but the tradeoff is that self-hosting means you become responsible for operating the observability backend.

My recommendation

If you gave me no other information, I'd evaluate Axiom vs Better Stack vs ClickStack in that order.

If you tell me roughly how many GB/TB of logs you ingest per day, retention period, and whether you need APM/metrics/traces too, I can do a much more useful Datadog-vs-Axiom-vs-Better Stack-vs-ClickHouse cost comparison at your actual volume.

If your priorities are high log volume + low cost + a genuinely good query language, I’d look beyond the usual Datadog clones.

My ranking

🥇 1. ClickStack — my first choice

ClickHouse's ClickStack is probably the most interesting Datadog Logs alternative if you're talking about hundreds of GB/day to multiple TB/day.

It is built on ClickHouse and gives you:

• Full SQL for sophisticated queries and aggregations
• Lucene-style search for ordinary log searching
• Extremely fast analytical queries
• Excellent compression
• High-cardinality data without Datadog-style indexing economics
• Native OpenTelemetry
• Logs + metrics + traces in the same system
• Open-source/self-hosted option
• Managed ClickStack on ClickHouse Cloud

ClickHouse specifically claims sub-second queries over petabytes of high-cardinality observability data and says ClickStack is designed for billions of events per day.

The really compelling part is the economics: you're essentially paying for infrastructure/compute/storage rather than per-log-event pricing. Managed ClickStack is explicitly designed around this model.

Query example:

SELECT
    service_name,
    count() AS errors,
    quantile(0.95)(duration_ms) AS p95
FROM otel_logs
WHERE timestamp > now() - INTERVAL 1 HOUR
  AND severity_text = 'ERROR'
GROUP BY service_name
ORDER BY errors DESC;

That's a major advantage if you dislike being constrained by a proprietary log query language.

Downside: ClickHouse is a more sophisticated system than Loki. If you just want "grep through Kubernetes logs," it's arguably overkill.

---

🥈 2. VictoriaLogs — best pure log-management bargain

VictoriaLogs is the sleeper choice I'd seriously consider.

Its LogsQL is considerably nicer than Loki's LogQL for many traditional log-analysis workloads, and VictoriaLogs is designed specifically around inexpensive, high-volume log storage.

For example:

error
| stats by (service) count() as errors
| sort by (errors) desc

It supports filtering, field extraction, aggregation, transformations, etc. The query API is explicitly designed to handle very large result sets.

The big attraction is that you can run it yourself and put the storage on relatively inexpensive infrastructure/object storage.

I'd choose VictoriaLogs over Loki if:

• logs are your primary concern
• you don't need the full Grafana observability ecosystem
• you want to minimize infrastructure cost
• you want a query language that feels more like a log analytics language
• you're comfortable operating the system yourself

---

🥉 3. Grafana Loki — cheapest/easiest if you're already using Grafana

Loki remains a very good answer, particularly if your team already uses Grafana Labs.

Its fundamental trick is not indexing the contents of every log line. It indexes labels and keeps the actual log data cheaply, which dramatically changes the economics at high volume.

Grafana Cloud currently starts at:

• $0.40/GB written
• $0.10/GB retained
• $0.05/GB processed
• 50 GB/month included

with volume discounts at higher usage.

And LogQL is quite capable:

{service="api", environment="prod"}
|= "error"
| json
| status >= 500
| stats count() by (endpoint)

The catch is that Loki's query model is fundamentally different from SQL/Elasticsearch. If your engineers routinely want arbitrary analytics over arbitrary fields, ClickHouse is more flexible.

Grafana also has a query-fair-use model allowing up to 100× monthly ingested log volume in GB to be queried without additional query charges, although heavy users can incur overages.

---

4. Better Stack — best "I don't want to operate anything"

Better Stack is worth a serious look if you want managed SaaS without Datadog pricing.

Its current log pricing is:

• $0.10/GB ingestion
• $0.05/GB/month retention
• standard querying included
• $0.001/GB scanned for query boost
• SQL queries
• VRL transformations
• OpenTelemetry support
• S3 storage option

Better StackFor example, Better Stack currently advertises a 700 GB logs/traces/metrics bundle for $420/month when billed monthly, or $350/month equivalent annually.

The SQL capability is particularly attractive if your team doesn't want to learn LogQL.

I'd pick Better Stack over ClickStack when developer convenience matters more than absolute economics/performance.

---

5. SigNoz — particularly good if you're going all-in on OpenTelemetry

SigNoz is another strong Datadog replacement because it's built around OpenTelemetry and ClickHouse.

Current cloud pricing starts at $0.30/GB of logs ingested, with a $49/month minimum and 15-day retention at the entry tier. It also offers a self-hosted Community Edition.

This makes it attractive if you want:

logs + metrics + traces + OTel + dashboards + alerts

rather than simply a log store.

I'd probably choose ClickStack over SigNoz if logs/querying are the primary requirement, though.

---

What I'd actually choose

If you told me:

"We're doing 500 GB–5 TB/day of logs and Datadog is getting ridiculous. We want fast searching, aggregations, long retention, and a good query language." I'd shortlist:

1. ClickStack

Best overall.

Especially if your engineers like SQL and you expect log volume to keep growing.

2. VictoriaLogs

Best price/performance if self-hosting is acceptable.

I'd investigate this very seriously before paying for a commercial log platform.

3. Grafana Loki

Best if you already use Grafana/Kubernetes.

The economics are excellent, but LogQL's data model is the biggest tradeoff.

4. Better Stack

Best managed/low-ops option.

Particularly compelling for roughly tens to hundreds of GB/day.

5. SigNoz

Best if replacing Datadog means replacing the entire observability stack.

---

One important distinction

I'd divide the market into two fundamentally different architectures:

Loki/VictoriaLogs

"Store logs extremely cheaply and query them efficiently." versus

ClickHouse/ClickStack

"Treat logs as an enormous analytical dataset." If your queries tend to be:

Find all errors for service X containing "connection refused" Loki/VictoriaLogs are fantastic.

If your queries tend to become:

Give me the p95 latency by endpoint, deployment, region and customer tier, correlate that with errors, compare it against the previous deployment, and show the top 50 exceptions ClickHouse/ClickStack wins by a mile.

That's why my personal recommendation for a serious high-volume Datadog replacement in 2026 is ClickStack. The combination of SQL + Lucene search + ClickHouse's columnar engine + OTel + high-cardinality support + infrastructure-based economics is unusually compelling.

If you tell me roughly how many GB/TB of logs you ingest per day, retention period, and whether you need managed SaaS or are willing to self-host, I can narrow this down to the cheapest 2–3 options and estimate the monthly cost.

When moving away from Datadog’s punishing log-volume pricing, the "sweet spot" for high-volume, affordable log management relies heavily on ClickHouse-backed architectures or LogQL/SQL-native pipelines . Datadog charges heavily for both ingestion and indexed storage; modern alternatives drop index overhead or use cheap object storage (S3/GCS) to cut bills by 70%–90%.

The top affordable, high-volume Datadog alternatives that feature robust query languages include:

• Grafana Loki (with Grafana Cloud or Self-Hosted)
  • The Query Language: LogQL (optimized for log streams, behaves somewhat like Prometheus PromQL, allowing label-based filtering and metric extraction on the fly).
  • Why it fits: Loki is famous for not indexing the full log contents—only the metadata/labels. This makes high-volume ingestion dramatically cheaper than traditional Elasticsearch/Datadog setups. You can use Grafana Cloud for a predictable managed bill or self-host the distributed version.
• SigNoz
  • The Query Language: ClickHouse SQL (fully expressive, extremely fast columnar querying).
  • Why it fits: SigNoz is an open-source, full-stack observability platform built natively on ClickHouse . Because it stores logs in ClickHouse, you get blazing-fast SQL queries over millions of high-volume log lines without paying per-gigabyte SaaS markup . It is available as a cost-effective managed cloud or self-hosted open-source software . You can review details on SigNoz.
• OpenObserve
  • The Query Language: SQL / OpenObserve QL.
  • Why it fits: Built specifically for ultra-high-volume cloud-native telemetry using a tiny storage footprint (on S3/local disk), OpenObserve is designed to replace ELK and Datadog at a fraction of the cost . It features a generous self-hosted tier and extremely low resource utilization. Check out OpenObserve.
• Parseable
  • The Query Language: SQL.
  • Why it fits: A lightweight, cloud-native log management system written in Rust that streams logs directly to object storage (S3, etc.). It treats log data immutably and lets you query it instantly using standard SQL. It provides an efficient Bring-Your-Own-Cloud (BYOC) model that drastically undercuts legacy per-GB pricing . Learn more at Parseable.

To help narrow down the best fit for your stack, tell me:

• What is your approximate daily or monthly log volume (GB/TB per day)?
• Do you prefer a fully managed SaaS or an open-source tool you can self-host on Kubernetes/Docker?
• Are you looking to replace just logs , or do you also need metrics and APM/traces included?