Topic 68

Managed Observability

Managed

Every quarter someone at Harborline asks the reasonable question: why does Mara spend days upgrading Loki and forecasting obs-01's disk when Datadog sells all of this as a product? The honest answer is not a winner — it is an exchange rate. Self-hosting pays in engineering time; SaaS pays in invoices and lock-in; and which side of the trade is right depends on team size, data volume, and how much of the stack's operation is differentiating work versus toil.

This topic arms the quarterly conversation with structure instead of vibes: what managed platforms actually sell, how the three market tiers price it, where the costs of each side hide, and a framework for re-running the decision as the numbers change — because they will.

What Managed Buys

The product is operations, not features. Someone else runs the ingest, scales the storage, applies the upgrades, and carries the pager for the observability stack itself. Chapter 12 raised the meta-problem — who watches the watcher, who responds when obs-01 fills at 02:00 — and a managed platform converts that rota into a line item. Everything else on the marketing page is secondary to this trade.

The Integrated Platforms

Datadog, New Relic, and Dynatrace sell one agent, every signal, and cross-signal correlation that works on day one — the metric-to-trace-to-log pivot Harborline hand-built across Chapters 6–8, delivered as a default. For a team with no observability engineering to spare, that day-one coherence is the entire pitch, and it is a real one.

The pricing models are where the three costs from Chapter 1 come back with an invoice attached. The platforms combine per-host infrastructure fees, per-GB log ingest, and per-ingest or per-user charges in vendor-specific mixes — which means the bill scales with exactly the quantities this book taught you to control: cardinality, sampling, retention. The line with teeth is custom metrics, billed by distinct series: one high-cardinality label on a harborline_* histogram moves the meter the same way it moved Prometheus's memory in Chapter 3, except now the consequence is denominated in currency.

Hosted Open Source

Grafana Cloud runs the same stack this book teaches — Mimir for Prometheus metrics, Loki for logs, Tempo for traces, Pyroscope for profiles — priced on usage: active series, GB of logs ingested, trace volume. Every PromQL query, dashboard JSON, and alert rule from Chapters 4–10 transfers unchanged, which makes hosted OSS the lowest-friction exit from self-hosting and, symmetrically, the lowest-friction return if the bill outgrows the convenience. For a team already fluent in the OSS stack, this tier is the default candidate.

Cloud-Native Monitoring

AWS CloudWatch and Google Cloud Monitoring hold a different position: already there, already collecting, and genuinely fine for cloud-resource telemetry — instance CPU, load-balancer 5xx counts, managed-database metrics arrive with zero setup. Their weakness is everything above the infrastructure: cross-signal correlation, application-level depth, anything multi-cloud. The trace-to-log jump Harborline built in Chapter 8 is exactly what they struggle to reproduce, so the sane pattern is both-and — native monitoring for the cloud resources, a real observability stack for the application.

The Real Cost of Each Side

Self-hosting's price never appears on an invoice, which is why it wins dishonest comparisons. It is Mara's hours: upgrades, disk forecasting, scaling Loki when ingest doubles, being the on-call for the on-call system — a real fraction of an engineer, every month, forever. Any spreadsheet that compares a SaaS quote against zero has already reached its conclusion by omission.

SaaS's price is the bill that grows with traffic whether or not anyone looks at the data, egress fees for shipping telemetry out of the cloud, and lock-in through proprietary agents and query languages — the exit cost of a platform whose agent is woven through every service is re-instrumentation, not repointing. The hedge is architectural: instrument with OpenTelemetry regardless of backend, and the data plane stays portable while the storage and query layer stays negotiable.

A Decision Framework

At Harborline's scale — 5 services, 2 hosts, one engineer who cares — either answer works: self-hosting is a hobby with benefits, and a SaaS bill for this volume is small. The calculus shifts when either axis grows 10×. Choose SaaS when engineering time is the scarce resource; choose self-hosted or hosted-OSS when data volume makes usage-based pricing the scarce resource; and re-run the numbers yearly, because ingest grows, team size changes, and vendor pricing moves. The failure is not picking the wrong side — it is treating either answer as permanent.

Build vs buy — match the choice to the scarce resource, and re-run yearly
Small team, engineering time is the scarce resourceIntegrated SaaS
Already fluent in the OSS stack, want the pager goneGrafana Cloud (hosted OSS)
Data volume makes usage-based pricing the painSelf-hosted
Just cloud-resource telemetry, already collectingCloud-native monitoring
Common Mistakes
  • Comparing the SaaS invoice against zero — the self-hosted stack costs a real fraction of an engineer plus hardware, and leaving Mara's hours out of the spreadsheet is how "free" wins every quarterly conversation and loses every incident.
  • Signing an integrated platform without modeling custom-metric cardinality — the per-host quote looks flat, then the first harborline_* histogram deployed fleet-wide lands in the custom-metrics meter and the bill doubles.
  • Instrumenting with a vendor's proprietary agent instead of OpenTelemetry — the telemetry pipeline now belongs to the vendor, and the exit cost is re-instrumenting every service rather than repointing an exporter.
  • Assuming CloudWatch or Google Cloud Monitoring covers application observability because it covers the infrastructure — resource metrics arrive automatically, but the checkout trace, the log correlation, and the SLO burn-rate math are yours to build or buy elsewhere.
  • Treating the decision as permanent — the right answer at 5 services and no dedicated SRE inverts at 50 services or 10× the ingest, and a team that never revisits it is paying last year's correct price for this year's wrong choice.
Best Practices
  • Instrument everything with OpenTelemetry regardless of backend, so the collect layer stays yours and switching backends is an exporter config, not a rewrite.
  • Price the self-hosted stack honestly — count the engineer-hours per month spent operating it, and put that number next to the SaaS quote in the same spreadsheet.
  • Pilot a managed platform with one service's telemetry and a hard ingest cap before any org-wide commitment, and watch the custom-metrics meter for 28 days — one full SLO window.
  • Use the cloud provider's native monitoring for cloud-resource telemetry even when the application stack lives elsewhere — it is already collecting, and duplicating it buys nothing.
Comparable toolsIntegrated Datadog, New Relic, Dynatrace — one agent, every signal, correlation on day oneHosted OSS Grafana Cloud — Mimir, Loki, Tempo, Pyroscope; this book's stack as a serviceCloud-native AWS CloudWatch, Google Cloud Monitoring — resource telemetry, already collectingSpecialists Honeycomb (trace-first), Splunk Observability, Elastic Observability, Chronosphere (cardinality control)

Knowledge Check

What is a managed observability platform fundamentally selling?

  • A feature set the open-source stack has no way of replicating at any team size
  • Operations: the meta-problem of running the stack becomes a line item
  • Cheaper storage than any team can provision itself
  • A standard query language shared across all vendors

Why do integrated-platform bills tend to grow teeth at the custom-metrics line?

  • Because every dashboard query issued against them is individually metered and billed
  • Cardinality drives the meter — one label can multiply the count
  • Vendors charge a conversion fee for non-proprietary formats
  • Custom metrics are retained forever by default

What makes Grafana Cloud the lowest-friction exit path for a team on the self-hosted OSS stack?

  • The queries, dashboards, and alert rules transfer unchanged
  • It is free of charge below a traffic threshold that no small team ever exceeds
  • It requires no agents or telemetry shipping at all
  • Grafana migrates all historical data with one click

Where does self-hosting's cost hide?

  • In the hardware invoices for obs-01's disks
  • In open-source license fees that accumulate quietly
  • In the egress fees for shipping telemetry to the cloud
  • In engineer-hours that never appear on an invoice

Why is OpenTelemetry instrumentation the hedge against vendor lock-in?

  • It guarantees identical pricing across all backends
  • It makes dashboards portable between query languages
  • Switching backends becomes an exporter config, not a rewrite
  • It forces every vendor to open-source their proprietary collection agents

You got correct