Observability

106 posts

datadog3 min readCurated summary

Breaking up a monolith: How we’re unwinding a shared database at scale

Datadog is moving away from a large shared relational database because its benefits eventually give way to coordination costs, schema fragility, noisy-neighbor problems, and scaling limits. Splitting the database is difficult and expensive, but platform investments in service development and managed Postgres can make independently owned databases practical. The key is to establish functional boundaries, provide safe cross-domain access, and automate migrations. ## Why Shared Databases Persist - Shared databases reduce operational overhead for small or fast-moving organizations. - A single database enables simple, low-latency joins across all data. - Workload isolation and access management often matter less when systems are small. - Because the cost of splitting a database is high, organizations commonly keep the shared model longer than they should. ## Signs It Is Time to Split the Database - Data grows beyond the capacity of one machine, or replication becomes too slow. - Noisy-neighbor effects make performance unpredictable. - Schema changes by one team unexpectedly affect others. - Security requirements such as access-control lists are difficult to enforce. - These issues create engineering costs, incidents, and degraded user experiences across teams. ## What Database Decomposition Requires - Identify functional ownership boundaries. - Build services for cross-domain queries where necessary. - Require consumers to use those services instead of querying another domain’s tables directly. - Provision new database instances. - Migrate data and traffic carefully from the shared database to the new instances. Datadog had previously split off large portions of its database into only a few separate databases. The experience showed that finding boundaries, enforcing them, and migrating without incidents is difficult and highly manual. ## Why Teams Resist Leaving Shared Infrastructure - Building a service may jeopardize existing product goals. - Operating a service can introduce significant maintenance and on-call work. - Cross-domain data access may be unclear or cause unacceptable latency or user impact. - Owning a database creates additional operational responsibility. - Migrations are often handcrafted, risky, and difficult to repeat. - Forcing the transition can cost more than tolerating the existing problems and create organizational resistance. ## Platform Investments That Enable Change Datadog addressed these obstacles through two major initiatives: - **Rapid:** An opinionated framework for building and operating API and gRPC services. - **OrgStore:** A managed platform for Postgres databases. Rapid reduces the cost of creating and maintaining services by providing shared configuration, common data-access patterns, and operational support. OrgStore reduces the burden of owning separate database instances. Together, these platforms make it more attractive for new projects to avoid the legacy shared database and allow existing domains to migrate incrementally. The broader lesson is that database decomposition becomes realistic when platform engineering makes service ownership, database operations, cross-domain access, and migrations safe enough to fit into normal product development.

Read original(opens in new tab)
datadog1 min readCurated summary

Detecting faulty deployments: Our journey from unlabeled data to supervised learning | Datadog

The supplied content does not include the blog post itself; it contains Datadog’s navigation menu and a link titled “Detecting Faulty Deployments.” As a result, there is not enough information to accurately summarize the article’s arguments, implementation details, or conclusions. ## Available context - The linked article appears to concern identifying deployments that introduce faults or regressions. - Datadog’s platform covers related capabilities such as: - Application Performance Monitoring - Metrics and infrastructure monitoring - Logs and error tracking - CI Visibility and software delivery monitoring - Service-level objectives and incident response - The page also promotes Datadog’s recognition as a Leader in the Gartner Magic Quadrant for Observability Platforms. ## Missing information - The article’s detection methodology - Metrics, queries, or deployment signals used - Alerting, rollback, or remediation procedures - Technical examples and conclusions Please provide the article text or a page extract containing the post body for an accurate summary.

Read original(opens in new tab)
datadog3 min readCurated summary

Squeezing every millisecond: How we rebuilt the Datadog Lambda Extension in Rust

Datadog rewrote its AWS Lambda extension from Go into Rust to overcome the performance limits of adapting its large, host-oriented Datadog Agent to Lambda’s constrained environment. The redesign reduced cold-start latency by 82%, memory usage by 40%, and binary size from 55 MB to 7 MB. The project succeeded by narrowing the problem, enforcing performance budgets from the beginning, and designing specifically for Lambda’s execution model. ## Why the Original Extension Needed to Change - The Lambda extension runs as a sidecar process, collecting logs, metrics, traces, profiles, and process data asynchronously. - It was originally based on the Datadog Agent, which is designed for hosts, containers, and clusters. - The Agent’s fairness, buffering, caching, and high-throughput features introduced unnecessary overhead in Lambda. - Optimization attempts included: - Removing dependencies with build tags - Compressing binaries with UPX - Eliminating unnecessary `init` methods - Exploring Go plugins for lazy loading - These changes could not reduce additional cold-start latency below roughly 450–500 milliseconds. ## Why a Rewrite—and Why Rust - Rewrites are risky because they can lose undocumented invariants, reproduce subtle bugs, and create the burden of supporting two systems. - The team concluded that Lambda represented a fundamentally different scale and workload from the general-purpose Datadog Agent. - Rust was well suited because: - Memory safety reduces the risk of crashes and data races. - Extension crashes also terminate the Lambda function and trigger another cold start. - Rust produces small binaries with limited runtime overhead. - Lambda targets a narrow platform set: Amazon Linux on x86 and Arm. - Compile-time concurrency guarantees support reliable multithreaded code. - A hackathon prototype demonstrated enough potential to begin the full rewrite, named Project Bottlecap. ## Project Bottlecap’s Design Constraints - The extension had to minimize interference with the function handler, especially because many Lambda functions serve latency-sensitive APIs. - Telemetry work should occur after the handler returns whenever possible. - The team also minimized post-runtime duration—the CPU time added after normal function execution. - Performance was monitored from the start: - Dashboards and alerts tracked cold-start overhead. - Every pull request was benchmarked. - Regressions were investigated before merging. - The team accepted targeted tradeoffs for speed, including manually implementing AWS API calls and request signing instead of using SDKs that added too much overhead. - The design emphasized optionality because Lambda workloads range from small API functions to large asynchronous batch jobs. - Planned flush strategies included: - Flushing at the end of an invocation for infrequently called or CPU-constrained functions - Periodic or in-invocation flushing for workloads needing different latency and resource tradeoffs The practical lesson is that software optimized for large, long-running systems may be fundamentally unsuitable for serverless runtimes. When optimization reaches a hard performance floor, a focused rewrite—constrained by the target environment and measured continuously—can deliver major gains.

Read original(opens in new tab)
datadog1 min readCurated summary

Squeezing every millisecond: How we rebuilt the Datadog Lambda Extension in Rust | Datadog

The provided text does not contain the blog post’s main article body. It mainly includes Datadog’s navigation links and a promotional announcement that Gartner named Datadog a Leader in the 2026 Magic Quadrant for Observability Platforms. The linked page URL suggests the intended post concerns Datadog’s AWS Lambda extension and Rust, but no technical details are included. ## Datadog’s Observability Platform Recognition - Datadog promotes its recognition as a Gartner Magic Quadrant Leader. - The surrounding navigation highlights products for: - Infrastructure and cloud monitoring - Application performance monitoring - Logs and data observability - Security - Digital experience monitoring - Software delivery - Service management - AI and platform capabilities ## Referenced Lambda and Rust Article - The navigation links to an engineering post titled around the Datadog Lambda Extension and Rust. - However, the supplied content contains no explanation of: - Why Rust was selected - The extension’s architecture - Performance or resource improvements - Deployment and compatibility considerations The article body is needed for a substantive technical summary.

Read original(opens in new tab)
datadog1 min readCurated summary

Achieving relentless Kafka reliability at scale with the Streaming Platform | Datadog

The provided content does not include the blog post itself. It contains Datadog’s navigation menu and a promotional link, including a URL suggesting an article about building a Kafka streaming platform with custom abstractions, but no article text or technical sections to summarize. Please provide the full blog post content for an accurate summary.

Read original(opens in new tab)
datadog1 min readCurated summary

Husky: Efficient compaction at Datadog scale | Datadog

The provided content does not include the blog post itself. It contains Datadog’s navigation links and a reference to an article at `/blog/engineering/husky-storage-compaction/`, but no substantive text about Husky or storage compaction. ## Available Information - The article appears to be an engineering post about **Husky storage compaction**. - The surrounding site navigation lists Datadog products across infrastructure, applications, data, logs, security, and AI. - No technical details, arguments, implementation choices, or conclusions from the article are present. Please provide the article’s body text or a complete excerpt for an accurate summary.

Read original(opens in new tab)
datadog1 min readCurated summary

How we use formal modeling, lightweight simulations, and chaos testing to design reliable distributed systems | Datadog

The provided content does not include the blog post itself. It contains Datadog’s navigation menu and a link titled “Formal Modeling and Simulation,” but no article text or technical explanation to summarize. ## Available Information - Datadog promotes its observability platform across: - Infrastructure and application monitoring - Logs, databases, and data pipelines - Security - Digital experience monitoring - Software delivery and service management - AI-powered observability - The page also advertises Datadog’s recognition as a Leader in the Gartner Magic Quadrant for Observability Platforms. - The linked engineering article appears to concern formal modeling and simulation, but its subject, methods, and conclusions are not included. ## Conclusion Please provide the blog post’s full text or the relevant article content to receive an accurate technical summary.

Read original(opens in new tab)
figma2 min readCurated summary

The Search for Speed in Figma | Figma Blog

Figma’s search investigation revealed that OpenSearch itself was responsible for less than 30% of total search latency. The larger costs came from query construction and especially permission checks before and after searches. By measuring the correct end-to-end metrics, Figma identified misleading monitoring data and established a foundation for improving search performance at scale. ## Diagnosing the Latency Gap - Figma migrated from an older Elasticsearch version to AWS-managed OpenSearch, a fork created after Elasticsearch’s 2021 license change. - OpenSearch reported an average search time of roughly **8 ms**, while Figma’s API showed: - About **150 ms average latency** - **200–400 ms** latency at the 99th percentile - Minimum latency above **40 ms** - Search performance also varied significantly depending on traffic levels, with peak periods much slower than weekends. - Additional instrumentation showed that substantial time was spent both before and after the OpenSearch request. ## Understanding OpenSearch’s Metrics - OpenSearch distributes a query through a coordinator node to worker nodes, typically sending one request per index shard. - It then gathers, sorts, and fetches results during the query and fetch phases. - The reported 8 ms metric measured only the average time for individual shard queries—not the total time required to coordinate hundreds of shard requests. - Figma’s queries could involve as many as **500 shard-level requests**, many of which ran in parallel but not all. - OpenSearch did not provide built-in metrics or logs for overall query duration. - Figma instead extracted the `took` value from each search response, producing a backend latency measure that aligned more closely with application-level timing. ## Permission Processing as the Main Bottleneck - Less than 30% of total query API time was spent waiting for OpenSearch. - Pre-processing: - Retrieved information about files the user could access. - Built an OpenSearch filter intended to exclude inaccessible files. - Post-processing: - Performed additional permission checks on every returned file. - Was especially slow and consumed more time than the search itself. - The investigation demonstrated that optimizing the search engine alone would not solve Figma’s overall latency problem. Figma’s experience highlights the importance of measuring end-to-end request latency rather than relying on subsystem metrics. Accurate coordinator-level and application-level instrumentation is essential, particularly when distributed searches involve many shards and expensive authorization work.

Read original(opens in new tab)
datadog1 min readCurated summary

How we optimized LLM use for cost, quality, and safety to facilitate writing postmortems | Datadog

The provided content does not include the blog post itself; it consists primarily of Datadog’s navigation menu and a promotional banner announcing its Gartner recognition. As a result, the article’s argument, technical details, and conclusion cannot be reliably summarized. ## Visible Page Content ### Datadog’s Gartner Recognition - Datadog promotes being named a **Leader in the Gartner Magic Quadrant for Observability Platforms**. - The linked resource appears to concern the **2026** observability-platform evaluation. ### Datadog Product Areas - Infrastructure and application monitoring - Logs, metrics, databases, and data pipelines - Security and cloud protection - Real user monitoring and digital experience - CI/CD and software delivery - Incident response and service management - AI capabilities, including Bits AI, agent observability, and GPU monitoring ### Article Reference - The URL path indicates an article titled **“LLMs for Postmortems.”** - However, no article text or sections about large language models, incident analysis, or postmortem generation are included in the supplied content. Please provide the full article body for an accurate summary.

Read original(opens in new tab)
datadog3 min readCurated summary

Timeseries indexing at scale | Datadog

Datadog’s “Time Series Indexing at Scale” explains how an observability platform can index and query enormous numbers of time series without making tag-based searches prohibitively expensive. The central challenge is matching flexible combinations of metric names and tags while keeping ingestion, storage, and query latency predictable. The article presents indexing strategies and architectural trade-offs that allow Datadog to support high-cardinality telemetry at scale. ## The Challenge of Time-Series Indexing - A time series is identified not only by its metric name but also by its complete set of tags. - Modern monitoring systems may contain billions of series generated by containers, hosts, services, and dynamic infrastructure. - Queries often filter on multiple tags, requiring the system to efficiently find the intersection of several large sets of series. - Indexing must support both: - Fast writes as new series appear - Low-latency reads for interactive dashboards and alerts - High-cardinality tags make naïve database indexes expensive in both storage and query processing. ## Inverted Indexes for Tags - Datadog uses an inverted-index model that maps searchable terms—such as metric names and tag values—to the series containing them. - A query can retrieve the posting list for each term and intersect those lists rather than scanning every time series. - Common terms may correspond to very large lists, so the system must optimize how these lists are stored, compressed, and combined. - The index separates metadata used to identify series from the time-series values stored for those series. ## Distributed Indexing - Index data is partitioned across machines so that no single node must hold or process the entire dataset. - Sharding enables horizontal scaling as the number of metrics, tags, and customers grows. - Query coordination gathers results from multiple shards and combines them into a single response. - The design must balance: - Even distribution of index data - Avoidance of hot shards - Efficient fan-out during queries - Resilience when individual nodes fail ## Managing Index Growth and Cardinality - Dynamic environments continuously create and remove series, making index lifecycle management essential. - Datadog must handle churn caused by short-lived containers, deployments, and changing tag values. - Compression and compact data structures reduce the memory and storage required for posting lists. - The system distinguishes between frequently queried data and less-used data to control resource consumption. - Cardinality limits and indexing policies help prevent unusually large tag dimensions from overwhelming the system. ## Query Performance and Trade-offs - Indexing every possible attribute would improve search flexibility but increase write, storage, and maintenance costs. - The platform therefore makes trade-offs between indexing coverage, freshness, and query speed. - Query execution can combine index filtering with additional processing over the remaining candidate series. - Caching and reuse of intermediate results can reduce repeated work for common queries. - The architecture is designed to maintain predictable latency even as data volume and query complexity increase. ## Operational Considerations - Large-scale indexing requires monitoring the index itself, including shard balance, ingestion lag, memory usage, and query fan-out. - Background processes must compact, expire, and rebalance index data without disrupting active queries. - Fault tolerance is important because an index outage can affect dashboards and alerts even when the underlying metric data remains available. - Separating indexing from time-series storage allows each subsystem to scale and evolve independently. Datadog’s approach illustrates that scalable observability depends as much on metadata indexing as on storing metric values. Systems handling high-cardinality telemetry should use distributed inverted indexes, compact representations, careful lifecycle management, and explicit trade-offs between flexibility and operational cost.

Read original(opens in new tab)
datadog2 min readCurated summary

How we migrated our static analyzer from Java to Rust | Datadog

Datadog migrated its static code analyzer from Java to Rust to improve performance, resource usage, and operational reliability. The rewrite addressed limitations that became increasingly significant as the analyzer processed larger codebases and ran more analyses in parallel. Rather than replacing everything at once, the team preserved existing behavior and introduced the Rust implementation incrementally. ## Why Move from Java to Rust - Static analysis is computationally intensive and often runs across many files simultaneously. - The Java implementation introduced overhead from: - Garbage collection - High memory consumption - Startup and deployment costs - Difficulty achieving predictable performance under heavy workloads - Rust offered: - Native performance - More predictable memory usage - Lightweight binaries - Safe concurrency without a garbage collector ## Preserving Analyzer Behavior - The primary challenge was maintaining compatibility with the existing analyzer and its rules. - The migration had to preserve: - Parsing behavior - Finding locations and diagnostic messages - Rule semantics - Output formats consumed by Datadog’s products and integrations - The team treated the existing implementation as the behavioral reference while rebuilding internal components in Rust. ## Incremental Migration Strategy - Datadog avoided a risky “big bang” rewrite. - Functionality was migrated in stages, allowing the team to: - Compare Java and Rust results - Detect behavioral differences - Benchmark performance - Roll back or isolate problematic changes - Parallel validation helped ensure that improvements in speed did not produce inconsistent security findings. ## Engineering Trade-offs - Rust improved control over memory and execution, but introduced a steeper learning curve and more explicit systems-level design. - The team had to redesign interfaces between components rather than mechanically translate Java code. - Particular attention was required for: - Error handling - Concurrency - Cross-platform builds - Dependency management - Observability and debugging ## Results and Lessons - The Rust implementation provided a stronger foundation for scaling static analysis workloads. - More predictable resource usage makes it easier to run analyses reliably in CI and other automated environments. - The migration demonstrated that large infrastructure rewrites are most manageable when correctness is continuously checked against the existing system. The practical recommendation is to approach similar rewrites incrementally: define compatibility requirements first, compare old and new implementations continuously, and use measured performance and resource data—not language preference alone—to guide the migration.

Read original(opens in new tab)
datadog2 min readCurated summary

Engineering VP spotlight: Ivo Dimitrov | Datadog

Datadog announces that Gartner named it a Leader in the 2026 Magic Quadrant for Observability Platforms. The supplied content primarily consists of the announcement link and Datadog’s product navigation, so it does not provide Gartner’s evaluation details or the reasoning behind the placement. It does show the breadth of Datadog’s unified observability, security, software delivery, and AI platform. ## Gartner Recognition - Datadog is identified as a “Leader” in Gartner’s Magic Quadrant for Observability Platforms 2026. - The linked resource appears to contain the full announcement and Gartner report, but its substantive text is not included here. ## Broad Observability Platform - **Infrastructure:** Infrastructure, container, Kubernetes, network, serverless, GPU, storage, and cloud cost monitoring. - **Applications and data:** APM, universal service monitoring, profiling, dynamic instrumentation, database monitoring, data streams, jobs, and quality monitoring. - **Logs:** Log Management, Sensitive Data Scanner, Audit Trail, and Observability Pipelines. - **Digital experience:** Browser and mobile RUM, session replay, product analytics, synthetic monitoring, mobile testing, and error tracking. ## Security and Software Delivery - Security offerings include code security, SAST, SCA, cloud security, SIEM, workload protection, vulnerability management, compliance, and application/API protection. - Software delivery tools cover CI visibility, test optimization, continuous testing, code coverage, feature flags, IDE plugins, and internal developer portals. - Service-management capabilities include incident response, event management, SLOs, case management, workflow automation, and service catalogs. ## AI and Platform Capabilities - Datadog highlights AI features such as Bits AI agents, investigation tools, AI integrations, MCP Server, and agent observability. - Platform features include dashboards, alerts, notebooks, Watchdog, access control, governance, fleet automation, and mobile access. Datadog’s positioning is as a consolidated platform spanning telemetry, application and infrastructure monitoring, security, developer workflows, and AI operations. For the specific Gartner assessment, readers would need to consult the linked announcement or report.

Read original(opens in new tab)
datadog1 min readCurated summary

.NET Continuous Profiler: Memory usage | Datadog

Datadog is presented as a Leader in the 2026 Gartner® Magic Quadrant™ for Observability Platforms. However, the provided content contains only the announcement headline, link, and website navigation; it does not include the blog post’s analysis, criteria, or supporting details. ## Announcement - Datadog’s headline claim is recognition as a “Leader” in Gartner’s 2026 Magic Quadrant for Observability Platforms. - The linked page appears to be a Datadog resource or announcement page. ## Available Product Scope The navigation indicates that Datadog’s observability platform spans: - Infrastructure monitoring, metrics, containers, Kubernetes, networks, serverless systems, and cloud costs - Application performance monitoring, profiling, and dynamic instrumentation - Logs, databases, data pipelines, and data quality - Security monitoring and cloud security - Real user monitoring, synthetic monitoring, session replay, and error tracking - CI/CD visibility, testing, developer portals, and software delivery - Incident management, service catalogs, SLOs, workflow automation, and AI-powered investigation Because the actual article text is missing, no further claims about Gartner’s evaluation or Datadog’s strengths can be reliably summarized.

Read original(opens in new tab)
datadog1 min readCurated summary

How we built the Datadog heatmap to visualize distributions over time at arbitrary scale | Datadog

The supplied content does not include the blog post itself; it mainly contains Datadog’s navigation menu and a promotional link announcing its Gartner recognition. The only identifiable article reference is a post about building Datadog’s heatmap for visualizing distributions over time at arbitrary scale, but its body text is missing. ## Available Content - Datadog is promoting its recognition as a Leader in the Gartner® Magic Quadrant™ for Observability Platforms. - The navigation lists Datadog products across: - Infrastructure and application monitoring - Logs, databases, and data observability - Security - Digital experience monitoring - Software delivery - Incident and service management - AI and platform capabilities - The referenced engineering post appears to discuss: - A heatmap visualization - Distributions over time - Scaling to arbitrary data volumes A meaningful technical summary would require the actual article text, which is not present in the supplied content.

Read original(opens in new tab)
datadog1 min readCurated summary

How we brought Datadog's data visualization to iOS: A focus on performance | Datadog

The provided content does not include the blog post’s actual article text. It contains Datadog’s navigation menu, product links, and a reference to an engineering post about bringing Datadog data visualization to iOS performance, so its technical argument and conclusion cannot be reliably summarized. ## Available Content - Datadog promotes its recognition as a Leader in the Gartner Magic Quadrant for Observability Platforms. - The navigation lists products across: - Infrastructure and application monitoring - Logs, databases, and data observability - Security - Digital experience monitoring - Software delivery - Service management - AI and platform capabilities - The referenced engineering URL suggests a post focused on implementing Datadog data visualization for iOS performance monitoring, but no implementation details are provided. Please provide the article body or a readable extraction of the post for a substantive technical summary.

Read original(opens in new tab)