There was a LOT to love in Datadog's S-1 and in their first quarterly report backing it up. I've been looking into them the past week, and here is my writeup on what Datadog does for a living. After I did about half this research, I took a 8% position [for me, a serious start... what I did with Okta and Alteryx a year ago]. If they keep up the hypergrowth, or announce some kind of differentiating product enhancement or ML breakthrough, I will ramp up from there. But I also think this is going to be a volatile one; there will be future FUD moments to buy into.

Datadog Overview

Datadog is a SaaS-based infrastructure & full-stack monitoring company that processes billions of data points daily. Customers utilize their system to process and analyze metrics & events from their infrastructure and the applications and services that run upon it.

Alexis Lê-Quôc (CTO) and Olivier Pomel (CEO) founded Datadog in 2010 in NYC, with a mission to break down silos between development and IT operations. The founders both worked for an edu-tech startup (ultimately bought out by News Corp), where Alexis lead IT/Ops, while Olivier lead development. They left to form Datadog, creating a SaaS tool highly focused on the tight partnership needed between those teams.

Their original platform monitored on-premise infrastructure, which was soon expanded into VMs, containers and cloud infrastructure in 2012. Over the past few years, they have expanded their core monitoring platform into new markets -- in 2017, they added full-stack APM, log management & analysis in 2018, and network performance in 2019. The expansion of their platform over the past 9 years has lead up to them providing what is called the "3 pillars of observability" (something Elastic also stresses). This means their platform can ultimately cover and analyze every dimension that software development teams want to watch in order to monitor their software stack and its usage.

3 pillars of Observability:

Infrastructure monitoring (System Metrics, Data Engines, Network Traffic, Containers, Serverless)
Log Management (Service Monitoring, Custom Triggers and Events)
APM (Application Performance Monitoring)

These various views come together like Voltron - they become stronger together. When you intermix these services, it gives full visibility over your entire stack. An error can be traced back across distributed systems, issues can discovered faster & easier, with alerts generated so responses can be automated. Discovering and researching issues is much easier when the team can see the real-time metrics and historical logs from every system, database engine, API, microservice, and front-end web or mobile application, plus the networking flows between them. You can narrow down problem areas rapidly when you have the COMPLETE 360 DEGREE VIEW of everything across your stack.

All of Datadog's product line co-exist in the same core dataset and dashboards, so you can overlay any and all of it (real-time app metrics over log data over system metrics). This promotes customers to explore other services in the product line, to enhance their existing usage of the platform. They recently reported 50% of customers use 2 or more products (+3500bps YoY, +1000bps seq). And more products will come - R&D spend is 28% of revenue.

"Today, we are the monitoring and analytics platform for dev, ops and business users. We provide clarity and actionable insights into software applications and IT infrastructure all in real time. We exist so that our customers can understand everything that happens in their technology stack; enabling them to deliver greater innovation, provide an exceptional user experience and achieve faster resolution of performance issues." - CEO on Q2 CC

Observability has been a success, and the market is booming. The "app economy" and cloud-computing has really driven monitoring into a vital need for any company with infrastructure and software services. And new development trends are helping drive growth from here, as they are massively scaling up these needs:

Containers
Microservices
Serverless computing

Datadog now has >1200 employees, with 31% of those spread across 24 countries (half of which is the R&D center in France). After hitting 5k customers in 2017, they started an annual user conference, DASH, in 2018. Datadog services require an easy-to-install agent - so easy that Datadog does not need a Pro Services dept to help customers integrate Datadog into their systems and processes.

Datadog is a dream tool for software development teams to utilize, allowing developers and IT to easily monitor their entire stack (metrics, services, logs), plus all the networking flows over it. One capability that Datadog is capable of (over traditional IT-focused infrastructure monitoring systems), is that their dashboards can be utilized and tailored to a wide swath of concerned users across multiple departments within each enterprise. Any interested party can have their own tailored dashboard over the core services... developers want to see app traffic, API usage & performance, and error notices; IT wants to see system performance metrics, and network flows; product mgmt wants to see app usage stats, and user decisions; top mgmt wants to see a view over all of it. Datadog, along with top competitors like Dynatrace and New Relic, can provide a unified and real-time view into a company’s entire technology stack.

Then, add in ML/AI capabilities, to start finding problems in your stack before they find you. There is a new moniker for what ML is enabling for infrastructure monitoring - AIOps. These features are driving further stickiness here, making their platforms more and more indispensable... and it seems like what ML/AI can bring is just getting started. There is a major focus on it across these SaaS providers, but it's at a point where everyone is doing it (at least per their marketing).

Like our database-oriented open-source centric SaaS companies, Datadog has a heavy focus on helping software developers. It publishes monitoring integrations with every major database and backend service, so it can be used to monitor Elasticsearch and MongoDB clusters along with a wide variety of server-side engines. Datadog boasts 350 integrations across all the server side systems and major cloud providers, plus into developer support tools like Github, Jira and ServiceNow.

All these features combine and make these SaaS monitoring services be game changers. The customers are coming in steadily, and spending more and more as they grow. Datadog and their top SaaS competitors have a serious leg up over the cloud providers' native solutions, as those are only capable of monitoring their own cloud platform. Datadog provides a VENDOR NEUTRAL way to go, and monitoring ALL systems IS A MUST across any layout (on-premise, cloud, or cloud-hybrid). Looking through their AWS-focused integrations alone, I count 77 of them -- they integrate with EVERY DAMN AWS SERVICE in order to allow monitoring over workflows across *any* AWS service you may be utilizing. Impressive. (New Relic also has a sizable number of integrations at 277, with 38 of them specific to AWS. Dynatrace only shows a small subset of their integrations, so unknown how many they have.)

Product Line

Platform Features

https://www.datadoghq.com/product/

Integrations: See across systems, apps, and services
APM: Get full visibility into modern applications
Logs: Analyze and explore log data in context
Synthetics: Proactively monitor your user experience
Network: Visualize traffic flow in cloud-native environments
Dashboards: Build real-time interactive dashboards
Collaboration: Share what you saw, write what you did (highlight and annotate events, discuss issues inline in the dashboard)
Alerts: Get alerted on critical issues (receive alerts, build alert logic to trigger conditions, ties to communication tools like PagerDuty, Slack)

New Pivots

Last 18mo, they have added a huge number enhancements to the platform:

New feature July 2018: Watchdog anomaly detection in APM via ML, to automatically detect issues without needing pre-specified alerts.
New product March 2019: Synthetic testing for simulating user requests for web apps and APIs.
New product July 2019: Serverless Function monitoring on AWS Lambda.
New product July 2019: Browser Log monitoring for front-end web apps.
New product July 2019: Network Performance Monitoring for visualizing network flows.
New product July 2019: Real User Monitoring (RUM) for viewing real-world use for front-end or mobile apps, and seeing your app through your customer's eyes.
Product expansion July 2019: Watchdog expanded into infrastructure and metrics (beyond just APM). This means they are using ML/AI detection over all their platform now, not just limited to APM.
New feature July 2019: Metric Correlation feature allows user to focus on an event, and ML/AI will find other metrics exhibiting similar patterns (to find correlations across systems, isolate cause vs effect, or to better understand errors across distributed systems).
New product Nov 2019: Security Monitoring means Datadog has gone full SIEM! Just as developers and IT can research, highlight, annotate and collaborate over events -- now cybersecurity staff can do the same for real-time threat detection. Ties into auth providers like Okta, and SECaaS providers for EPP like Carbon Black and Immunio. This is an exciting new direction that bridges infrastructure monitoring with cybersecurity. https://www.datadoghq.com/blog/announcing-security-monitoring/

Pricing

https://www.datadoghq.com/pricing/

Infrastructure Monitoring

Real-time monitoring of any server, service or platform.

Free Tier ($0/host/mo): on up to 5 hosts, w/ 1 day retention
Pro Tier ($18/host/mo or $15 if billed annually): utilize monitoring across their 350 integrations, w/ 15mo retention, allowing up to 10 containers and up to 100 custom metrics per host
Enterprise ($27/host/mo, or $23 if billed annually, requires 100 host minimum): ... adds Watchdog (ML alerts), Anomaly Detection, Forecast Monitoring, Live Process Monitoring, Adv Admin tools, and premium phone support, allowing up to 20 containers and up to 200 custom metrics per host
Serverless functions: $5/func/mo

Log Management

Automate ingest to explore and analyze logs from all services, applications and platforms.

Prices are per month per million log events processed

7 day retention ($1.91/mo or $1.27 if billed annually)
15 day retention ($2.55/mo or $1.70 if billed annually)
30 day retention ($3.75/mo or $2.50 if billed annually)

APM

Full visibility into your application stack, via embedded libraries that transmit real-time metrics out of your apps.

APM & Distributed Tracing ($36/host/mo or $31 if billed annually): monitor, troubleshoot, and optimize application performance over full-stack (backend, APIs, microservices, frontend); auto-maps service layout
App Analytics ($2.55/mo or $1.70, per million analysis spans): ML add-on w/ 15 day retention

Network Monitoring

Identify problem areas and bottlenecks by pinpointing under-performance across your stack's intercommunication.

$7.20/host/mo or $5 if billed annually

Synthetics

Proactive testing across entire application stack - API endpoints, microservices, or front-end applications.

API Tests ($7.20/mo or $5 if billed annually, per 10k tests): validate endpoints via automated scripted test runs, monitor SLAs
Browser Tests ($18/mo or $12 if billed annually, per 1k tests): code-free UI to record web app actions and replay them in testing

Real User Monitoring

Track all user sessions. Capture user experience metrics from your front-end applications, to see through customer's eyes. Allows for researching what occurred during specific user sessions.

$21.60/mo or $15 if billed annually, per 10k sessions

Datadog Customers

Twitter, PagerDuty, Evernote, AirBnb, Peloton, Sonos, Whole Foods, Dreamworks, Alamo, AARP, Ubisoft, WaPo, Bose, Comcast, FedEx, Medium, Nikon, Samsung, Activision, Nasdaq, FICO, Conde Nast, and many others

Competition

Landscape

Gartner reviews - Infrastructure Monitoring
Gartner reviews - APM
Gartner MQ - APM (Datadog didn't make the cut somehow, nor Elastic or Splunk)
Forrester Wave - Intelligent App & Service Monitoring Q219 PDF

Major Competitors

Dynatrace (DT)
New Relic (NEWR)
Splunk (SPLK)
Elastic (ESTC) with their DIY monitoring stack
AppDynamics, acq by Cisco (CSCO) in 2017
Cloud Providers themselves (AWS, Azure, GCP)

The top competitors are New Relic and Dynatrace. Last I checked in with New Relic, they were top dog in APM, and had just acquired SignifAI to add a slug of ML/AI features. But since then, New Relic has held steady at mid-to-low 30%s rev growth over past year (now dipping to 27%), while Datadog is over twice that! Dynatrace, who IPO'd on 8/1/19, is a very similar competitor, and is also heavily touting ML. One unique feature they tout over the others is a "zero-touch configuration" agent that auto-determines services used - so it recognizes you are running MySQL on the server and sets up the agent for you, instead of having to configure each service yourself.

I cannot tell what distinguishes Datadog's product line from these top competitors, and the prices are all pretty similiar to each other. One question is - why is Datadog getting glowing reviews and a top-3 customer rating for APM (4.5 stars vs the leaders at 4.6 stars) on Gartner, but isn't making the Magic Quadrant? Dynatrace and New Relic are in "Leader Quadrant" and getting "Customer Choice 2019" accolades. There are many current winners in this space, but Datadog seems to be in 3rd place according to Gartner customer reviews page. Unlike Gartner, Forrester Research rated Datadog as top leader in their APM category in Q219, with strongest strategy. I expect Datadog to show up in the next Gartner MQ, and in Leader quadrant at that.

Ultimately quibbling on ranking of these top 3 doesn't matter. Being leader doesn't always translate to being the best investment. Nor does having the best product. [See Infinera INFN.] On their latest earnings call, CEO agreed with an analyst's sentiment that the market for APM alone is only 5% penetrated (I haven't been able to verify). There is a LOT of market for these top players to capture from here.

Latest Q numbers:

NEWR: Rev 146M +27%, $NER 112% (-1200bps), Custs >100K 906 +15%, Gross Margin 83%, Market cap $4B.
DT: Rev 129M +27%, ARR +44%, Sub Rev +35%, Custs on new platform 1828 +100%, $NER >120%, Gross Margin 69%, Market cap $7B. [FYI 42% of that customer growth is from custs on their old platform ("Classic") migrating.]
SPLK: Rev 626M +30%, Software Rev 454M +40%, Cloud Rev 80M +78%, Custs 19k, Gross Margin 86%, Market cap $23B.
ESTC: Rev 101M +63%, Sub Rev 91.7M +61%, SaaS Rev +114% (all CCURR), Custs >100K 525 +11%, $NER >130%, Gross Margin 72%, Market cap $5B.
DDOG: Rev 96M +88% (and accelerating), $NER >130%, Custs 9500 +34%, Custs >100K 793 +93%, Gross Margin 76%, Market cap $10.6B.

Datadog is CLEARLY doing something very right, with its customers looking quite happy per the reviews. Whether they have the better product is not something we can tell - it's an opinion. It's the hypergrowth that is telling us something - customers are heading to and spending more at the one they feel is best at this service for THEIR needs, and is easing their burden at maintaining all these systems. It's likely saving costs on IT staffing alone in having to maintain systems. Quite simply, this is a vital service that makes a lot of companies able to operate their software products and services. Banks, brokerages, gaming, hotels, social media, retailers -- these companies all have web apps and mobile apps and B2B services that need to be operated and maintained and MONITORED [and secured - but for that see my Flavors of Security posts].

Final Thoughts

I'm starting DDOG as a 2nd tier holding, as I think this company will ultimately hit a wall at some point as the hypergrowth wanes and they slow down to New Relic and Dynatrace levels. But I plan on riding it a long while until that starts to occur. I ultimately feel the same about CrowdStrike - but I see Datadog having way more optionality going forward, so see it as a stronger bet and have set percentages accordingly. [CrowdStrike 4%, Datadog 8%.]

Ultimately I see Datadog as "Elastic, if it could focus solely on being a monitoring SaaS service". Funnily enough, under the hood Datadog makes heavy use of Elasticsearch. Yet it is knocking it out of the park as a SaaS provider of what Elastic offers as DIY. Unlike Elastic, however, Datadog is right at the profit turning point (adj op income just swung pos, adj EPS is $0). But don't count out Elastic just yet - they allow companies to "do it yourself" at a cheaper price, and has become a contender in this space.

An Elastic aside -- if you remember from my cybersecurity writeup on them, Elastic had a disadvantage compared to other SaaS cybersecurity providers, in that it leaves each customer as its own "island" of data where SaaS providers get a complete global view of security. However, in infrastructure/APM monitoring, the one advantage SaaS solutions have over Elastic Stack is simplicity, and their major con is ultimately cost, especially as the infrastructure scales up. So Elastic has a big place in the observability market... but there is no denying that Datadog has been incredibly successful in making a SaaS service around what is a major focus of their own -- monitoring. And given that Datadog has got higher growth rates at the same revenue level, it has a earned a higher percentage in my port.

Like CrowdStrike in Endpoint Protection, they have a lot of top contenders in their market, with many of them doing well. However, both CrowdStrike and Datadog stand out from their immediate competition with their hypergrowth. What is distinguishing these companies over their respective competition? Execution! Both are in highly competitive markets where product lines & feature sets are all similar. R&D can result in new product ideas, but competitors will likely do the same, and each will copy the good ideas from the others. Both monitoring and cybersecurity markets are swelling with the proliferation of cloud and cloud-hybrid infrastructure, and the overall "app economy" that is driving a lot of success right now across the top SaaS providers. Because of the blur between competitors as the services become commodities with low switching costs, I rate these markets and companies a tier lower than I rate my top tier [like OKTA and AYX] that clearly stand above the competition (as in, don't really have any).

I do see these monitoring platforms as sticky. It's easy to switch platforms and installed agents, but there won't be much incentive for customers to leave if the platform is giving them vision and enough success to make the cost worth it. New features with AIOps and ML routines are allowing for automated alerts & responses after finding problems in your stack -- which seems like just the beginning of where ML and automation could go. There is a land-rush here driven by the reality and difficulty of making software, and the top SaaS providers are all having success. Datadog in observability [monitoring], like CrowdStrike in endpoint protection [cybersecurity], is having THE MOST success, as seen in their hypergrowth while the competition lags at (still respectable) 30-40% level of growth.

I am content not knowing what exactly distinguishes Datadog's platform over the competition. All are cloud SaaS providers with infinite scale (important as they add additional ML compute capabilities, and have to grow storage as they on-ramp more and more customers). All have integrations into a wide variety of services to monitor - Datadog with the most. One exciting new direction for Datadog's platform is Security Monitoring, as it neatly adds cybersecurity features over the same monitoring platform that developers and IT/Ops utilize.

For now, I will let the hypergrowth speak for itself. Datadog is growing OVER TWICE AS FAST as both New Relic and Dynatrace. Both of them have more revenue, but Datadog should soon surpass both of them within the next year. At that time, it will be worth more than them, and more than it is today.

A Datadog technical review

muji

muji

Datadog Overview

Product Line

Platform Features

New Pivots

Pricing

Infrastructure Monitoring

Log Management

APM

Network Monitoring

Synthetics

Real User Monitoring

Datadog Customers

Competition

Landscape

Major Competitors

Final Thoughts

Other Reading

-muji

Apple's new mixed reality headset

Flare Ups

A Snowflake deep dive

A Look at SaaS 2020

Flavors of Security - Elastic