Benchmarks: Azure Monitor Performance and Cost Comparison¶

Audience: Platform Engineers, SREs, Architects Last updated: 2026-04-30

Overview¶

This document provides empirical benchmarks comparing Azure Monitor's performance and cost characteristics against Datadog, New Relic, and Splunk Observability. All benchmarks represent typical enterprise workloads; your results will vary based on data volume, query complexity, and architecture.

1. Log query performance (KQL vs DQL vs NRQL vs SPL)¶

Test methodology¶

Queries were executed against 30 days of log data (~500 GB/day, 15 TB total) in each platform. Each query was run 10 times; results show median execution time.

Results: Common query patterns¶

Analysis¶

• Simple searches: Datadog is fastest for basic keyword searches due to its columnar indexing. KQL and NRQL are comparable. SPL is consistently slowest.
• Aggregations: KQL performs well at scale due to the underlying Azure Data Explorer engine. Performance degrades gracefully with time window expansion.
• Joins: KQL's join support is significantly more powerful than competitors. NRQL has limited join capabilities. SPL joins are possible but slow.
• Complex analytics: KQL excels at complex analytical queries (subqueries, multi-joins, statistical functions) due to its ADX heritage. This is where KQL's design as a true analytics language provides an advantage over query languages designed primarily for search.

Log query performance depends heavily on table size, indexing, query optimization, and workspace configuration. These benchmarks represent typical patterns; outlier queries will vary. Dedicated cluster workspaces generally perform faster than shared workspaces for heavy query loads.

2. Data ingestion rates¶

Ingestion throughput¶

Ingestion latency percentiles¶

Azure Monitor's ingestion latency is higher than Datadog's due to the additional processing in Data Collection Rules (transformations, routing). For use cases requiring sub-10-second log availability, Application Insights Live Metrics provides a real-time stream that bypasses the standard ingestion pipeline.

3. Alert evaluation latency¶

Analysis¶

• Metric alerts: Splunk Observability (SignalFx heritage) provides the fastest metric alert evaluation at 1-second granularity. Azure Monitor's minimum is 1 minute. For most operational use cases, 1-minute granularity is sufficient; for real-time trading or IoT alerting, the 1-second granularity gap is material.
• Log alerts: All platforms converge around 1-5 minute evaluation frequencies. Azure Monitor's 1-minute log alert frequency is competitive.
• Smart detection: All platforms provide background anomaly detection with comparable latency (minutes). Azure Monitor's Smart Detection is included at no additional cost; Datadog's Watchdog requires Enterprise tier; Splunk requires ITSI add-on.

4. Cost-per-GB comparison¶

Log ingestion cost (effective price per GB)¶

New Relic's per-GB data ingestion price (\(0.35/GB) appears significantly cheaper than Azure Monitor. However, New Relic charges per Full Platform User (\)549-$1,149/user/month), which must be added to the total cost. For an organization with 50 Full Platform Pro Users, the per-user cost alone is $689,400/year -- equivalent to ingesting approximately 1,970 TB at Azure Monitor's 500 GB/day commitment tier rate. Always compare total cost, not per-GB cost in isolation.

Basic logs cost optimization¶

Routing 50% of logs to Basic tier reduces effective cost by 27%. Most organizations can safely route debug logs, CDN access logs, and verbose infrastructure telemetry to Basic without impacting operational visibility.

5. Application Insights sampling impact¶

Sampling rate vs data accuracy¶

Recommended sampling configurations¶

Sampling overrides: Preserve critical telemetry¶

Always sample at 100% for:

• Exceptions -- every exception should be captured
• Failed requests (5xx status codes) -- every failure should be visible
• Slow requests (>5 second duration) -- tail latency matters

{
    "sampling": {
        "percentage": 20,
        "overrides": [
            { "telemetryType": "exception", "percentage": 100 },
            {
                "telemetryType": "request",
                "attributes": [
                    {
                        "key": "http.status_code",
                        "value": "5.*",
                        "matchType": "regexp"
                    }
                ],
                "percentage": 100
            },
            {
                "telemetryType": "request",
                "attributes": [
                    {
                        "key": "http.request.duration",
                        "value": "5000",
                        "matchType": "greaterThan"
                    }
                ],
                "percentage": 100
            }
        ]
    }
}

6. Retention cost comparison (1-year)¶

For organizations with compliance-driven retention requirements (FedRAMP, HIPAA, PCI-DSS).

Azure Monitor's archive tier (\(0.02/GB/month) provides a structural cost advantage for long-term log retention. At 500 GB/day over 7 years, the archive stores approximately 1.28 PB at ~\)25,600/month -- a fraction of the cost of keeping logs in active query tiers on any platform.

Key takeaways¶

1. Query performance: KQL is competitive for simple queries and excels at complex analytics (joins, subqueries, statistical functions). Datadog is fastest for simple keyword searches.
2. Ingestion latency: Azure Monitor's 30-90 second typical latency is adequate for operational monitoring. Live Metrics provides real-time telemetry for time-sensitive scenarios.
3. Alert evaluation: 1-minute minimum for metric alerts covers most use cases. Splunk Observability's 1-second evaluation is uniquely fast but rarely needed.
4. Cost efficiency: Azure Monitor is 60-75% cheaper than Datadog and Splunk at scale. New Relic's per-GB price is lower, but per-user costs dominate total spend.
5. Sampling: 25-50% sampling provides accurate aggregates with significant cost savings. Always override to 100% for exceptions and errors.
6. Long-term retention: Azure Monitor's archive tier is the most cost-effective option for multi-year compliance retention.

Related: TCO Analysis | Feature Mapping | Best Practices | Migration Playbook