For an engineering organization of roughly 250 engineers, the realistic choices narrow fairly quickly. The main question is less "can it collect logs, metrics, and traces?"—most modern platforms can—and more "can six platform engineers operate it without it becoming a full-time project?"

The strongest candidates are:

1. Grafana LGTM Stack (probably the safest recommendation)

The stack consists of:

• Grafana
• Loki
• Mimir
• Tempo
• Alloy

Advantages

• Very mature ecosystem.
• Native support for OpenTelemetry.
• Large community.
• Prometheus-compatible.
• Excellent dashboards.
• Good long-term roadmap.
• Storage can be inexpensive object storage instead of SSD-heavy clusters.

Operational complexity

For a platform team of six:

• Reasonable.
• Usually 0.5–1 FTE once deployed.
• Kubernetes support is excellent.

Weaknesses

The stack is modular rather than integrated.

You're operating several services instead of one application.

2. SigNoz

This has become one of the strongest "Datadog replacement" projects.

Architecture:

• OpenTelemetry-first
• ClickHouse storage
• Unified UI

Advantages:

• Single interface.
• Easier than assembling Grafana components.
• Good tracing experience.
• Good service maps.
• Fast queries.

Operational effort:

Lower than LGTM because fewer moving pieces.

Potential downside:

Smaller community than Grafana.

3. Elastic Stack

Historically the default choice.

Pros:

• Outstanding log search.
• Mature security model.
• Rich ecosystem.
• Excellent SIEM capabilities.

Cons:

• Resource intensive.
• JVM tuning.
• Elasticsearch clusters require expertise.
• Traces and metrics aren't as pleasant as dedicated observability products.

Many companies end up with at least one engineer who effectively becomes "the Elasticsearch person."

4. OpenObserve

This is newer but increasingly interesting.

Pros:

• Very efficient.
• Rust implementation.
• Uses object storage.
• Much lower hardware requirements.
• Unified platform.

Cons:

• Smaller community.
• Less operational history.
• Enterprise ecosystem is still growing.

5. OpenSearch

Good if your organization already runs OpenSearch.

Less compelling if you're starting from scratch specifically for observability.

Cost comparison

This is where self-hosting becomes attractive.

Assume roughly:

• 250 engineers
• 400–800 services
• 2–5 TB/day telemetry before retention
• 30-day hot retention

Approximate annual infrastructure and operating costs:

The exact numbers depend heavily on ingest volume, retention, and whether you already operate Kubernetes and object storage, but organizations with substantial telemetry often see significant savings after migrating from SaaS pricing to self-hosted infrastructure.

Hidden costs

The biggest expenses aren't compute.

They're:

• On-call support
• Upgrades
• Capacity planning
• Backups
• Disaster recovery
• Retention management
• Index optimization
• OpenTelemetry rollout

These operational tasks often dominate the ongoing effort.

SOC 2 considerations

For your auditors, the strongest story is often:

• Production telemetry never leaves company-controlled infrastructure.
• Storage is encrypted at rest.
• Transport is encrypted with TLS.
• RBAC integrated with your identity provider.
• Immutable audit logs for administrative actions.
• Retention policies aligned with compliance requirements.
• OpenTelemetry collectors deployed within your environment, forwarding only to internal endpoints.

That provides a clear control narrative around data residency and access.

What I'd choose

Given your constraints—a fintech scale-up, approximately 250 engineers, SOC 2 Type II, and a six-person platform team—I would lean toward one of these:

1. Grafana LGTM Stack if you want the most mature, widely adopted, and flexible open-source ecosystem. It's a strong long-term choice and scales well.
2. SigNoz if you prioritize operational simplicity and a more integrated "single product" experience with native support for logs, metrics, and traces.
3. Elastic Stack only if your organization already has significant Elasticsearch expertise or relies heavily on its search and security capabilities.

For a greenfield replacement of Datadog in 2026, the balance of maturity, community support, and operational overhead generally favors Grafana LGTM or SigNoz over building around Elasticsearch alone.

For a 250-engineer fintech with SOC 2 Type II requirements, the key question is not “what is the cheapest open-source stack?” It is “what can a six-person platform team run as a production-grade internal service with audit evidence, upgrades, backups, access controls, and incident response?”

The realistic shortlist is fairly small:

PlatformLogsMetricsTracesOperational fit for 6-person teamRelative cost vs DatadogGrafana LGTM StackGrafana LokiGrafana Mimir / PrometheusGrafana TempoBest overall fitInfrastructure cost only; usually 60–90% cheaper than Datadog at scale, but requires engineering ownershipElastic ObservabilityElasticsearch + KibanaElastic metricsElastic APMGood, but heavierOften cheaper than Datadog, especially with large log volumes, but storage/operations can be significantVictoriaMetrics + Loki + TempoLokiVictoriaMetricsTempoVery cost-efficientUsually lowest infrastructure costOpenSearch stackOpenSearch DashboardsPrometheus-compatibleJaeger-compatible optionsPossible, but more DIYLower license cost, higher engineering costSigNozClickHouse-backed logsClickHouse metricsOpenTelemetry tracesAttractive for smaller teamsLower cost, but less proven for large enterprise operations

My ranking for your situation

1. Grafana LGTM stack — likely the best replacement

Architecture:

Applications | OpenTelemetry Collector | +--> Loki (logs) +--> Mimir (metrics) +--> Tempo (traces) | Grafana UI

OpenTelemetry should become your collection layer so applications are not coupled to a vendor or backend.

Why it fits a fintech scale-up:

Pros

• Fully self-hostable.

• Strong Kubernetes support.

• Good multi-tenancy patterns.

• Native correlation between logs, metrics, and traces.

• Large ecosystem and hiring pool.

• Works well with object storage for retention.

Grafana Tempo is specifically designed as a scalable tracing backend and integrates with Grafana, Prometheus-compatible metrics, Loki, and OpenTelemetry. Grafana Labs

Cons

• You own reliability.

• Alerting, RBAC, SSO, upgrades, capacity planning, and backups become your responsibility.

• Loki is not a drop-in Elasticsearch replacement for arbitrary full-text log searching; teams must adopt structured logging.

For a six-person platform team, I would avoid running every component independently at first. Use a managed Kubernetes operator pattern, GitOps deployment, and standardize ingestion through OpenTelemetry.

2. Elastic Observability — strongest if logs are your hardest problem

Choose this if your compliance/audit requirements revolve around:

• forensic log search,

• retention policies,

• security investigations,

• SIEM-style workflows.

Advantages:

• Mature search.

• Excellent log exploration.

• Familiar to security teams.

Tradeoff:

• Elasticsearch operations are not trivial.

• Memory/storage requirements can become substantial.

3. VictoriaMetrics-based stack — best cost optimization

A common architecture:

OpenTelemetry Collector | +--> VictoriaMetrics | +--> Loki | +--> Tempo | Grafana

This can materially reduce infrastructure spend compared with large Prometheus deployments.

The downside is that you are assembling a platform rather than adopting a single product. Community discussions commonly compare LGTM and VictoriaMetrics-based stacks as the leading self-hosted patterns for logs/metrics/traces. Reddit

Total cost comparison

The comparison is not simply license cost.

Datadog

Datadog pricing scales through multiple dimensions: hosts, custom metrics, logs, indexed events, and other products. For example, Datadog publishes infrastructure pricing beginning around $15/host/month for Infrastructure Pro, with separate pricing dimensions for metrics and logs. Datadog

A rough enterprise example:

EnvironmentDatadog annual cost500 monitored hosts~$90k/year before many add-ons1,000 hosts~$180k/year+Large Kubernetes environment with APM/logging/securityOften several hundred thousand/year

(Actual cost depends heavily on ingestion volume and negotiated discounts.)

Self-hosted LGTM/VictoriaMetrics

Typical annual costs:

ComponentApproximate annual infrastructureKubernetes compute$30k–100kObject storage$5k–30kPersistent disks / databases$10k–50kPlatform team ownershipBiggest cost

The hidden cost is engineering time. A six-person team could easily spend:

• 1–2 engineers maintaining observability infrastructure,

• on-call ownership,

• upgrades,

• scaling,

• incident response.

A realistic TCO comparison:

OptionLicenseInfraPeople costOverallDatadogHighLowLow$$$$LGTMFreeMediumMedium