Host

Overview

In Datadog, a host means a single instance of a physical or virtual operating system. Because it is counted not by the number of physical servers but by the number of running operating systems, one physical machine carrying 4 virtual machines is 4 hosts. The rows lined up on the Infrastructure Monitoring screens and the <code>host</code> tag automatically attached to metrics are both tied to this unit. Since it is not just a name but also the unit for counting usage, drawing up an estimate while leaving the definition of the word host vague is a cause of gaps between expectations and actuals.

What is counted is not the number of machines but the number of operating systems

As of August 2026, Datadog's official documentation defines a host as an instance of a physical or virtual operating system. The point to hold on to here is that the boundary lies at the OS, not the chassis. Running 4 virtual machines on one physical server makes 4 hosts, and conversely, consolidating onto one large machine with a single OS makes 1 host.

Thanks to this definition, the counting method can be kept consistent even in environments that mix on-premises and cloud. On the other hand, since it works in the direction of increasing the count the more layers of virtualization you add, your choice of architecture also affects how the monitoring side counts.

Counted every hour, dropping only the top 1% of spikes

Usage is tallied not once at month end but hourly. As of August 2026, the official documentation explains that Datadog records, every hour, the number of unique hosts being monitored by Infrastructure Monitoring. There are two methods for the monthly count. In the high-water mark method, the maximum value among the bottom 99% of the hourly values for that month is adopted. The top 1% of hours is cut off by this mechanism. In the other method, on top of the monthly minimum commitment, host hours exceeding it are added on an hourly basis. This counting method is a part that is easily misunderstood. Because an average is not adopted, a configuration that runs 10 hosts for most of the month and swells to 40 hosts for only a few dozen hours is counted at a value close to 40, not close to 10. Conversely, it is also important that the margin cut off is only the top 1%. Taking a month as roughly 720 hours, what can be dropped is limited to approximately 7 hours' worth. An operation that spins up hosts every night for a daily batch does not fit within this margin.

Containers and Fargate are counted outside of hosts

What comes into play as a design decision is that if you look only at hosts, you will misread the overall picture. According to the official documentation as of August 2026, containers are counted every 5 minutes and tallied monthly according to the hours of monitored containers. Fargate tasks are likewise measured at 5-minute intervals and tallied by the total time they were running and monitored. Both are separate lines from the counting of hosts. In other words, an architecture change that reduces the number of virtual machines and increases container density looks like a reduction if you look only at the host count, but the container-side tally goes up instead. When estimating monitoring usage, the practical way to proceed is to count hosts, containers, and serverless separately, and check for each configuration where to shift things so that the whole becomes lighter. Optimizing only one side and having the estimate miss happens when you change the architecture without knowing about this separation.

Host is also a reserved tag key

The word host not only refers to the unit of what is monitored; it also occupies a special position in the world of Datadog tags. In the list in the official documentation, host is named as a reserved tag key, and if you use it for a different meaning for your own convenience, the product-side linkage stops working. Furthermore, tags tied to a hostname are inherited by the telemetry sent from that host. This means that if you set the role or owning team once on the host side, the same marker rides along on the metrics and logs that host emits. Since it saves you the work of adding tags to each individual sender, it makes sense to place the starting point of your tag design on the host. It is worth remembering that the host unit doubles as both the thing that is counted and the thing that markers are attached to.

When to care, and the points that are easily misunderstood

The times to seriously verify the definition of a host are when estimating monitoring usage and when making major changes to the architecture. In day-to-day incident response, it is enough to treat a host as the name of a row lined up on the screen, but in estimating, a gap in definition becomes a gap in the numbers as it is. Three misunderstandings stand out. First, thinking of hosts as the number of physical servers. The definition is an OS instance, so the count increases by the amount you virtualize. Second, thinking that it is counted by the monthly average. In the high-water mark method, the maximum of the bottom 99% is taken, so even a brief surge leaves an upward bias. Third, thinking that containerizing will be absorbed within the counting of hosts. Containers and Fargate are tallied as separate lines. The primary source for the counting method is Datadog's official documentation Pricing. The tallying methods touched on here are based on the description as of August 2026, and the method that applies differs by the form of your contract. What becomes visible starting from hosts is summarized in the explainer "Infrastructure Monitoring".