Customer value: Keep PromQL — and stop using scrape intervals and remote-write fan-out as your cost controls.
Prometheus admins stretch scrape intervals, stand up multiple remote-write endpoints, relabel every job, farm recording rules, run HA Prom + Thanos/Mimir, and shard by team — high ops tax, coarser data in incidents. Elastic Serverless is one managed remote-write / OTLP path: keep resolution, Drop noise at ingest, no sidecar TSDB. Then paste the same Explore expressions. (Bonus: one project instead of Prometheus + Loki + Tempo.)
15s → 60s scrapes · extra remote-write paths · relabel YAML · recording rules · shard the TSDB.
One remote-write / OTLP endpoint · Streams Drop · lifecycle — no Prom/Mimir compactors to run.
Paste into Discover / Metrics — Explore habit, Elastic backend, resolution you actually want.
Customer value: Familiar boards on Kibana — and a path to migrate a few real Grafana exports without a rewrite project.
Open Horizon — Grafana continuity, the sample board migrated with obs-migrate, then Horizon — Dashboard sprawl — which boards still query which indexes (Grafana folder sprawl).
Time series, stat, table → same story on the continuity board.
Sample: Prometheus Basics + PromQL alerts → Dashboards on live Horizon metrics.
Keep PromQL in Kibana rules (ES|QL PROMQL) — one project, no Alertmanager sidecar.
Grafana folder sprawl: Elastic inventories which dashboards still query which indexes, and alerts if a schema change would blank a widget.
Customer value: Same PromQL workloads — modeled ~33% lower than Grafana Cloud, plus one store instead of three.
On the Grafana stack worksheet, two reference points: 100k samples/sec @ 296B → Grafana Cloud ~$33K/mo (Elastic ~$22K/mo, ~33% lower); smaller Prometheus footprint → Grafana Cloud ~$3.1K/mo (Elastic ~$2.1K/mo, ~33% lower). In the lab: Drop /debug/pprof, open Horizon — Streams savings, then open the sheet with your samples/sec.
Modeled list-rate · ~33% lower than Grafana Cloud in pricing analysis · tco-calc.o11ybot.app/?scenario=grafana-stack · confirm with measured usage
Cut scrape/debug noise before ingest — keep resolution without starving scrapes to control Grafana Cloud billable series.
One observability store, one investigation query language, PromQL preserved — and ~33% lower than Grafana Cloud on modeled workloads.
Customer value: Keep PromQL for dashboards — but stop exporting host lists and trace IDs between Loki, Prometheus, and Tempo.
In a typical Grafana stack, logs, metrics, and traces sit in three stores with three query languages. ES|QL subqueries (WHERE field IN (subquery)) keep the intermediate cohort inside Elasticsearch — saturated hosts, erroring hosts, or 500 slow trace IDs never land in a clipboard. One query answers questions like “what did the saturated hosts log?” or “470 of 500 slow traces share the same lock wait.” (Observability Labs · Aug 2026)
PromQL chart → copy host names → LogQL → copy trace IDs → Tempo. Stale lists, manual joins, negative checks skipped.
Metrics → logs, logs → metrics, traces → logs, or all three nested — OTel fields kept on ingest, one time picker.
One ES|QL string anyone can re-run in Discover — not a join that lives in one engineer’s head during the incident.