Alternatives to ELK

I’ve probably mentioned it before, but one of the things I really like about open source is that there’s often an alternative choice available when it comes to choosing software. It allows ideas to evolve and things to improve over time (hopefully, anyway). Parts of the ELK stack can be replaced for example. Fluentd is an alternative to Logstash, written in Ruby (and handily has drivers available for Docker) which has a large installed user base (I work with some clients who call this arrangement a ‘FEK’ stack).

Graylog is an open source based company which uses Elasticsearch (and MongoDB) as part of its setup as well as its own alternatives for the ‘LK’ portions of the stack. Grafana can act as an alternative to Kibana (apparently – I haven’t tried it yet), which I’ve seen criticised online as being too heavyweight ( Kibana recently went up to a new version, which often causes ructions in the user base of course).

The 200 pound gorilla in this space though is Splunk, which isn’t open source - but does have free tiers available if you want to run small setups (the product is excellent in my experience - but extremely expensive). Other commercial SaaS alternatives are SumoLogic and Loggly. Be aware though that in some environments, having logs sent to a third party might not be a possibility (or might require a lot of safeguards are in place). If you’re evaluating these kinds of infrastructure, double-check to make sure you won’t run aground on any industry standards (such as PCI).