Elasticsearch, Logstash, Kibana and Beats: full-text indexing and search of logs with Kibana dashboards and alerting. Self-host the free distribution or buy Elastic Cloud.
Pricing and hosting
- Pricing
- Free plan
- Open source
- Yes (AGPL-3.0-only OR SSPL-1.0 OR Elastic-2.0)
- Self-hosted
- Yes
- Launched
- 2010
- Status
- Active
- Website
- elastic.co
Plans and prices change; check the tool's own site before you decide.
What it does
Log management checklist
9 of 10 confirmed in Elastic Stack (ELK)'s own documentation. The same checklist is used for every tool in Logs.
- Full-text search Yes
- Structured log parsing Yes
- OTLP logs ingest Yes
- Log alerts Yes
- Live tail Not confirmed
- Metrics from logs Yes
- Archive or tiered retention Yes
- Dashboards Yes
- Query language Yes
- Access control Yes
No live tail in current Kibana docs (the old Logs Stream view is not in the 9.x docs)
Checked against: elastic.co, elastic.co (2), elastic.co (3), elastic.co (4), elastic.co (5), elastic.co (6)
Dashboards and visualization checklist
5 of 8 confirmed in Elastic Stack (ELK)'s own documentation. The same checklist is used for every tool in Dashboards.
- Many data sources Not confirmed
- Prometheus source Not confirmed
- SQL sources Not confirmed
- Alerting Yes
- Template variables Yes
- Dashboards as code Yes
- Sharing Yes
- Annotations Yes
Kibana queries Elasticsearch only; as-code means saved-object NDJSON export/import
Checked against: elastic.co, elastic.co (2), elastic.co (3), elastic.co (4), elastic.co (5)
Alternatives to Elastic Stack (ELK)
Other log management tools. See all 25.
-
Axiom Hosted event store for logs, traces and other event data, queried with the APL language, with dashboards and monitors. Integrates with Vercel, Cloudflare and OpenTelemetry. -
Better Stack Telemetry Better Stack's log, metric and trace store built on ClickHouse, queried with SQL or a live-tail view. Shares an account with Better Stack uptime and on-call. -
Bugfender Remote logging for mobile and web apps: the SDK sends device logs to the cloud so you can read what happened on a user's device, with crash reports and user feedback. -
CrowdStrike Falcon LogScale Index-free log store (formerly Humio) that compresses and searches large log volumes quickly; sold by CrowdStrike for security and operations logging. -
Dozzle Small web UI that streams and searches live Docker container logs across hosts, with no log storage. Optional Dozzle Cloud adds grouped alerts and log analysis. -
Fluent Bit Lightweight C log and metrics processor from the Fluentd project, common as the node-level agent in Kubernetes. Ships to Loki, Elasticsearch, cloud logging and OTLP. -
Fluentd CNCF graduated log collector that reads, parses, buffers and forwards logs to hundreds of outputs through a plugin system. Written in Ruby and C. -
Grafana Loki Log aggregation system that indexes only labels, not full log text, and stores chunks in object storage. Queried with LogQL from Grafana; hosted as part of Grafana Cloud. -
Graylog Centralised log collection with parsing pipelines, stream routing, search and alert conditions. Graylog Open is free to self-host; paid editions add security analytics and archiving. -
lnav Terminal log file navigator that merges several log files into one timeline, highlights errors, and lets you query log lines with SQL. Runs locally, no server. -
Logflare Log ingestion and search backed by Google BigQuery, popular with Cloudflare Workers, Vercel and Elixir apps. Now part of Supabase and open source. -
Logz.io Hosted observability platform that grew out of managed ELK: log search and alerting on OpenSearch, plus metrics and traces. Priced per GB ingested.