The Elastic Stack (Elasticsearch, Logstash or Beats, and Kibana) is the reference for log search, and Elastic Security adds a capable SIEM on top. The reasons teams look for alternatives are consistent: running Elasticsearch well takes real skill (shards, heap, index lifecycle), storage for long retention is expensive on a search index, and on Elastic Cloud the bill grows with resources or ingest.
We compare alternatives on the things that decide the move: how much cluster work is left, how storage cost behaves at longer retention, whether security monitoring is included and where your data falls legally.
Why teams look for an Elastic alternative
- Cluster operations: shard sizing, JVM heap, index lifecycle policies and upgrades are a specialism.
- Storage cost: an inverted search index takes more disk than a compressed columnar store, which hurts at 90 days or more of retention.
- Cost predictability: Elastic Cloud charges by resources or usage, so growth in log volume shows up in the bill.
- Licensing history: the 2021 move away from Apache 2.0 (AGPL was added as an option in 2024) made some teams reconsider.
The alternatives
1. LogPulse
Managed log management and SIEM on ClickHouse, a columnar database that stores logs compressed with ZSTD and keeps every log searchable for the full retention, without hot and cold tiers. LPQL is a pipe-based query language, and the AI Investigator writes queries from questions in plain language. Security monitoring with over 690 Detection Hub rules is in every plan; pricing is flat per plan; data is hosted at Scaleway in Amsterdam.
Best for: Teams that want ELK-style search and a SIEM without running Elasticsearch.
2. OpenSearch
The Apache 2.0 fork of Elasticsearch and Kibana, now under the Linux Foundation, with a security analytics plugin. Familiar for ELK users, but the cluster work stays the same.
Best for: Teams that want to stay on an Elasticsearch-compatible engine with an open licence.
3. Graylog
Open-core log management with a commercial Security tier. Easier day-to-day log handling than raw ELK, but it still runs on a search cluster you operate.
Best for: Teams that want a friendlier self-hosted log UI.
4. Grafana Loki
Indexes labels instead of full text, which makes storage cheap and suits Kubernetes logs. Full-text search over large volumes is slower and there is no SIEM.
Best for: Operational logging next to Grafana dashboards.
5. Splunk
Powerful search and the most complete SIEM ecosystem, owned by Cisco since 2024. Typically the most expensive option at volume.
Best for: Enterprises with the budget and Splunk skills.
6. Microsoft Sentinel
Cloud SIEM on Azure with KQL. No cluster to run, but metered per GB plus retention and automation.
Best for: Organisations standardised on Microsoft security tooling.
Side-by-side comparison
| Alternative | Storage engine | Cluster to run? | SIEM included | Pricing model |
|---|---|---|---|---|
| LogPulse | ClickHouse (columnar) | No (managed) | Yes, every plan | Flat per plan |
| Elastic (self-hosted) | Elasticsearch (search index) | Yes | Yes (Elastic Security) | Free or subscription + infra |
| OpenSearch | OpenSearch (search index) | Yes | Plugin | Free (infra + time) |
| Graylog | Search cluster + MongoDB | Yes | Paid tier | Free / tiered licence |
| Grafana Loki | Object storage + label index | Yes, unless cloud | No | Free / usage-based |
| Splunk | Splunk indexers | Partly | Yes (ES) | Ingest / workload |
| Microsoft Sentinel | Azure Log Analytics | No | Yes | Per GB + meters |