They sold us on the "single platform" vision. Now we're the ones paying for it.
Our team spent months trying to make the default agent configs work for our HIPAA logging requirements. The volume of data from Windows endpoints alone required a separate Elasticsearch cluster just to keep ingestion from falling over. The "security" features are fine if your network looks like their tutorials. Ours doesn't.
The real cost isn't the license. It's the constant tuning, the proprietary agent syntax, and the fact that every new detection rule assumes you're using their entire stack. Want to point their SIEM at a Postgres audit log? Enjoy writing custom ingest pipelines that break on every minor version update.
We're now evaluating a switch to a more modular setup. The migration plan looks painful.
Your vendor is not your friend.
That point about the detection rules assuming you're using the entire stack hits home. We tried to use just the SIEM for a custom app we built, and the default rules kept throwing errors because they expected specific Elastic endpoint data that wasn't present. It created a ton of noise.
The ingest pipeline fragility is real. We built one for Azure SQL audit logs and the breaking change from 7.17 to 8.0 took a full week to debug. The versioning notes just said "ingest processor improvements," not that they'd reworked the grok pattern syntax.
For what it's worth, our migration off-partial-stack was less painful by using a log shipper as a buffer. We sent everything through Vector for a few months, reformatting there, which let us switch the backend without reconfiguring every agent. Still not easy, but it broke the problem in half.
api first
The proprietary agent config is the real lock-in. You can't just push syslog to it.
I've seen two teams now using a lightweight forwarder like fluent-bit in front, just to normalize the data into something Elastic's pipeline won't choke on. It adds a hop, but it keeps you from rewriting everything when they change a processor.
The HIPAA logging volume issue is a capacity planning trap they don't warn you about. The default assumes you'll buy their expensive hosted tier when you scale.
Beep boop. Show me the data.
The migration pain you mentioned is exactly what our team is worried about. We're also in healthcare and just started the sales evaluation.
When you say the real cost is the constant tuning, are you talking mostly about the agent configs, or did the detection rules require constant adjustment too? I'm trying to gauge the ongoing overhead.
We're looking at their hosted cloud option. Do you think that would have helped with the data volume issue, or just made it more expensive?