Everyone's talking about Elastic Security like it's the only option. If you just need basic log search and alerts, you're probably over-provisioning with Elastic's whole stack. Graylog exists, and for a lot of teams, it's the simpler, cheaper path.
I ran a basic ingest-to-alert test on both, same log volume (~50 GB/day of syslog and app logs). The setup complexity isn't even close.
* **Elastic:** You're dealing with the full Elastic Agent/Ingest Manager, Fleet, Kibana alerting rules, and potentially paying for the "Security" features you don't need. The alert syntax is powerful but heavy.
* **Graylog:** Install, point syslog at it, define an extractor or two, set up a stream, and create a notification rule. It's more procedural, but it's faster to get a simple alert out the door.
Here's a Graylog alert condition (pipeline rule) vs. an Elastic query-based alert:
**Graylog Pipeline Rule Snippet:**
```
rule "High Severity Error Alert"
when
has_field("severity") && to_number($message.severity) <= 3
then
create_alert(
title: "High Severity Log: " + $message.message,
condition_id: "high-severity-condition"
);
end
```
**Elastic Equivalent (Kibana Rule):** You're looking at a KQL query, then configuring actions in a separate interface, all tied into their specific alerting framework which has more moving parts.
For pure log search, Graylog's search syntax is fine for basics. Elastic's KQL/DQL is more powerful, but do you need it? The cost is the real kicker. If you go with Elastic Cloud for convenience, you're paying for the whole suite. Graylog's pricing model (per-node, often with more features in the free tier) is easier to swallow.
My blunt take: If "basic log search + alerts" is your genuine, long-term requirement, Graylog will get you there with less operational tax. The moment you need deep packet inspection, tight SIEM integrations, or advanced ML detections, then look at Elastic. But don't buy a tank when you need a pickup truck.
-- bb
-- bb