Six months ago, the powers that be decided our Splunk bill was an excellent source of venture capital for their shareholders. We were ordered to migrate our security operations to Elastic Security. The mandate was delivered with the usual buzzwords: "unified platform," "cost efficiency," and "open source ethos." Having now lived through the deployment and half a year of daily use, I can offer a somewhat drier, more grounded assessment.
Let's start with the obvious win: cost. It's cheaper. Dramatically so. We're not paying per gigabyte ingested, which changes the entire calculus around log verbosity. You can actually turn on debug logging for a problematic system without triggering a financial review. That part of the "unified platform" pitch is, for once, not marketing fluff.
However, the transition was akin to swapping a fully furnished apartment for a plot of land and a pile of lumber. The Elastic Stack is powerful, but it expects you to be your own architect and carpenter. Out of the box, the security content is decent but sparse compared to Splunk's vast ecosystem. We spent months:
- Normalizing our custom logs to ECS. A noble goal, but a tedious, ongoing process.
- Building detection rules that Splunk Enterprise Security provided off-the-shelf.
- Recreating dashboard visualizations that our analysts had taken for granted.
The pain point isn't capability; it's convenience. Kibana is a capable visualization tool, but its UX for security workflows feels like a dashboard tool that had security features bolted on. The separation between Discover, Dashboards, and the Security app creates friction. An analyst hunting an anomaly shouldn't need to understand the architectural nuances of the Elastic suite.
Performance is a mixed bag. Searches across hot data are blisteringly fast. But once you're into warmer tiers, the experience degrades noticeably, and tuning index lifecycle management becomes a new part-time job for someone. The assumption that you'll have a dedicated Elastic engineer on staff is not unfounded. If you don't, you'll be developing that expertise rapidly, often during incidents.
So, the final tally? For a lean, engineering-oriented team willing to invest significant upfront effort in building their own security "product," Elastic can be a justifiable choice. The cost savings are real and substantial. But if you're expecting a polished, out-of-the-box SOC experience that lets you focus on threats instead of tooling, you've migrated to the wrong planet. You'll be building that SOC yourself, one painstakingly crafted detection rule at a time.
Show me the data
I'm a principal engineer at a fintech processing low seven-figures in transactions daily. We've run both Splunk Enterprise Security (on-prem) and Elastic Security (self-managed on Kubernetes) for our SOC 2 and fraud detection workloads, with about 2 TB of daily security log ingestion.
* **Real Pricing and TCO:** Splunk's ingestion-based licensing creates a direct tax on observability. At our scale, it was approximately $4,500 per TB ingested, per month. Elastic's subscription model (we use Platinum) is a flat $14 per node per hour for the full stack, making our bill roughly 70% lower. The hidden cost is engineering time: you easily spend 20-30% more on pipeline management and content development.
* **Deployment and Content Maturity:** Elastic is an infrastructure project, not an installed product. Moving from Splunk's out-of-the-box rules and correlations meant building our own detection logic for about 40% of our use cases. The ECS mapping you mentioned took my team of three engineers nearly three months to solidify, and we still have edge cases. Splunk's CIM is less elegant but has more community content.
* **Query Performance Nuance:** For ad-hoc searches on hot data, they're comparable. For scheduled correlations over time windows, we found Elastic to be 3-4x slower on the same hardware when joins involve more than five indices. We had to implement a separate warm-tier architecture with faster storage to get parity. Kibana's alerting is also less mature than Splunk's scheduled searches for complex multi-source conditions.
* **Where It Clearly Wins:** The integrated stack is the advantage. Having Beats/Agent management, index lifecycle policies, and alerting actions within the same API sphere eliminates integration fragility. Our custom threat intel enrichment pipeline that would have required separate middleware in Splunk is just an Elasticsearch ingest pipeline. For a team willing to write code, the automation potential is significantly higher.
Given those points, I'd only recommend Elastic Security for organizations with strong platform engineering resources that intend to heavily customize their detection logic and value the integrated data pipeline. If you need a comprehensive, supported SOC tool out of the box with a vast app ecosystem, Splunk is still the safer choice. To make a clean call, tell us your team's ratio of security analysts to DevOps engineers and whether you primarily need to replicate existing Splunk detections or build net-new ones.
brianh