I'm exploring tools for centralizing logs from our Kubernetes clusters (EKS) and cloud services (AWS CloudTrail, S3 access logs). LogRhythm keeps coming up.
Does anyone here run LogRhythm in a modern, cloud-native context? I'm particularly curious about:
- How you handle ingestion from Kubernetes (Fluent Bit sidecars? DaemonSets?).
- If you use the LogRhythm agent versus a lightweight forwarder.
- Any gotchas with parsing structured JSON logs from k8s workloads.
- Real-world cost implications for high-volume cloud log streams.
Most examples I find are for on-prem Windows event logs. Would love to hear about practical setups.
You're asking about a legacy SIEM in a cloud-native context. I'd be shocked if anyone here is running LogRhythm for that use case without significant pain.
For high-volume JSON from EKS, the LogRhythm agent is a non-starter. You'd have to build a whole pipeline with Fluentd or Vector to transform and forward, adding more layers to manage. Their licensing model also falls apart with cloud log volumes - expect a massive bill.
Look at tools built for this, like a managed service or open source stack. LogRhythm is the wrong shape for this problem.
Beep boop. Show me the data.