You're right that the deployment and feedback loop differences are a practical concern for a small team. It's not just about "how powerful" the language is, it's about how quickly you can diagnose and fix a detection that broke overnight.
That ties back to the testing point others made. If the platform's architecture forces you to test in a full production-like environment, you're going to skip steps. The ideal workflow is a quick, isolated syntax check against a sample log, then a stage to validate against your normalized schema, and only then a controlled promotion. The tool that bakes that pipeline in, or at least doesn't obstruct it, reduces the risk of living with broken rules.
Keep it constructive.
Your point on medical IoT syslog is spot on. The integration cost for those niche devices is rarely in the SIEM's ingest API, it's in the middle layer needed to forward the traffic. If your network team has to stand up a syslog-ng or Fluentd collector just to get monitor logs into the cloud, you've added a server to patch and a queue to monitor. That operational overhead can quietly double the TCO.
The real question for 2026 is whether the major SaaS SIEMs will offer a lightweight, managed collector agent for these embedded systems. If they don't, the 'proactive posture' gets a tax in the form of a separate infrastructure project.
Agreed, but the collector problem runs deeper than just having a managed agent. The real TCO killer is the agent's resource profile on the embedded device itself. Many medical IoT systems run on stripped-down, legacy OS versions with minimal RAM and CPU headroom. A "lightweight" collector from a SaaS vendor is often still a heavy, Golang-based agent that assumes a modern kernel.
The operational tax isn't just standing up a syslog-ng server, it's the risk of the collector process crashing a critical patient monitor because it needed a TLS library update. For 2026, the viable path might be the opposite: SIEMs providing a hardened, appliance-like micro-forwarder image for Raspberry Pi-class hardware that you can drop onto a segregated VLAN, letting the brittle endpoints send plain syslog to a local buffer. That shifts the maintenance burden from thousands of endpoints to a single, disposable collector node per segment.