We're looking to replace a legacy SIEM. Team of 5 handling infra + security. Need to manage logs from ~200 VMs, cloud workloads, and network gear. Budget is a factor, but so is staff time.
I've seen fluffy comparisons. Need real operational numbers from teams who've run both.
* What was your *actual* annual TCO for LogRhythm (licensing + support) for a similar size?
* For a self-managed ELK stack (with a proper SIEM layer like Opensearch Security or Elastic Security), what's the monthly hours investment for maintenance, tuning, and upgrades?
* Any hard metrics on ingestion/query performance with similar data volumes (~150 GB/day)?
Bonus: If you went with ELK, what's your current stack for parsing/alerting/dashboards? Be specific.
—cp
—cp
I run a 6-person infra/security team at a 400-person SaaS company. We ingest about 120 GB/day from 300 VMs, K8s, and network gear. We've run both LogRhythm (previous job) and self-managed ELK (current). I hate vendor lock-in and prefer to own my stack, but I'll give you the dirty numbers.
**LogRhythm TCO (for ~150 GB/day)**
Licensing: at my last shop, they quoted us $42k/year for 10 GB/day. To scale to 150 GB/day, that jumps to roughly $300-350k/year (they charge per GB ingested, with tier discounts). Support is an extra 20% on top, so ~$400k/year all-in.
Hidden costs: they force you to use their appliances or certified hardware. We ended up buying two $60k appliances. You can't just throw it on commodity servers.
Staff time: low. Maybe 2-4 hours/month for tuning rules. But you're stuck with their parser and alerting logic. Good luck customizing.
**Self-managed ELK (Opensearch + ElastAlert + Kibana)**
Hardware: 5 nodes (c5.4xlarge on AWS, or equivalent on-prem). That's about $2,500/month in compute, plus $1,200/month for EBS storage (hot tier 1 TB, warm tier 3 TB). Total ~$45k/year.
Maintenance hours: I spend 8-12 hours/month on upgrades, index tuning, and fixing mapping issues. Another 4-6 hours/month on alerting tweaks and dashboards. Expect 15-20 hours/month total for a team that's not full-time ops.
Ingestion: with 5 nodes, we handle 150 GB/day fine. Peak throughput ~2,000 events/sec per node. Query times: hot data (1-2 sec), warm data (5-10 sec on cold cache). Cold cache queries can be 3-4x slower if you don't use ILM aggressively.
Where it breaks: if you don't tune shard counts and ILM, you'll hit cluster yellow/red. Mapping explosions are a real pain. Also, Elastic Security is expensive if you want built-in threat detection; we use ElastAlert (free) and custom rules.
**Parsing/Alerting/Dashboards Specifics**
Filebeat for shipping (with custom modules for Nginx, system auth, firewalls)
Logstash for heavy parsing (grok filters, date math) - we tried Vector but it didn't handle multiline as well
ElastAlert for alerting (Slack, PagerDuty) - rules are plain YAML, works fine
Kibana for dashboards - we use Vega for custom visualizations, and saved searches for security views
Opensearch Security for RBAC and audit logging (free, no Elastic license)
**Performance Numbers**
Indexing: 150 GB/day raw logs compress to ~45 GB/day (deflate). We use 5 shards per index, rollover every 24 hours.
Query: "show me all failed SSH attempts from subnet X in last 7 days" - returns in ~2 seconds on hot nodes, 8 seconds on warm nodes. That's fine for investigation.
Alerting: ElastAlert runs every 60 seconds, checks ~50 rules. CPU usage < 5% on a single node.
**My Pick**
If you have a team member who enjoys tinkering and doesn't mind a 20-hour/month learning curve, go ELK + Opensearch + ElastAlert. You'll save $350k/year and own your data. If you need a "fire and forget" SIEM and have a $400k+ budget, LogRhythm works but you'll hate the vendor lock-in. Given your team of 5 already handling infra and security, I'd lean ELK - just budget for the ops time upfront. But tell us: are you married to on-prem or can you go cloud? That changes the hardware cost math.
null