Hey everyone! 👋 I've been tasked with helping my team evaluate our logging and security monitoring stack. We currently use Sumo Logic for SIEM-ish stuff (mostly centralized logs and some security event correlation), but the cost is starting to creep up as we ingest more data.
The immediate answer from everyone seems to be "just use Splunk," but honestly, that feels like jumping from one expensive, complex platform to another. Our use case isn't that crazy—we need to monitor our cloud app logs, some AWS CloudTrail events, and maybe down the line tie in some endpoint stuff. The dev team (where I sit) also likes being able to write queries for debugging.
So my question: what are the best alternatives to Sumo Logic for SIEM that **aren't** Splunk? I've heard names like Elastic SIEM (now Elastic Security), Datadog's security offering, and even open-source stacks like Graylog with some add-ons thrown around. But I'm having a hard time finding concrete, recent experiences.
What I'd love to know:
- If you moved from Sumo Logic to something else, what was it and why?
- How was the migration for the actual log ingestion and parsing? We have a bunch of custom parsers.
- Is the query language/interface decent for folks who are used to Sumo's search syntax?
- Any gotchas with pricing models? We got burned a bit by the data ingestion volume in Sumo.
I'm still pretty new to the whole security data side of things (my background is more in ETL pipelines with Python and Airflow), so any advice on what to look for or pitfalls to avoid would be super helpful. Thanks in advance!
rookie
I'm the platform lead at a fintech (~150 engineers, ~500 total employees) where we run a multi-cloud stack (mostly AWS, some GCP) and migrated off Sumo Logic about 18 months ago after a significant cost review. In production now, we self-host Elastic Security (formerly Elastic SIEM) on EC2 for our core security logging and use Grafana Cloud (Loki) for developer-centric application log querying.
**Core Comparison of Alternatives I've Run or Evaluated:**
1. **Elastic Security (Self-Hosted)**:
- **Ingest Cost**: The most direct financial win. Our Sumo Logic bill was ~$180k/year; our Elastic cluster (6 hot + 3 warm + 3 master nodes, i3en.2xlarge) runs ~$45k/year in EC2 + EBS. No per-GB tax.
- **Migration Effort**: High. Be prepared to rewrite parsers into Elasticsearch Ingest Pipelines (Painless scripting). We spent 3 engineer-months moving ~50 log sources. The benefit is you own the normalization fully.
- **Where It Breaks**: The learning curve for SecOps analysts used to Sumo's UI is steep. The correlation rules (Elastic Rules) are powerful but require YAML/editor work, not a GUI builder.
- **Hard Capability Limit**: You become your own support. Tuning for sudden ingestion spikes (e.g., a misconfigured app logging 100x) is an ops task, not a support ticket.
2. **Grafana Cloud (with Grafana Loki)**:
- **Dev Experience**: Near-perfect for the debugging use case. LogQL is more intuitive for engineers than Sumo's query language. Our dev adoption soared.
- **Pricing Trap**: Their security monitoring (with Grafana Enterprise Security) is separate and costly. Using just Loki for security events lacks built-in correlation. Our bill for dev logs (~2 TB/month) is ~$15k/month, but adding the security module doubled that in a pilot.
- **Migration Simplicity**: Trivial for CloudWatch, K8s, and syslog. Logfmt and JSON parsing is native; complex regex extraction is possible but less performant. We migrated these sources in a week.
- **Cold Query Performance**: Queries over older, "cold" data stored in object storage can hit 15-20 second latencies. For real-time security alerting, you must keep recent data hot.
3. **Datadog Security Platform**:
- **Unified Agent Win**: If you're already on Datadog for APM & infra, adding security is a checkbox. The single agent reduces deployment friction drastically. We ran a POC adding it to ~30% of our hosts.
- **Real Cost**: It's not cheaper than Sumo. Expect ~$0.20-$0.30 per GB ingested *on top of* your existing infra/host costs. For our scale, it was a 40% increase over our already expensive APM bill.
- **Black Box Nature**: Custom parsing is done through the Datadog Grok Processor, which is fine, but you cannot debug a parsing pipeline locally like you can with an open-source agent. You are locked to their pipeline.
4. **Graylog (Open Source Core + Paid Enterprise)**:
- **Mid-Ground Viable**: We tested this for a team that wanted a GUI-centric setup. It worked acceptably for ~100 GB/day.
- **Throughput Wall**: The single-node open-source version choked above ~150 GB/day in our tests (sustained 2k msgs/sec). The Enterprise version with sidecars improves this but introduces cost.
- **Security Module Gap**: The security features (threat intel, correlation) feel bolted-on compared to Elastic's integrated stack. You'll rely more on writing custom streams and alerts.
**My Pick**: For your stated mix of "cloud app logs, AWS CloudTrail, maybe endpoints," I'd recommend a split: **Elastic Security (self-hosted) for the security monitoring and compliance, paired with Grafana Cloud (Loki) for the developer debug logging**. This gives you cost control and power on the security side, and fantastic dev UX on the other.
If your team absolutely cannot handle self-hosting, the next clean question is: are you already a heavy Datadog shop? If yes, their security offering is logical despite the cost. If not, the managed Elastic Service on AWS is worth a cost comparison, though it eats into the savings.
numbers don't lie
You're asking the right questions upfront. A lot of teams get tripped up later by underestimating the parser migration.
Based on what you've described - cloud app logs, AWS events, and developer query needs - I'd steer you toward evaluating a split approach rather than a single "Sumo replacement." Many successful migrations separate the security-specific ingestion (CloudTrail, endpoint, auth logs) from the general developer debugging logs. This lets you choose a tool optimized for each job, often at a lower total cost.
Elastic Security is a strong candidate for the security side, but the parser rewrite is indeed a significant project. An alternative path to consider is a managed service like Panther or an AWS-native stack (OpenSearch Service with Security Lake). These can reduce the operational burden compared to self-hosting, though you'll trade some control.
—lucas