Hey folks,
So our team finally made the big switch last quarter. After our Sumo Logic bill grew faster than our actual log volume (anyone else feel that pain?), we migrated our core application logging and monitoring stack over to a self-hosted Grafana/Loki combo, with Prometheus for metrics. The cost savings have been undeniable—we're talking about reducing our monthly observability spend by about 70%. It was the right financial decision, but as with any major platform shift, there are trade-offs. I've been deep in the trenches of both, and I wanted to share what we find ourselves missing, and how we're trying to build workarounds.
**What We Miss from Sumo Logic:**
* **The Out-of-the-Box "Smartness":** Sumo's query autocomplete, field extraction, and log parsing felt almost psychic at times. With Loki, we're writing a lot more regex in `| logfmt` and `| pattern` parsers manually. We had to build a whole pre-processing pipeline to get close to that automatic structure.
* **The Unified Data Tier:** Having hot/warm/cold data handled seamlessly was a luxury. Now we're managing retention periods and storage buckets ourselves. It's not *hard*, but it's operational overhead we didn't have before.
* **Dashboard and Alert "Portability":** In Sumo, a saved search could be trivially turned into a panel or an alert. Our Loki/Grafana setup requires more steps—defining the query in Grafana, then building the alert separately in Prometheus or Grafana's alert manager. The workflow feels more fragmented.
* **The Built-in Compliance & Security Features:** This was a big one. Sumo's audit event indexes and compliance reports were basically ready-to-go. Recreating that level of oversight for our own infra has been a significant project.
**Our DIY Workarounds (so far):**
We're using Make to stitch things together. For example, to compensate for the less intuitive alerting, we built a scenario that:
1. Listens for a specific log pattern via a Grafana webhook to Make.
2. Enriches the alert by querying our internal API for context.
3. Routes it to different channels (Slack, PagerDuty, a ticket) based on severity.
```json
// Example of a Loki parser config we had to write for a custom app log
// Sumo would often just figure this out...
job: myapp
pipeline_stages:
- regex:
expression: '^(?Pd{4}-d{2}-d{2} d{2}:d{2}:d{2}) [(?Pw+)] (?Pw+) (?P.+)$'
- labels:
level:
trace_id:
```
The bottom line is this: we traded cost for complexity and developer time. For a lean team watching the budget, it was worth it. But I'm curious—has anyone else gone down this path? What have you missed, and more importantly, what clever integrations or low-code automations have you built to bridge the gap? I'm always looking to steal... ahem, *learn from* better workflows.
api first
api first
Daniel Rojas, reliability lead at a mid-market SaaS shop. We run a 200-node K8s fleet for our multi-tenant platform. I've shipped Sumo Logic and Grafana/Loki stacks to prod and manage both now for different teams.
* **Total cost of ownership for 1 TB/day:** Sumo's price tag is easy but steep, roughly $45k/month list for that volume. Self-hosted Loki on-prem (using our own object storage) runs about $8k/month in infra and labor. The 70% savings you see is real, but that's the sticker price. The real cost is 2 FTE quarters to build parity on parsing, retention, and uptime.
* **Time to actionable insight:** With Sumo, a new engineer could find an error pattern across three microservices in under 5 minutes. With Loki, the same person needs to know LogQL, our label schema, and the specific grafana dashboards. We measured this: average incident diagnosis is 3-4x slower for our junior on-call.
* **Operational overhead:** Sumo's data tier is zero ops. Loki's retention management is manual. We had a misconfigured `compactor` job that doubled our S3 storage costs for a month because old indexes weren't cleaned up. You will have these moments.
* **Parsing and enrichment:** Sumo's field learning and extraction worked on 80% of our arbitrary app logs. For Loki, we had to write and maintain `dockerize`-ed log preprocessing sidecars for 30+ services to get structured logging at ingest, adding latency. Custom parsing is a constant tax.
I'd pick Loki if you have the platform team bandwidth to build and maintain the gaps, and your log volume justifies the labor cost. I'd pick Sumo if you need to move fast and your bill is less than 20% of an engineer's fully-loaded salary. What's your team's size and your current daily log volume in GB?
Trust, but verify