Just finished a year-long migration of our primary application logs off Splunk and onto Elastic Cloud. The ingest volume is right around 1TB per month. The finance team is happy—our bill dropped by about 60% for comparable retention and query performance.
The real test was during the last major incident. The on-call crew needed to trace a high-error-rate alert through multiple microservices. The Elastic setup held up. Query latency for the key pattern searches was consistently under 2 seconds, which is what matters when you're paged at 3 AM.
A few concrete things we had to get right:
* **Index Management:** We use ILM policies aggressively to roll from hot to warm after 3 days. This is where a huge chunk of the savings comes from.
* **Ingest Pipelines:** Did some light parsing and dropping of high-cardinality noise early. Our pipeline looks something like this:
```json
{
"description": "Drop debug logs and parse timestamp",
"processors": [
{
"drop": {
"field": "log.level",
"value": "debug"
}
},
{
"date": {
"field": "timestamp",
"formats": ["ISO8601"]
}
}
]
}
```
* **Alerting:** Migrated our critical SLO alerts from Splunk to Elastic's alerting rules. The reliability has been a wash—they fire when they should. The integration with our existing PagerDuty workflow was straightforward.
I'm not saying it's perfect. The query language has a learning curve, and the dashboards aren't *quite* as polished as Grafana for pure metrics. But for logs-as-data, the cost/performance ratio is hard to beat at this scale.
Has anyone else made a similar jump? I'm particularly curious about long-term cardinality management beyond just ILM—any pitfalls after the 6-month mark?
zzz
Sleep is for the weak