Elastic Security vs Graylog comparison

Read 19 Graylog reviews

9,556 Views
8,400 Comparison Views

94% willing to recommend

Elastic Security

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jan 12, 2025

Graylog and Elastic Security are competing products in the security event management and monitoring category. Elastic Security seems to have the upper hand due to its advanced features and flexibility, despite higher costs.

Features: Graylog offers straightforward log management, efficient archiving, and user-friendly search, supporting quick and efficient monitoring. Elastic Security provides robust threat intelligence, anomaly detection, and machine learning integration, catering to comprehensive security analytics and incident response.

Room for Improvement: Graylog could enhance its integration capabilities, expand its alerting options, and offer more advanced analytics features. Elastic Security could improve its user interface for easier navigation, offer more customizable alerting out of the box, and reduce complexity in its setup and configuration processes.

Ease of Deployment and Customer Service: Graylog is known for its quick and easy deployment, minimizing setup hassle. Elastic Security is slightly more complex but offers strong support and comprehensive documentation to facilitate deployment.

Pricing and ROI: Graylog presents a cost-effective option with lower initial setup costs for fundamental logging and analysis tools. Elastic Security involves a higher setup cost but provides significant value and a better perceived ROI for enhanced security insights.

To learn more, read our detailed Elastic Security vs. Graylog Report (Updated: January 2025).

Elastic Security vs. Graylog

January 2025

Download the complete report

Helped 841,004 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Elastic Security

Ranking in Log Management

7th

Average Rating

7.6

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (5th), Endpoint Detection and Response (EDR) (16th), Security Orchestration Automation and Response (SOAR) (6th), Extended Detection and Response (XDR) (8th)

Graylog

Ranking in Log Management

16th

Average Rating

8.0

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of March 2025, in the Log Management category, the mindshare of Elastic Security is 3.7%, down from 6.9% compared to the previous year. The mindshare of Graylog is 6.4%, up from 5.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Nikhil-Kumar

Assistant Manager - IT Security at Photon inc

Customizable with great dashboards but the premium support is poor

The initial setup can be complex if you don't have technical knowledge. However, once it is deployed, it works well. I'm not sure how long it took to deploy. I wasn't there when it was set up and configured. We have an internal team that handles deployment and maintenance. It doesn't require too many people to deploy. Five or six people would be enough. However, for 24/7 monitoring, you need to have someone always on it.

Read full review

Andrey Mostovykh

Senior Data Architect at a non-tech company with 201-500 employees

Real-time analysis, easy setup, and open source

We stopped using it for analytics because of its price, and at the moment, we are using it mostly for log centralization. If you use it with high traffic for analytical purposes, as well as for the logs, the infrastructure costs are unbelievable. Graylog is a great product backed by Elasticsearch as the storage and query engine. It is just an interface on top of Elasticsearch and some Elasticsearch management. The indexes that are kept in Elasticsearch are managed by Graylog software. Elasticsearch is a decent product, but it's very infrastructure-heavy. It requires lots of resources, and if you make a mistake with provisioning, you are likely to not get a cluster back. We had a couple of outages like that, and we hated that. So, we ended up over-provisioning resources just to avoid such situations from happening. If you have a whole team trying to fix the Graylog instance for two days, that's a bit too much. That may be my Norwegian take on it, but the engineering resources are expensive. It's better to just provision the infrastructure. Overall, the product is great, and the features are just fine, but the infrastructure cost is what is killing it. The infrastructure cost is the main issue. I like the rest. If the infrastructure costs could be lower, it would be fantastic. I'm not sure if they can improve the infrastructure cost with the way Elasticsearch is. If they keep using Elasticsearch, maybe there are some opportunities there, or they can support other backends with cheaper storage. They could have a different backend to replace Elasticsearch or do some tweaks to Elasticsearch to reduce the costs. There could be partial parsing of logs or parsing on demand so that when you write data through Graylog to Elasticsearch, it doesn't need to crunch in every detail requiring that much CPU.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The stability of the solution is good."

"I can look at events from more than one source across multiple different locations and find patterns or anomalies. The machine learning capabilities are helpful, and I can create rules for notifications to be more proactive rather than responding after something has gone wrong."

"The visualization is very good."

"The solution is quite stable. The performance has been good."

"Elastic Security offers advanced features such as machine learning and integration with ChatGPT."

"It is an extremely stable solution. Stability-wise, I rate the solution a ten out of ten."

"The most valuable thing is that this solution is widely used for work management and research. It's easy to jump into the security use case with the same technology."

"We like Elastic Security because it's a REST API-based solution. That's the primary reason we use it."

More Elastic Security pros

"The build is stable and requires little maintenance, even compared to some extremely expensive products."

"Real-time UDP/GELF logging and full text-based searching."

"Graylog's search functionality, alerting functionality, user management, and dashboards are useful."

"I am very proud of how very stable the solution is."

"What I like about Graylog is that it's real-time and you have access to the raw data. So, you ingest it, and you have access to every message and every data item you ingest. You can then build analytics on top of that. You can look at the raw data, and you can do some volumetric estimations, such as how big traffic you have, how many messages of data of a type you have, etc."

"I like the correlation and the alerting."

"It has data adapters and lookup tables that utilize HTTP calls to APIs."

"We run a containerized microservices environment. Being able to set up streams and search for errors and anomalies across hundreds of containers is why a log aggregation platform like Graylog is valuable to us."

More Graylog pros

Cons

"I want to find an automatic security system in the tool, like a SOAR solution. I am looking forward to seeing a SOAR system in the tool."

"Technical support could respond faster."

"We'd like better premium support."

"I think because we are a cybersecurity company, the thing that can be improved is the prebuilt tools, especially quality. Compared to its competitor, they still have fewer prebuilt security rules. Elastic Security, in terms of generating alerts, cannot group the same products into one another. Even though the alerts are the same, they still generate them one by one. So, it is very noisy in our dashboard. I would like the Elastic Security admin to group all the same alarms into one alarm so that our dashboard is not noisy."

"This solution is very hard to implement."

"One thing they could add is a quick step to enable users who don't have a solid background to build a dashboard and quickly search, without difficulty."

"With Elastic, you have to build the use cases for the specific requirement. Other products have a simple integration and more use cases to integrate out-of-the-box solutions for SIEM."

"Their visuals and graphs need to be better."

More Elastic Security cons

"More complex visualizations and the ability to execute custom Elasticsearch queries would be great."

"I would like to see a default dashboard widget that shows the topology of the clusters defined for the graylog install."

"Elasticsearch recommendations for tuning could be better. Graylog doesn't have direct support for running the system inside of Kubernetes, so it can be challenging to fill in the gaps and set up containers in a way that is both performant and stable."

"When it comes to configuring the processing pipeline, writing the rules can be very tedious, especially since the documentation isn't extensive on how the functions provided for these rules work."

"I hope to see improvements in Graylog for more interactivity, user-friendliness, and creating alerts. The initial setup is complex."

"We ran into problems with Elasticsearch throwing a circuit-breaking exception due to field data size being too large. It turned out that the heap size directly impacted this size in a high-throughput environment, causing unexplained instability in Graylog. We were able to troubleshoot on the Elasticsearch size, but we should have been able to reference some minimum requirements for Graylog to know that our settings weren't sufficient."

"I would like to see a date and time in the Graylog Grok patterns so that I can save time when searching for a log. I like how the streams and the search query work, but adding a date and time will allow me to pull out a log in a milli-second."

"There should be some user groups and an auto sign-in feature."

More Graylog cons

Pricing and Cost Advice

"It's a monthly cost with Elastic SIEM, but I am not sure of the exact cost."

"Its price is fine. Its licensing works on a yearly basis. We have to renew the license every year. I also have a good experience with Darktrace. When we buy Darktrace, we get training free of cost, which is not there in Elastic. We have to pay extra for training. There is certainly room for improvement."

"The licensing cost of Elastic Security is based on the daily ingestion rate. I can't recall the exact figure, but for 10GB of log action daily, it would cost around $20,000."

"The base product is open-source but if you need advanced security features then you need to pay for the subscription. Elastic Security's price is reasonable in some cases and in other cases it's not."

"The product offers an amazing pricing structure. Price-wise, the product is very competitive."

"The solution is free."

"The price is reasonable. It probably costs the same as ArcSight and LogRhythm SIEM. FortiSIEM might cost less than Elastic Security. There are no hidden or additional costs."

"I find it better than Splunk in terms of cost-effectiveness. For cost-effectiveness, I would rate it a nine out of 10."

More Elastic Security pricing and cost advice

"Graylog is a free open-source solution. The free version has a capacity limitation of 2 GB daily, if you want to go above this you have to purchase a license."

"I use the free version of Graylog."

"Having paid official support is wise for projects."

"I am using a community edition. I have not looked at the enterprise offering from Graylog."

"If you want something that works and do not have the money for Splunk or QRadar, take Graylog."

"It's open source and free. They have a paid version, but we never looked into that because we never needed the features of the paid version."

"There is an open source version and an enterprise version. I wouldn't recommend the enterprise version, but as an open source solution, it is solid and works really well."

"We're using the Community edition."

More Graylog pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

841,004 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

16%

Government

10%

Financial Services Firm

10%

University

Computer Software Company

17%

Comms Service Provider

10%

Government

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

Datadog vs ELK: which one is good in terms of performance, cost and efficiency?

With Datadog, we have near-live visibility across our entire platform. We have seen APM metrics impacted several times lately using the dashboards we have created with Datadog; they are very good c...

What do you like most about Elastic Security?

Elastic provides the capability to index quickly due to the reverse indexes it offers. This data is crucial as it contains critical information. The reverse index allows fast data indexing because ...

What is your experience regarding pricing and costs for Elastic Security?

Elastic Security is considered cost-effective, especially at lower EPS levels. However, a direct comparison was not made due to different pricing structures.

What do you like most about Graylog?

The product is scalable. The solution is stable.

What is your experience regarding pricing and costs for Graylog?

We are using the free version of the product. However, the paid version is expensive.

What needs improvement with Graylog?

When it comes to configuring the processing pipeline, writing the rules can be very tedious, especially since the documentation isn't extensive on how the functions provided for these rules work. P...

Wazuh vs Elastic Security

Comparisons

Compared 26% of the time

CrowdStrike Falcon vs Elastic Security

Compared 9% of the time

IBM Security QRadar vs Elastic Security

Compared 7% of the time

Splunk Enterprise Security vs Elastic Security

Compared 6% of the time

AlienVault OSSIM vs Elastic Security

Compared 2% of the time

More Elastic Security Competitors

Grafana Loki vs Graylog

Compared 43% of the time

Wazuh vs Graylog

Compared 23% of the time

syslog-ng vs Graylog

Compared 11% of the time

Security Onion vs Graylog

Compared 4% of the time

Nagios Log Server vs Graylog

Compared 1% of the time

More Graylog Competitors

Product Reports

Download Elastic Security product report

Elastic Security

March 2025

Download Graylog product report

February 2025

Also Known As

Elastic SIEM, ELK Logstash

Graylog2

Overview

Elastic Security is a robust, open-source security solution designed to offer integrated threat prevention, detection, and response capabilities across an organization's entire digital estate. Part of the Elastic Stack (which includes Elasticsearch, Logstash, and Kibana), Elastic Security leverages the power of search, analytics, and data aggregation to provide real-time insight into threats and vulnerabilities. It is a comprehensive platform that supports a wide range of security needs, from endpoint protection to cloud and network security, making it a versatile choice for organizations looking to enhance their cybersecurity posture.

Elastic Security combines the features of a security information and event management (SIEM) system with endpoint protection, allowing organizations to detect, investigate, and respond to threats in real time. This unified approach helps reduce complexity and improve the efficiency of security operations.

Additional offerings and benefits:

The platform utilizes advanced analytics, machine learning algorithms, and anomaly detection to identify threats and suspicious activities.
It offers extensive integration options with other tools and platforms, facilitating a more cohesive and comprehensive security ecosystem.
With Kibana, users gain access to powerful visualization tools and dashboards that provide real-time insight into security data.

Finally, Elastic Security benefits from a global community of users who contribute to its threat intelligence, helping to enhance its detection capabilities. This collaborative approach ensures that the solution remains on the cutting edge of cybersecurity, with up-to-date information on the latest threats and vulnerabilities.

Elastic

Graylog is purpose-built to deliver the best log collection, storage, enrichment, and analysis. Graylog is:

Considerably faster analysis speeds.
More robust and easier-to-use analysis platform.
Simpler administration and infrastructure management.
Lower cost than alternatives.
Full-scale customer service.
No expensive training or tool experts required.

Sample Customers

Texas A&M, U.S. Air Force, NuScale Power, Martin's Point Health Care

Blue Cross Blue Shield, eBay, Cisco, LinkedIn, SAP, King.com, Twilio, Deutsche Presse-Agentur