Elastic Security vs Graylog comparison

Read 19 Graylog reviews

9,556 Views
8,400 Comparison Views

94% willing to recommend

Elastic Security

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jan 12, 2025

Graylog and Elastic Security are competing products in the security event management and monitoring category. Elastic Security seems to have the upper hand due to its advanced features and flexibility, despite higher costs.

Features: Graylog offers straightforward log management, efficient archiving, and user-friendly search, supporting quick and efficient monitoring. Elastic Security provides robust threat intelligence, anomaly detection, and machine learning integration, catering to comprehensive security analytics and incident response.

Room for Improvement: Graylog could enhance its integration capabilities, expand its alerting options, and offer more advanced analytics features. Elastic Security could improve its user interface for easier navigation, offer more customizable alerting out of the box, and reduce complexity in its setup and configuration processes.

Ease of Deployment and Customer Service: Graylog is known for its quick and easy deployment, minimizing setup hassle. Elastic Security is slightly more complex but offers strong support and comprehensive documentation to facilitate deployment.

Pricing and ROI: Graylog presents a cost-effective option with lower initial setup costs for fundamental logging and analysis tools. Elastic Security involves a higher setup cost but provides significant value and a better perceived ROI for enhanced security insights.

To learn more, read our detailed Elastic Security vs. Graylog Report (Updated: March 2025).

Elastic Security vs. Graylog

Download the complete report

Helped 841,824 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Elastic Security

Ranking in Log Management

7th

Average Rating

7.6

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (5th), Endpoint Detection and Response (EDR) (16th), Security Orchestration Automation and Response (SOAR) (6th), Extended Detection and Response (XDR) (8th)

Graylog

Ranking in Log Management

16th

Average Rating

8.0

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of March 2025, in the Log Management category, the mindshare of Elastic Security is 3.7%, down from 6.9% compared to the previous year. The mindshare of Graylog is 6.4%, up from 5.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Nikhil-Kumar

Assistant Manager - IT Security at Photon inc

Customizable with great dashboards but the premium support is poor

The initial setup can be complex if you don't have technical knowledge. However, once it is deployed, it works well. I'm not sure how long it took to deploy. I wasn't there when it was set up and configured. We have an internal team that handles deployment and maintenance. It doesn't require too many people to deploy. Five or six people would be enough. However, for 24/7 monitoring, you need to have someone always on it.

Read full review

Andrey Mostovykh

Senior Data Architect at a non-tech company with 201-500 employees

Real-time analysis, easy setup, and open source

We stopped using it for analytics because of its price, and at the moment, we are using it mostly for log centralization. If you use it with high traffic for analytical purposes, as well as for the logs, the infrastructure costs are unbelievable. Graylog is a great product backed by Elasticsearch as the storage and query engine. It is just an interface on top of Elasticsearch and some Elasticsearch management. The indexes that are kept in Elasticsearch are managed by Graylog software. Elasticsearch is a decent product, but it's very infrastructure-heavy. It requires lots of resources, and if you make a mistake with provisioning, you are likely to not get a cluster back. We had a couple of outages like that, and we hated that. So, we ended up over-provisioning resources just to avoid such situations from happening. If you have a whole team trying to fix the Graylog instance for two days, that's a bit too much. That may be my Norwegian take on it, but the engineering resources are expensive. It's better to just provision the infrastructure. Overall, the product is great, and the features are just fine, but the infrastructure cost is what is killing it. The infrastructure cost is the main issue. I like the rest. If the infrastructure costs could be lower, it would be fantastic. I'm not sure if they can improve the infrastructure cost with the way Elasticsearch is. If they keep using Elasticsearch, maybe there are some opportunities there, or they can support other backends with cheaper storage. They could have a different backend to replace Elasticsearch or do some tweaks to Elasticsearch to reduce the costs. There could be partial parsing of logs or parsing on demand so that when you write data through Graylog to Elasticsearch, it doesn't need to crunch in every detail requiring that much CPU.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I like the indexing of the logs."

"The cost is reasonable. It's not overly pricey."

"It's not very complicated to install Elastic."

"The product has huge integration varieties available."

"The most valuable thing is that this solution is widely used for work management and research. It's easy to jump into the security use case with the same technology."

"What customers found most valuable in Elastic Security feature-wise is the search capability, in particular, the way of writing the search query and the speed of searching for results."

"It is the best open-source product for people working in SO, managing and analyzing logs."

"The intelligence of the system has been very impressive. It's not quite AI, but the technical bit where it correlates information, based on the seen attacks within an organization is good."

More Elastic Security pros

"I am very proud of how very stable the solution is."

"UDP is a fast and lightweight protocol, perfect for sending large volumes of logs with minimal overhead."

"Everything stands out as valuable, including the fact that I can quantify and qualify the logs, create pipelines and process the logs in any way I like, and create charts or data maps."

"One of the most valuable features is that you are able to do a very detailed search through the log messages in the overview."

"This had increased productivity for the dev and support teams, because we are directly notifying them."

"Message forwarding through the in-built module."

"It has data adapters and lookup tables that utilize HTTP calls to APIs."

"Graylog's search functionality, alerting functionality, user management, and dashboards are useful."

More Graylog pros

Cons

"There are connectors to gather logs for Windows PCs and Linux PCs, but if we have to get the logs from Syslog then we have to do it manually, and this should be automated."

"The problem with ELK is it's difficult to administer. When you have a problem, it can be very, very difficult to rebuild indexes."

"Elastic Security consumes a lot of resources, requiring a substantial deployment setup."

"With Elastic, you have to build the use cases for the specific requirement. Other products have a simple integration and more use cases to integrate out-of-the-box solutions for SIEM."

"The interface could be more user friendly because it is sometimes hard to deal with."

"One limitation of Elastic Security is that it does not have built-in workflows for all tasks. For example, if you need a workflow for compliance, you will need to create a custom workflow."

"We had issues with scalability. Logstash was not scaling and aggregation was getting delayed. We moved to Fluentd making our stack from ELK to EFK."

"I think because we are a cybersecurity company, the thing that can be improved is the prebuilt tools, especially quality. Compared to its competitor, they still have fewer prebuilt security rules. Elastic Security, in terms of generating alerts, cannot group the same products into one another. Even though the alerts are the same, they still generate them one by one. So, it is very noisy in our dashboard. I would like the Elastic Security admin to group all the same alarms into one alarm so that our dashboard is not noisy."

More Elastic Security cons

"With technical support, you are on your own without an enterprise license."

"The infrastructure cost is the main issue. I like the rest. If the infrastructure costs could be lower, it would be fantastic."

"Dashboards, stream alerts and parsing could be improved."

"Over six months, I had two similar issues where searches were performed on field "messages". It exhausted all the memory of the ES node causing an ES crash and a Graylog halt."

"When it comes to configuring the processing pipeline, writing the rules can be very tedious, especially since the documentation isn't extensive on how the functions provided for these rules work."

"I would like to see a date and time in the Graylog Grok patterns so that I can save time when searching for a log. I like how the streams and the search query work, but adding a date and time will allow me to pull out a log in a milli-second."

"More complex visualizations and the ability to execute custom Elasticsearch queries would be great."

"I would like to see a default dashboard widget that shows the topology of the clusters defined for the graylog install."

More Graylog cons

Pricing and Cost Advice

"The pricing is in the middle. I think it is not an expensive experience if we compare it with big names, for example, QRadar, and also Oxide. I think Elastic Security is quite cheap. I would rate the pricing of this solution a five out of ten."

"There is no charge for using the open-source version."

"Affordable but with additional costs"

"Its price is fine. Its licensing works on a yearly basis. We have to renew the license every year. I also have a good experience with Darktrace. When we buy Darktrace, we get training free of cost, which is not there in Elastic. We have to pay extra for training. There is certainly room for improvement."

"Compared to other tools, Elastic Security is a cheaper solution."

"Elastic Security is free to use."

"When compared to other products, the price is average or on the low side."

"This is an open-source product, so there are no costs."

More Elastic Security pricing and cost advice

"I use the free version of Graylog."

"There is an open source version and an enterprise version. I wouldn't recommend the enterprise version, but as an open source solution, it is solid and works really well."

"We're using the Community edition."

"I am using a community edition. I have not looked at the enterprise offering from Graylog."

"Having paid official support is wise for projects."

"Graylog is a free open-source solution. The free version has a capacity limitation of 2 GB daily, if you want to go above this you have to purchase a license."

"It's open source and free. They have a paid version, but we never looked into that because we never needed the features of the paid version."

"You get a lot out-of-the-box with the non-enterprise version, so give it a try first."

More Graylog pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

841,824 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

17%

Government

10%

Financial Services Firm

Comms Service Provider

Computer Software Company

17%

Comms Service Provider

10%

Government

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

Datadog vs ELK: which one is good in terms of performance, cost and efficiency?

With Datadog, we have near-live visibility across our entire platform. We have seen APM metrics impacted several times lately using the dashboards we have created with Datadog; they are very good c...

What do you like most about Elastic Security?

Elastic provides the capability to index quickly due to the reverse indexes it offers. This data is crucial as it contains critical information. The reverse index allows fast data indexing because ...

What is your experience regarding pricing and costs for Elastic Security?

Elastic Security is considered cost-effective, especially at lower EPS levels. However, a direct comparison was not made due to different pricing structures.

What do you like most about Graylog?

The product is scalable. The solution is stable.

What is your experience regarding pricing and costs for Graylog?

We are using the free version of the product. However, the paid version is expensive.

What needs improvement with Graylog?

When it comes to configuring the processing pipeline, writing the rules can be very tedious, especially since the documentation isn't extensive on how the functions provided for these rules work. P...

Wazuh vs Elastic Security

Comparisons

Compared 25% of the time

CrowdStrike Falcon vs Elastic Security

Compared 9% of the time

IBM Security QRadar vs Elastic Security

Compared 7% of the time

Splunk Enterprise Security vs Elastic Security

Compared 6% of the time

SentinelOne Singularity Complete vs Elastic Security

Compared 2% of the time

More Elastic Security Competitors

Grafana Loki vs Graylog

Compared 42% of the time

Wazuh vs Graylog

Compared 24% of the time

syslog-ng vs Graylog

Compared 11% of the time

Security Onion vs Graylog

Compared 5% of the time

Nagios Log Server vs Graylog

Compared 1% of the time

More Graylog Competitors

Product Reports

Elastic Security

Download Elastic Security product report

Download Graylog product report

Also Known As

Elastic SIEM, ELK Logstash

Graylog2

Overview

Elastic Security is a robust, open-source security solution designed to offer integrated threat prevention, detection, and response capabilities across an organization's entire digital estate. Part of the Elastic Stack (which includes Elasticsearch, Logstash, and Kibana), Elastic Security leverages the power of search, analytics, and data aggregation to provide real-time insight into threats and vulnerabilities. It is a comprehensive platform that supports a wide range of security needs, from endpoint protection to cloud and network security, making it a versatile choice for organizations looking to enhance their cybersecurity posture.

Elastic Security combines the features of a security information and event management (SIEM) system with endpoint protection, allowing organizations to detect, investigate, and respond to threats in real time. This unified approach helps reduce complexity and improve the efficiency of security operations.

Additional offerings and benefits:

The platform utilizes advanced analytics, machine learning algorithms, and anomaly detection to identify threats and suspicious activities.
It offers extensive integration options with other tools and platforms, facilitating a more cohesive and comprehensive security ecosystem.
With Kibana, users gain access to powerful visualization tools and dashboards that provide real-time insight into security data.

Finally, Elastic Security benefits from a global community of users who contribute to its threat intelligence, helping to enhance its detection capabilities. This collaborative approach ensures that the solution remains on the cutting edge of cybersecurity, with up-to-date information on the latest threats and vulnerabilities.

Elastic

Graylog is purpose-built to deliver the best log collection, storage, enrichment, and analysis. Graylog is:

Considerably faster analysis speeds.
More robust and easier-to-use analysis platform.
Simpler administration and infrastructure management.
Lower cost than alternatives.
Full-scale customer service.
No expensive training or tool experts required.

Sample Customers

Texas A&M, U.S. Air Force, NuScale Power, Martin's Point Health Care

Blue Cross Blue Shield, eBay, Cisco, LinkedIn, SAP, King.com, Twilio, Deutsche Presse-Agentur

Elastic Security vs. Graylog