Security Operations
Log management tools that keep the pipe when SIEM is the tax (2026)
A 2026 shortlist of durable ingest when the SIEM bill is the hole. Public docs, not a lab bake-off.
Expertise: Security Operations · Level: Intermediate · 12 min read
A detection you cannot store is a wish.
The SIEM dropped the SaaS source because the meter went red. Log management is cheap durable ingest you can still query. The SIEM alternatives list is the detection console. This page is the pipe.
Six pipes. One label store. Two open search shelves. One shipper. One commercial router. One known meter. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Grafana Loki | Label-cheap logs you can still grep | AGPL-3.0 |
| Graylog | Open log shelf you operate | SSPL / Graylog terms |
| OpenSearch | Search-native log store you host | Apache-2.0 |
| Vector | Ship logs without a second SIEM | MPL-2.0 |
| Cribl | Commercial route before the meter | Commercial |
| Splunk | Known meter you already pay | Commercial |
Grafana Loki
Best for label-cheap logs you can still grep
Loki indexes labels, not every line. You pay for metadata. The query is LogQL.
Key features
- Label index
- LogQL
- You host it
- Pairs with Grafana
Why we like it
This is the hidden gem when the SIEM tax is full-text ingest.
Limits
AGPL-3.0. It is not a detection platform. You still write the query.
Graylog
Best for open log shelf you operate
Graylog is a log platform with extractors and streams. Open core. Enterprise is paid.
Key features
- Streams and extractors
- You operate it
- Alerts they document
- SSPL on the core
Why we like it
A lot of shops already run it. We list it so Loki has a neighbor.
Limits
SSPL is not Apache. You staff the cluster.
OpenSearch
Best for search-native log store you host
OpenSearch is the Apache fork of Elasticsearch. Logs are indices. The SIEM list already rows Elastic. This is the store.
Key features
- Apache-2.0
- Dashboards
- You operate it
- Huge operator memory
Why we like it
If you want search without the Elastic license talk, this is the store.
Limits
You staff it. It is not cheap if you index everything.
Vector
Best for ship logs without a second SIEM
Vector is a shipper. Sources, transforms, sinks. Datadog opened it.
Key features
- Pipelines as config
- Many sinks
- MPL-2.0
- You run the agent
Why we like it
A store without a shipper is a hope. Vector is the honest agent.
Limits
It does not detect. You still pick a sink.
Cribl
Best for commercial route before the meter
Cribl sells Stream: reduce and route before the SIEM bill.
Key features
- Route and reduce
- Many destinations
- Commercial
- Known in SIEM estates
Why we like it
When the tax is volume, a router is the job. Link SIEM for the query.
Limits
Commercial. We did not run a tenant.
Splunk
Best for known meter you already pay
Splunk is on the SIEM list. Here it is the ingest you already bought. Overlap declared.
Key features
- Heavy forwarders
- Index time you pay for
- Known SPL
- Commercial
Why we like it
If the pipe is already Splunk, start by cutting sources, not by adding a fourth store.
Limits
Price is the hole this page exists to dodge. We will not reprint the SIEM six.
What the internet thinks about log management tools
Log threads treat ingest cost as the real SIEM. We keep that line. A cheap store is not a detection.
dineshkumar_cs on Hacker News, May 2023: “Use Prometheus or Influx for storing metrics, ELK or Opensearch or loki for logs, Grafana for visualization, and Jaeger for tracing.”
Prove Loki still publishes
Confirm Loki still publishes. Do not point a new shipper at production indices on the first run.
curl -fsSIL https://grafana.com/oss/loki/ | head -n 8FAQs
Does a log store replace the SIEM?
No. This page is the pipe. SIEM alternatives is the detection console.
Should I index every field?
No. That is how the meter returns. Labels and a query you can afford.
Is Cribl a SIEM?
No. It routes. The query still lives somewhere else.
Is this a scored bake-off?
No. Order is editorial.
