Security Operations
Log Management Tools in 2026: Ingest, Retention, and Search
Keep cheap ingest and search when the SIEM meter cannot take another source.
Expertise: Security Operations · Level: Intermediate · 6 min read
Can you keep the line when the SIEM meter cannot take 1 more source? Most SOCs already pay a detection console. That console looks healthy until ingest is the bill.
Cheap durable ingest is not a second hunt UI. Log management is the store that still accepts the firehose when you cannot afford another billed source on the detection product.
The miss in production is a source you dropped because the meter screamed, then a week later you cannot search the host that actually failed. If you need to hunt, that query language still lives on a SIEM. This shortlist is for keeping the bytes.
Hosted stores, open pipelines you run, and the SIEM you already pay that also wants to be the archive are not the same purchase. Buy the archive first when the constraint is volume, not a new correlation language.
How we evaluated
We read first-party docs, source, licenses, and release notes, and we treat a marketing page as a claim, not as proof that two products do the same work.
We cared about whether you query the product or only ship through it, whether you operate it, the license or commercial meter, and whether the docs name a query or pipeline you can run on logs you own. Elasticsearch missed because Elastic Security already sits on the SIEM list.
We read first-party docs, licenses, and release notes. Unless a write-up says otherwise, we did not run a paid tenant.
| Tool | Best for | What to check |
|---|---|---|
| Grafana Loki | Label-cheap logs you can still grep | Label index · AGPL-3.0 · you host it |
| Graylog | Open log option you operate | Streams · SSPL / commercial · you operate it |
| OpenSearch | Search-native log store you host | Apache-2.0 · you operate it · indices, not labels |
| Vector | Ship logs without a second SIEM | MPL-2.0 · pipeline as config · you run the agent |
| Cribl | Commercial route before the meter | Commercial · route and reduce · quote the meter |
| Splunk | Known meter you already pay | Commercial · known meter · heavy forwarders |
Grafana Loki
Best for label-cheap logs you can still grep
Loki indexes labels, not every line. You pay for metadata, then LogQL pulls the matching chunks. That is why teams reach for it when full-text ingest is the tax.
You host it and pair it with Grafana. It is not a detection platform. You still write the query, and AGPL-3.0 is the license on the core.
Key features
- Label index
- LogQL
- You host it
- Pairs with Grafana
Why we like it
When the SIEM tax is full-text ingest, labels you can still grep are the cheaper store that still lets you grep.
Limits
AGPL-3.0. It will not hunt for you. You staff the box and you own the LogQL.
Graylog
Best for open log option you operate
Graylog is a log platform with extractors and streams. Open core is what you can run. Enterprise is a paid add.
A lot of shops already operate it, so it sits next to Loki as the other open option, not as a cute alternative nobody staffs.
Key features
- Streams and extractors
- You operate it
- Alerts on the public docs
- SSPL on the core
Why we like it
Extractors and streams are a real operator model. You are not pretending a shipper is a store.
Limits
SSPL is not Apache. You staff the cluster. Enterprise features sit behind a sales motion.
OpenSearch
Best for search-native log store you host
OpenSearch is the Apache fork of Elasticsearch. Logs are indices. Dashboards are in the same project.
If you want search without the Elastic license talk, this is the store. The SIEM list already covers Elastic Security. OpenSearch is the index, not that console.
Key features
- Apache-2.0
- Dashboards
- You operate it
- Huge operator memory
Why we like it
Apache-2.0 plus a query language operators already know. That is a clear buy when license talk is the blocker.
Limits
You staff it. Indexing everything is how it stops being cheap.
Vector
Best for ship logs without a second SIEM
Vector is a shipper. Sources, transforms, and sinks live in config. Datadog opened it under MPL-2.0.
A store without a shipper is a hope. Vector is the agent you run. It does not detect, and it does not keep a week of lines unless you pick a sink.
Key features
- Pipelines as config
- Many sinks
- MPL-2.0
- You run the agent
Why we like it
The pipeline is readable. You can prove a source and a sink on a host you own without buying a second SIEM.
Limits
It is not a store. You still pick the destination and you own the failure path.
Cribl
Best for commercial route before the meter
Cribl sells Stream: reduce and route before the SIEM bill. The job is volume, not a new query language.
If the tax is ingest, a router is the product. The query still lives somewhere else. Open SIEM alternatives for the query language.
Key features
- Route and reduce
- Many destinations
- Commercial
- Known in SIEM estates
Why we like it
When the hole is volume, routing before the meter is the commercial product teams already pay for.
Limits
Commercial. It will not replace the console you query.
Splunk
Best for known meter you already pay
Splunk is on the SIEM list. Here it is the ingest you already bought. Overlap is declared on purpose.
If the pipe is already Splunk, start by cutting sources. Adding a fourth store without turning something off is how the meter stays red.
Key features
- Heavy forwarders
- Index time you pay for
- Known SPL
- Commercial
Why we like it
Naming the meter you already pay is the point of this shortlist. The purchase may be subtracting, not adding.
Limits
Price is the hole this page exists to dodge.
What we left out
- Fluent Bit. People want a tiny forwarder they already run on Kubernetes. It ships and does not store, and Vector already covers that work on this page.
- Elasticsearch. Teams already search there. Elastic Security already sits on the SIEM alternatives list.
Log threads treat ingest cost as the real SIEM. A cheap store is not a detection.
Questions before you buy
If procurement cannot get written answers, you are still buying a brochure.
- Can I still grep a week of this source after we stop paying the SIEM meter for it?
- Do we operate the cluster, or are we buying a hosted product we cannot export?
- Is this a store, a shipper, or a router, and which sink already exists?
Keep or move the line here. Open SIEM alternatives when the gap is the query language.
FAQs
Does a log store replace the SIEM?
No. A log store is the pipe. SIEM alternatives is the detection console.
Should I index every field?
No. That is how the meter returns. Labels and a query you can afford.
Is Cribl a SIEM?
No. It routes. The query still lives somewhere else.
Is this a scored bake-off?
No. Order is editorial.
