Grafana Loki vs. Logstash

AWS integrations are easy, metrics are easily accesable Long term log insights need to be thought out and set up carefully

Incentivized

Logstash is a must in an ELK stack, which I am sure is going to be the #1 case. At any point when you have several sources, Logstash can be the common point to aggregate, and categorize those data. Then send this new data to its destination. Very handy. It is free and open source. It may not be appropriate to analyze data-sets dependent on each other but from a different data source. Reason being Logstash works on data at hand, and not wait for other data to arrive. It would be unwise for Logstashh to handle complicated, long-running transformations because this is injected and ejected. The faster you do it, the safer.

Incentivized

• Integration with AWS
• Notifications land where they should
• Broad integration options

Incentivized

• Plugin ecosystem allows modular extensions.
• Tight integration into the Elastic.com products of Beats and Elasticsearch, so minimal setup is required when using those tools.
• Filter plugins are powerful for extracting and enriching input data.

Incentivized

• Offer log suggestions.
• Offer basic query syntax check.
• Offer data range controls.

Incentivized

• Memory: Logstash is a HOG, if you are deploying it on commodity (i.e. cheap and old) hardware: You will need at least 2GB, just for Logstash. So don't expect to run your entire ELK stack on one AMD Athlon machine.
• Overlap: Logstash fills in an area of the ELK stack that makes the most sense: as a log file transformer / shipper. However, if you start breaking that stack, with the addition of other components- you start seeing where features of Logstash may be implemented or solved in the additional components much easier (or better, or to a higher degree of resolution)
• More Overlap: Since my team employs Syslog-ng extensively- Logstash can sometimes get in the way (and this may be a problem for DevOps stacks overall): You can configure Syslog to record certain information from a source, filter that data, and even export that data in a particular format. Logstash will pick that data up, and then parse it. However, if you don't keep your Syslog-ng configuration files, and your Logstash configuration files in sync, your results will not be what you expected, and this will translate into (sometimes) hours/days of work, hunting down a line item in a configuration file.

Incentivized

I think it is very developer minded and has a very high learning curve

Incentivized

As I said earlier, for a production-grade OpenStack Telco cloud, Logstash brings high value in flexibility, compliance, and troubleshooting efficiency. However, this brings a higher infra & ops cost on resources, but that is not a problem in big datacenters because there is no resource crunch in terms of servers or CPU/RAM

Loki is an essential complement to Grafana and provides logging metrics for dashboards and other visual tools. Loki can handle the service logging, while other data source plugins can provide more specific quantifiable metrics to support the logging data. Different types of metrics make a robust data dashboard.

Incentivized

MongoDB and Azure SQL Database are just that: Databases, and they allow you to pipe data into a database, which means that alot of the log filtering becomes a simple exercise of querying information from a DBMS. However, LogStash was chosen for it's ease of integration into our choice of using ELK Elasticsearch is an obvious inclusion: Using Logstash with it's native DevOps stack its really rational

Incentivized

• Enable engineers to access logs quickly to distribute the workload.
• Provide a possible standard for log access between multiple services.
• Provide data metrics for customer use.

Incentivized

• It is very difficult to give any figures on ROI, as it depends on many factors, and in a Telcocloud environment, it is much complex to find out; however, I would give some points below on ROI
• ROI based on flexibility is very high, as it reduces the time to find RCA
• ROI based on integration is very high because it supports multi-vendor environments, avoiding vendor lock-in & works across multi-cloud setups
• ROI on resource consumption is less because Logstash in 2-3 times more resource-intensive as compared to its lightweight alternatives resulting in latency