Elastic Stack Reviews

I work as an Elastic consultant, so I am interested in learning about other tools.

The ability to deploy Elastic Stack both in the cloud and on-premises meets my organization's infrastructure needs and compliance requirements completely. Elastic holds most of the compliance requirements that customers would ever need, including being HIPAA certified and possessing various security-based certifications. Many government organizations use Elastic Stack, so it aligns with compliance standards.

The centralized logging capabilities of Elastic Stack have helped me streamline my logging processes significantly because there are many open-source tools available, such as Filebeat and Logstash, to collect the logs. Some people are using Vector these days, which is built on Rust, making it very fast. Since it is open-source, I can push logs from anywhere, and most of the client tools available that can push logs are open-source.

In terms of centralizing, this tool is mostly built for that purpose. People who are using traditional bases face a challenging issue with the schema; without a proper understanding of the schema, they cannot search. However, with Elastic Stack and other Lucene-based or indexing-based tools, everything is converted to JSON, parsed, and ingested. I can do full-text search within seconds because it creates inverted trees at the time of indexing itself.

The best features of the Elastic Stack are that it is mostly out of the box. Predominantly it is built as an indexing tool to store logs and gives me the ability to search quicker. Over time, they have built many frameworks on top of it, such as the security feature and centralized agent monitoring.

I can scale the cluster depending on the costing. I have all these data tiers, such as hot, cold, and warm, so based on the customer's use case, I can decide if they only need two days or three days' worth of hot data, and the remaining can be saved in a frozen tier, where everything is saved in an S3 bucket but still accessible for searching.

The most important feature now is the Elastic Agent, which comes with out-of-the-box integrations for most firewalls, Windows, Linux, and many other systems, and is improving. All I need to do is deploy the agent, deploy the connector, and they have the out-of-the-box parsers. Moreover, the detections in terms of security come out of the box as well. In terms of go-to-market, I can very quickly deploy a system for any customer without taking much time at all.

There are improvements needed for Elastic Stack. It is mostly based on Lucene, and the heart of Elastic Stack is Lucene, which has some limitations. Anything built on top of Lucene often feels an add-on, and that includes vector databases. Elastic Stack can store vector embeddings as well and perform AI and machine learning tasks out of the box without excessive configuration.

The main improvements involve increasing speed and compression capabilities; I have seen databases that claim to achieve significantly better compression. While Elastic Stack can manage vast amounts of data, if the mapping is not specified correctly, the indexing time can be slow, especially with many events per second. Improper mapping usually means that every document received gets indexed for all fields, which is not desired. Elastic consultants typically optimize this, but out of the box, as data volume increases, scaling becomes necessary. They are working on these improvements in new versions.

I have been dealing with Elastic Stack for five-plus years.

Elastic Stack supports high availability in my systems because it is a clustered system. I have at least two or three master nodes and multiple data nodes, which can be segregated for disk tiering based on disk performance. My hot tier runs on NVMe drives, while the cold tier may use slower disks or even EBS storage. High availability is configurable; by default, anything I ingest has a replica saved elsewhere on a different node, so no primary and replicas reside on the same machine. If a machine goes down, I can bring in another node, and it recovers on its own.

I would rate their technical support a seven. The support personnel I work with are knowledgeable and helpful. However, the quality depends on the service agreement I have with Elastic Stack; not every customer has an enterprise subscription. If I do have an enterprise subscription, they are typically available within 30 minutes for a Sev1 issue, but lower-tier licensing may lead to slightly delayed responses. Resolution is much quicker if they are on the call. I often find that support is similar across most tools, which is why I would rate them a seven.

Neutral

I am not working with any new solution, but out of curiosity, I am comparing a few others.

The initial setup of Elastic Stack is very straightforward. Setting it up is easy; to go to the cloud, I just need to visit elastic.cloud, select my preferences, and I do not even need to choose specific hardware. I select the region, such as AWS or Azure, and enter my anticipated data retention needs, such as 120 GB of storage. Based on my expected ingestion, I key in that size, and the system automatically selects the appropriate hardware and shows me the costs per hour or month. It allows me to create an account quickly, making it simple.

My experience with Elastic Stack pricing indicates that it is node-based. While I do not have complete pricing details, they are available online. If I choose Elastic Cloud, it includes licensing and data transfer costs. To start with a bare minimum cluster in Elastic Cloud, such as a two-node cluster, the cost is reasonably low, around $5 to $6, for a setup that can store about 120 GB of data with all features enabled.

While starting, I can monitor external endpoints without needing an agent, but eventually, there are charges for API calls. For smaller usage scenarios, such as 5,000 to 10,000 events per second, it is relatively affordable compared to Splunk. However, costs can escalate for higher volumes of events, such as 100,000 per second.

The flexibility of Elastic Stack when handling diverse data types is remarkable. It works as a log management tool, so anything I ingest into Elastic Stack undergoes a full-text scan, extracting tokens and creating an inverted index behind the scenes. This allows me to search for specific words or groups of words without any parsing, pinpointing documents effortlessly.

Users do not always just search; they also want to create dashboards and aggregations. In such cases, I can write parsers to break down messages and create fields such as text, keyword, or numeric fields. It is very flexible; I can ingest everything in its raw format and then refine it later, giving developers time to devise the proper schema and mappings.

X-Pack features have had a significant impact on my systems because X-Pack used to be a licensed feature for the open-source version of Elastic Stack, but now it is more integrated with different licensing tiers such as platinum and gold. Some customers who primarily operate in Kubernetes have deployed those as well.

I use the cost-to-performance ratio as the primary metric to measure the impact of the centralized logging capabilities, as most of the customers I deal with are really concerned about the cost. Performance metrics typically center around events per second, which are crucial for capturing performance. When building a system, it is not just one tool; it requires additional brokers such as Kafka. Even those can be monitored through Elastic Stack.

Security is one of the use cases, and observability has a separate connector. They also have out-of-the-box integrations for Kafka, RabbitMQ, and all the other systems, so I just need to deploy an agent and configure JMS or Kafka. All the logs and metrics are collected, and they come with their own dashboards. If someone wants to start a monitoring solution and later extend it to a security solution, it is seamless. They can start very small and pay very little, then explore additional features over time. That is how I perceive Elastic Stack.

I would rate the overall product as a nine.

Elastic Stack is primarily used for everything related to security, including security systems, checking the security system, and also servers and networks.

The features I find most valuable in Elastic Stack include the very good search speed for checking problems. The search speed is the best.

I have benefited from the security features provided by X-Pack in Elastic Stack, particularly the SIEM capability, which is very good for checking security issues.

The impact of these security features on my data security and risk management is very good. We face some problems with the security system and we check the network traffic and web access logs regularly, always using Elasticsearch.

I would like to improve Elastic Stack by addressing the current big problem we face with importing logs and log files, such as syslogs. To import these log files, we need to design the ingest pipeline using an Elastic Agent, which is part of the new version of Elastic Stack.

I believe the next release of Elastic Stack should include AI functionality, and we are hoping to use that AI functionality.

I have been working with Elastic Stack for almost two years.

I would assess the scalability and flexibility of Elastic Stack when handling diverse data types as good. It means that if I want to know about Elasticsearch functionality or features, it is good for checking logs without degradation in search functionality, even if we check a lot of logs or many stacks.

I rate the scalability of Elastic Stack as eight or nine out of ten, where ten is the best.

I would rate the technical support by Elastic as five or six out of ten. There is a problem there.

They should improve their response time and first-level support, particularly knowledge, which is very important for using Elasticsearch. The supporting skills are very important, and we have not had good technical support at this moment.

Positive

Before Elastic Stack, I worked with a similar product called Splunk.

The initial setup for Elastic Stack is a little bit difficult to configure and construct Elasticsearch system.

Almost ten people in my organization are using Elastic Stack. Our operating personnel are utilizing Elasticsearch.

I have not specifically calculated a return on investment, but it is definitely good for us.

Splunk is easier to use, particularly regarding the interface. The configuration and connection between other systems are also better.

Integration with other systems is easier for Splunk than it is for Elasticsearch.

Given that we have many servers, it takes almost six months to create and configure the entire system.

The price is reasonable, which helps us reduce the workload.

I rate this product eight out of ten.

The main use cases include maintaining and monitoring my client's internet platform. I am plotting reliability and scalability monitoring through Elastic Stack.

The scripting model in Elastic Stack allows me to query logs and then put the data into Grafana. I use ELK scripts for complex customer scenarios. The search capabilities are helpful as they allow me to fetch data and then display it on Kibana.

Elastic Stack should be more simplified with ready-to-use widgets. Also, incorporating AI capabilities is essential as monitoring and observability tools are now adding AI features. 

Ideally, it should evolve into a full-stack observability tool, similar to AppDynamics or DynaTrace, which offers a solution that includes ISP provider, API monitoring, and infrastructure monitoring.

I have been working with Elastic Stack for the last five years.

I rate the stability of the product as eight out of ten.

The product's scalability is also very good, and I rate it eight out of ten.

The technical support is good, however, having domain expertise on ELK is necessary to implement it. It would be helpful if the process was simplified.

You need domain knowledge on ELK; otherwise, it is difficult.

I may not be able to answer as this is customer-paid Elastic Stack, and I didn't handle the payment.

Prometheus and Grafana support monitoring purposes. DynaTrace and AppDynamics, post the integration with Cisco's ThousandEyes and Splunk, are main competitors providing full-stack observability tools.

I rate Elastic Stack eight to nine out of ten. 

`It is an excellent tool for monitoring purposes. I recommend Elastic Stack to others and have done so.

Our primary use case for Elastic Stack is to stack our logs in one place.

Elastic Stack has made a positive impact as we can now see our logs.

The only beneficial aspect of Elastic Stack is that it's open source.

Elastic Stack needs more features similar to other SIEM tools such as Sentinel or the ability to create automations. Additionally, it should facilitate easier manual integration.

I have been using Elastic Stack for a few months.

The stability of the solution is rated as three or four out of ten as we frequently encounter issues.

The scalability is rated as four out of ten as it lacks auto detect and auto deploy features. Everything needs to be done manually on-site.

I haven't had any experience contacting their technical support.

I did not use a solution before Elastic Stack.

The initial setup of Elastic Stack was okay.

The implementation was done in-house.

We use Elastic Stack's open source version, so it is free for us.

I did not evaluate other options.

I would recommend Elastic Stack only if there is no need to pay for it.

I'd rate the solution five out of ten.

We're using Elastic Stack for logging as part of our MDR solution within a SIEM system. We have developed our user interface on top of the Elastic Stack. We leverage Elastic for its storage and parsing capabilities.

It provides a faster response.

It supports various integrations. It's open source and has excellent community support.

There could be better documentation. They should improve to capture more data because we have to migrate to another vendor called Wazuh, which provides a full-fledged capability compared to Elastic.

I have been using Elastic Stack for two years.

I rate the solution’s stability a nine out of ten.

There could be a high availability structure. We had around 40 customers using Stack.

Slack community of Elastic is good.

The initial setup is straightforward. We have to do a lot of research & development and hit-and-try levels. There is little knowledge of resources available to begin training them.

It's an application that is good for the planet. There is no challenge or consultation from external sources.

Elastic Stack provides such capabilities, reducing the mean time needed to detect compared to other tools.

The significant versions might be compatible since our products depend on some features.

If you want to invest in Elastic Stack, you can start with a paid subscription instead of going open source.

Overall, I rate the solution a seven out of ten.

Initially, my company started with Elastic Stack for some kind of search in one of the mobile-related projects we were handling and when Kibana was available in the beta release version. My company enabled Elastic Stack for most of the cases of one of our customers, and mostly, it was for the search-related area. My company managed the search for complex scenarios, not only for the logs but also for the FDA and drug database for the physicians involved in one of the healthcare projects, where the search capability had to be enabled. Apart from AWS, Amazon CloudWatch offers a faster setup process for Elastic Stack. With AWS, my company used ELK Stack and Kibana for all kinds of other things instead of Amazon CloudWatch.

One of the biggest assets of the Elastic Stack is its search capability, as it is one of the core features that my company leverages for most things, including the search of logs. Regarding the timestamp and retrieval of logs, anyone apart from the production support with proper access can search the log timestamp, including the exact details of what has been logged and what caused the issue. For application-related or large sets of data that are not relational, like in a JSON format, my company is pushing and putting across the Elasticsearch index, and once it is enabled, the search can be made faster.

Elastic Stack provides all sorts of things, so it provides Elasticsearch for the transformations into a specific format, and pipelines can be defined for distributed applications along with the logs that come in the JSON format, which is clean. It's only the enhancements or the security that the product lacks and needs to be enhanced. I don't think further enhancement of the features needs to be added to the solution because it is already equivalent to a monitoring or alerting system, like Dynatrace and other tools. Some developments in the area of AI, which Elastic Stack is currently working on, should be fine in terms of the enhancements.

Whenever some critical issue happens, there should be some kind of a co-pilot that helps resolve the issue. The tool should learn from its own previous issues. If you take Databricks, you see that it provides a co-pilot for Python, so a similar kind of development in Elastic Stack would be a real asset for it.

AI would be considered a good way to enable the tool further for more in 2024, and even a beta launch would be helpful. If you take any sort of cloud-native monitoring product, like Azure Monitor or AWS CloudWatch, you see that such products don't provide much of the insights. If you go with Azure Monitor for any sort of ML models to be there, Sentinel needs to be used from Azure, which is very costly.

AI-enablement would be a big improvement in Elastic Stack. Everyone in the monitoring space, including Dynatrace and New Relic, has lately been discussing AI, but it doesn't seem to be coming out. If there is room for an ML model in Elastic Stack, then it would be good.

I have been using Elastic Stack for more than seven years.

The stability of the product is good as it can be fine-tuned to meet all its specified parameters by following the best practices.

Scalability-wise, I rate the solution an eight out of ten.

The scalability depends on how the cloud team, the DevOps team, or the development team uses the in-built functionalities in the solution, like the indexes, as they occupy quite a lot of space, making it pretty slow.

At any given point in time, the concurrent users of the tool would be around 1,000.

The online forum of the product is fine since anybody can respond to it to help resolve someone else's issues. My company has never contacted the support team of Elastic Stack.

Azure Monitor or the AWS CloudWatch provides only cloud-native services, so you will be able to monitor only the services of Azure or AWS since neither of the products is a cloud-agnostic tool in nature. If you take Azure Monitor and monitor something in AWS, it is not possible. The agent is not comfortable with Azure Monitor, where AWS services are monitored, meaning one may face some difficulties. Elastic Stack is a cloud-agnostic product, so you can have Elastic deployed on Azure, and you can monitor AWS or GCP services as well.

The product's initial setup phase was simple.

The solution is deployed on the cloud.

The solution can be deployed in half a day. With all the cloud security, subnets in place, and the other things being allocated, everything can be completed. Our company does have some sort of scripts to take care of the deployment part, so we have written some Terraform scripts from scratch, which pull the Docker image, the latest version of the Docker image, and then deploy it onto the VM.

I took care of the product deployment phase by myself.

For a few of the cases, my company uses the license to the version of the solution, and for a few other cases, we use the cloud-managed service by AWS since Elasticsearch is equivalent to OpenSearch with AWS, along with a few of the tweaks that are there, but ultimately both the products are one and the same.

The pricing of the product depends on how the capacity planning has been done in your company and the plan that has been chosen for use in the environment. Ultimately, the pricing depends upon the capacity planning that the enterprise architect does.

The security part of the product is fine since, anyway, it gets deployed in a VPC or under a subnet, so the cloud provider takes care of the security part.

I rate the overall tool a nine out of ten.

In my company, we use Elastic Stack for managing logs from various equipment, and then we create alerts in some cases before sending them to one of our projects.

The most valuable feature of Elastic Stack is its ease of implementation. The tool has various services like security, managing, and searching logs. Elastic Stack is one of the best tools, and I highly recommend it since it influences everything in one's environment.

The implementation of dashboards in the solution needs to be made easier. Last year, I implemented dashboards with the help of Docker's compose file, and I had some issues with the ports and configuration since it was kind of complex to implement with Docker.

The product's dashboard and maintenance are two areas that need improvement.

I have experience with Elastic Stack beginning in 2023. I am an end user of the solution. I used Elastic Stack as a part of one of our company's projects involving certain security aspects for three months.

The solution's stability was great. I only had issues with the pieces of equipment we were using in our company since I don't have such a great server, restricting the use of only features that open on my computer. Stability is an area that can be terrible if you don't have a great server.

It is a very scalable solution. It is very easy to scale up logs. I didn't face any problem with this scalability part of the solution since we only have a few pieces of equipment in our company. For bigger enterprises, I am unsure if the product would be a very scalable one.

Elastic Stack was used in our company for just one project, so only one of my colleagues and I were using it.

My experience with the solution's customer support team was great. Though I hadn't interacted much with the technical support team, they used to respond via emails if we faced some issues with the solution in our company.

I use Apache Kafka to manage the flow between two databases.

Elastic Stack's deployment process could be done easily because of the documentation and availability of videos everywhere related to the deployment phase.

The deployment process for the product got completed within a few days.

One of my colleagues and I were the only two people involved in the product's implementation phase.

I used the open-source version of Elastic Stack, because of which I did not have to pay anything.

I want to use some tools so that I can manage and visualize the flow while having scalability and availability options.

I have experience with the benchmarking of Splunk, IBM, and QRadar. I had only searched for the videos and documentation of the aforementioned tools and didn't use them since they weren't open-source products. Pricing was a major area of difference between Elastic Stack and the products I evaluated.

For those looking for just some support products or an open-source service, Elastic Stack can be a great choice. For organizations handling big projects, IBM STACK can be a better choice compared to Elastic Stack.

The maintenance part of the solution was difficult since I wasn't aware of the process, but after doing a few searches online, I felt the maintenance part to be good. Some additional knowledge is required to maintain the product.

I rate the overall solution an eight out of ten.

Elastic Stack is used for advanced search and observability purposes. It is utilized for Application Performance Monitoring and log monitoring in daily operations. 

Elastic Stack is mainly used to monitor servers and APIs. It helps ensure the software's availability and sends notifications at the right time so the system is not down for a long time. The tool's stability and advanced features, such as anomaly detection, are the most valuable features. The benefit of using it is real-time monitoring. 

The solution is expensive, particularly the training and certification. If customers want to increase their use of Elastic Stack, they should consider reducing the cost of certification and training.

I have been using the product for six months. 

I would rate the stability of Elastic Stack between seven to eight out of ten. It may vary depending on the specific features being utilized. 

I rate the solution's scalability a nine out of ten. Scalability impacts the project based on how well the initial sizing is done. If the initial sizing is done properly, there won't be many challenges. Scalability becomes relevant when dealing with complex applications and large amounts of data. My company has two to three users for it. 

The tool's technical support is reasonably good. It is knowledgeable, and the technical support team is quite helpful.

I rate the product's deployment a nine out of ten. It is easy for technical resources. You can manage deployment with two or a maximum of three individuals. Maintenance depends on the number of hours and shifts you're operating. At least one person is needed to create dashboards or reports.

I rate the overall product a nine out of ten.The feedback so far has been good. Timelines that should take four to five weeks have been accomplished in just two to three days.

The biggest strength of Elastic Stack is its brilliant archiving capabilities.

Improvements are needed in the solution in areas like SOAR and TIP, where there are certain shortcomings.

When it comes to Elastic Stack, it doesn't matter if the product is mature or professional, like the other vendors in the market who offer TIP tools. Elastic Stack needs to have some features similar to the other tools that offer SOAR and TIP functionalities.

From an improvement perspective, Elastic Stack's support team should have more people with expertise, and the response time should be minimized. There are no SOC analysts available at Elastic Stack's support team's end to resolve big or major issues. Small issues in the product can be resolved quickly by going to the availability of an online community from Elastic Stack's end, which is friendly and useful.

The product lacks automation capabilities, making it an area where improvements are required. The product should also be able to integrate with multiple tools that offer TIP functionalities.

I have been using Elastic Stack for a year and a half. I work in the sales department of my company.

Stability-wise, I rate the solution a nine out of ten.

I rate the stability of Elastic Stack high when compared with other products like LogRhythm, ArcSight, or FortiSIEM.

Scalability-wise, I rate the solution a ten out of ten.

I rate the scalability of Elastic Stack as high when compared with other products like LogRhythm or ArcSight, with which I have faced many problems in the past. If the size or number of users exceeds 50,000 or 80,000 in LogRhythm or ArcSight, I need to ensure that I depend on an expensive cluster setup, which won't perform well. With Elastic Stack, you can expand by just adding a new setup, during which you need not turn off the servers in your environment.

Elastic Stack's support team is not good. What makes the tool useful is that most of the SOC people in my company know about Elastic Stack because there is a free version of the product that they use, but if they get stuck with something and need support, they don't get any help. I can rate the technical support a four out of ten.

Neutral

I have experience with LogRhythm and ArcSight.

LogRhythm and ArcSight are better than Elastic Stack when it comes to the area of dashboards, so you can find which dashboards you want. The stability, expandability, and support of LogRhythm and ArcSight are not like Elastic Stack. For IBM users, Elastic Stack can be complex. In general, users of Elastic Stack find the product to be too expensive to be renewed.

Elastic Stack is one of the easiest vendors to deal with when it comes to the initial setup phase. During the initial setup phase, users need to manage the servers and set them up, after which the setup phase of Elastic Stack is easy. It is a very easy process to set up the tool if the prerequisites are met before the setup process is carried out.

If I compare Elastic Stack to the other products in the market, I would say that the tool is available at a competitive price. I don't like to compare Elastic Stack with a vendor like Fortinet, which offers FortiSIEM at a very low price. Compared with products like IBM QRadar SIEM, LogRhythm, and ArcSight, the price of Elastic Stack is much better. Elastic Stack offers certain module, like EDR, for free, which are not available in other products.

I recommend the solution to those who plan to use it. The tool's potential users should use it not just as a SIEM tool but as a complete security platform. The tool has a lot of advantages, and it is better for users to implement and use all the modules that are available in the product. The tool can be considered as a product that can be integrated with other platforms to get full security for an environment.

When it comes to the area of dashboards in Elastic Stack, they are not very easy to build and may not be enough for you, especially if you need to integrate them into the environment of a big entity with multiple security protocols. You may have to build everything by yourself to use the dashboards in Elastic Stack.

I rate the overall product a seven and a half to eight out of ten.

We use the solution to do threat analysis. We also have an integration with a threat intelligence platform.

The machine learning capabilities are valuable. I also like the auto-recognition of the fields with the data sources. The product can be deployed easily. All these features are available in the community version. The enterprise version might be much better. The SaaS version is way better. The solution has many features. It is very easy to learn and scale up. We can learn the query language very easily.

Agent deployment is a little tough in the on-premise version. Fleet Manager is tough to use. The configuration is tough. The SaaS version might not have such issues, though.

I have been using the solution for a year.

The tool is very stable. We didn’t see any lag in the product.

If we use the Kubernetes version, it will auto-scale directly. We are using the tool for machine-learning purposes. We have 1 TB of log sources.

The initial setup is very easy. We just have to do a Docker deployment.

We are using the open-source community version of the product.

I am using the latest self-hosted community version. It suits our needs. If someone wants to use the product, they must consider their scalability needs. They must think about how much they're going to ingest and how they’re going to retain the data. They might have to put it into hot, cold, and warm types of data storage. We must consider all these things before deploying the product. Overall, I rate the solution a nine out of ten.