We performed a comparison between Datadog and Elastic Security (formerly ELK Logstash) based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.
Comparison Results: Datadog and Elastic Security have a similar user rating for ease of deployment, and users of both felt that the solutions were expensive. Users felt Elastic Security took too long to respond when it came to service and support. In terms of features, reviewers of Datadog had a problem with stability and felt there wasn’t enough monitoring through their dashboard. Reviewers of Elastic Security said they had difficulty retrieving data and felt the solution should offer predictive maintenance.
"The querying and the log-retention capabilities are pretty powerful. Those provide some of the biggest value-add for us."
"The most useful feature for us, because of some of the issues we had previously, was the simplicity of log integrations. It's much easier with this platform to integrate log sources that might not have standard logging and things like that."
"The alerting is much better than I anticipated. We don't get as many alerts as I thought we would, but that nobody's fault, it's just the way it is."
"The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events."
"The most valuable feature is that it has native MSSP capabilities and maintains perfect data separation. It does all of that in a very easy-to-manage cloud-based solution."
"The thing that Devo does better than other solutions is to give me the ability to write queries that look at multiple data sources and run fast. Most SIEMs don't do that. And I can do that by creating entity-based queries. Let's say I have a table which has Okta, a table which has G Suite, a table which has endpoint telemetry, and I have a table which has DNS telemetry. I can write a query that says, 'Join all these things together on IP, and where the IP matches in all these tables, return to me that subset of data, within these time windows.' I can break it down that way."
"One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful."
"The strength of Devo is not only in that it is pretty intuitive, but it gives you the flexibility and creativity to merge feeds. The prime examples would be using the synthesis or union tables that give you phenomenal capabilities... The ability to use a synthesis or union table to combine all those feeds and make heads or tails of what's going on, and link it to go down a thread, is functionality that I hadn't seen before."
"The most valuable aspect is the APM which can monitor the metrics and latencies."
"Because of our client focus, it is easy for us to sell. This is because it is easy to use and easy to set up."
"The service catalog helped improve our organization by giving a good view of the flow for our microservices applications."
"The most valuable features are the dashboards and the reporting."
"Dashboards and their versatility are among the most valuable features."
"The flexibility to create notebooks and dashboards and fully customize them gives us a lot of power to track the exact services and endpoints we are working on."
"The biggest thing I liked was the combination of all the things - monitoring, log aggregation, and profiling."
"We have hundreds of microservices, and knowing how top-level requests weave throughout all of them is invaluable."
"Elastic is straightforward, easy to integrate, and highly customizable."
"The indexes allow you to get your results quickly. The filtering and log passing is the advantage of Logstash."
"It is very quick to react. I can set it to check anomalies or suspicious behavior every 30 seconds. It is very fast."
"Elastic Security allows us to deliver visibility in a few hours, which makes our customers more confident in our service."
"I like the indexing of the logs."
"Its flexibility is most valuable. We can have a number of scenarios, and we can get logs from anything. If we know how to use Logstash, we can tweak it in many ways. This makes the logging search on Elastic very easy."
"The solution is quite stable. The performance has been good."
"One of the most valuable features of this solution is that it is more flexible than AlienVault."
"The overall performance of extraction could be a lot faster, but that's a common problem in this space in general. Also, the stock or default alerting and detecting options could definitely be broader and more all-encompassing. The fact that they're not is why we had to write all our own alerts."
"There are some issues from an availability and functionality standpoint, meaning the tool is somewhat slow. There were some slow response periods over the past six to nine months, though it has yet to impact us terribly as we are a relatively small shop. We've noticed it, however, so Devo could improve the responsiveness."
"We only use the core functionality and one of the reasons for this is that their security operation center needs improvement."
"Where Devo has room for improvement is the data ingestion and parsing. We tend to have to work with the Devo support team to bring on and ingest new sources of data."
"One major area for improvement for Devo... is to provide more capabilities around pre-built monitoring. They're working on integrations with different types of systems, but that integration needs to go beyond just onboarding to the platform. It needs to include applications, out-of-the-box, that immediately help people to start monitoring their systems. Such applications would include dashboards and alerts, and then people could customize them for their own needs so that they aren't starting from a blank slate."
"From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments."
"Some of the documentation could be improved a little bit. A lot of times it doesn't go as deep into some of the critical issues you might run into. They've been really good to shore us up with support, but some of the documentation could be a little bit better."
"Technical support could be better."
"They should continue expanding and integrating with more third-party apps."
"While the tool is robust with many different capabilities, users would greatly benefit from more examples in the documentation."
"Once Datadog has gained wide adoption, it can often be overwhelming to both know and understand where to go to find answers to questions."
"The sheer amount of products that are included can be overwhelming."
"When it comes to storing the logs with Datadog, I'm not sure why it costs so much to store gigabytes or terabytes of information when it's a fraction of the cost to do so myself."
"Sometimes it’s difficult to customize certain queries to find specific things, specifically with the logging solution."
"The documentation could be improved regarding setting up the agent properly and debugging."
"At times, it can be hard to generate metrics out of logs."
"The problem with ELK is it's difficult to administer. When you have a problem, it can be very, very difficult to rebuild indexes."
"With Elastic, you have to build the use cases for the specific requirement. Other products have a simple integration and more use cases to integrate out-of-the-box solutions for SIEM."
"Its documentation should be a bit better. I have to spend at least a couple of hours to find the solution for a simple thing. When we buy Elastic, training is not included for free with Elastic. We have to pay extra for the training. They should include training in the price."
"An area for improvement in Elastic Security is the pricing. It could be better. Right now, when you increase the volume of logs to be collected, the price also increases a lot."
"Better integration with third-party APMs would be really good."
"Elastic Security provides a huge amount of searchable data, which is a great advantage in itself but is costly in terms of the number of servers used."
"This type of monitoring is not very mature just yet. We need more real-time information in a way that's easier to manage."
"The solution does not have a UI and this is one of the reasons we are looking for another solution."
Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.
Datadog is a cloud monitoring solution that is designed to assist administrators, IT teams, and other members of an organization who are charged with keeping a close eye on their networks. Administrators can use Datadog to set real-time alerts and schedule automated report generation. They can deal with issues as they arise and keep up to date with the overall health of their network while still being able to focus on other tasks. Users can also track the historical performance of their networks and ensure that they operate at the highest possible level.
Some of the ways that organizations can benefit by deploying Datadog include:
Reviews from Real Users
Datadog is a solution that stands out when compared to many of its competitors. It can offer organizations many advantages. Two major advantages are the dashboards that users can create and the monitoring capability that it gives system administrators.
A senior manager in charge of site reliability engineering at Extra Space Storage writes, “The dashboards we created are core indicators of the health of our system, and it is one of the most reliable sources we have turned to, especially as we have seen APM metrics impacted several times lately. We can usually rely on logs to tell us what the apps are doing.”
Housecall Pro’s senior director of DevOps writes, “We value the monitoring capability since it allows us to be pushed alerts, rather than having to observe graphs continually.”
See how Devo allows you to free yourself from data management, and make machine data and insights accessible.
Datadog is ranked 2nd in Log Management with 101 reviews while Elastic Security is ranked 8th in Log Management with 18 reviews. Datadog is rated 8.6, while Elastic Security is rated 7.4. The top reviewer of Datadog writes "Provides insightful analytics and good visibility that assist with making architectural decisions". On the other hand, the top reviewer of Elastic Security writes "It is quite comprehensive and you're able to do a lot of tasks". Datadog is most compared with Dynatrace, New Relic APM, Azure Monitor, Amazon CloudWatch and AppDynamics, whereas Elastic Security is most compared with Wazuh, Splunk, Graylog, Microsoft Sentinel and Nagios Log Server. See our Datadog vs. Elastic Security report.
See our list of best Log Management vendors.
We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.