Datadog vs Elastic Security comparison

Cancel
You must select at least 2 products to compare!
Devo Logo
Read 16 Devo reviews
14,221 views|5,466 comparisons
Datadog Logo
52,984 views|38,974 comparisons
Elastic Logo
33,755 views|28,588 comparisons
Comparison Buyer's Guide
Executive Summary
Updated on Mar 30, 2022

We performed a comparison between Datadog and Elastic Security (formerly ELK Logstash) based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.

  • Ease of Deployment: Most users of Datadog felt the setup and deployment was straightforward, as long as they were familiar with the software. Users of Elastic Security said setup and deployment was easy, but with each additional server, it became more complex.
  • Features: Datadog users felt the software had great integration and error reporting, and that it provided great visibility, which helped proactivity around incident management. But users had a problem with stability and didn’t like that there was not enough monitoring through the dashboard.

    Elastic Security users thought the software was very flexible and scalable but felt the monitor was not mature enough. They also had difficulty retrieving data, and were unhappy that the solution didn’t offer predictive maintenance.
  • Pricing: Users of Datadog found the software expensive and the pricing model confusing. Users of Elastic Security said that licensing was expensive yet competitively priced.
  • Service and Support: Most Datadog users were satisfied with the level of support. On the other hand, Elastic Security users had mixed reviews regarding support; some said that response time took a while.
  • ROI: Users of Datadog had mixed reviews on the ROI; some thought the product was too expensive, which was why they hadn’t seen ROI yet.

Comparison Results: Datadog and Elastic Security have a similar user rating for ease of deployment, and users of both felt that the solutions were expensive. Users felt Elastic Security took too long to respond when it came to service and support. In terms of features, reviewers of Datadog had a problem with stability and felt there wasn’t enough monitoring through their dashboard. Reviewers of Elastic Security said they had difficulty retrieving data and felt the solution should offer predictive maintenance.

To learn more, read our detailed Datadog vs. Elastic Security Report (Updated: October 2022).
653,522 professionals have used our research since 2012.
Q&A Highlights
Question: Datadog vs ELK: which one is good in terms of performance, cost and efficiency?
Answer: With Datadog, we have near-live visibility across our entire platform. We have seen APM metrics impacted several times lately using the dashboards we have created with Datadog; they are very good core indicators of the health of our system. You can build very useful dashboards right out of the box using this solution. Our developers are able to see how code is running in production, and having custom built-in metrics gives us a wealth of knowledge and historical data that helps keep our system running smoothly. The pricing with Datadog can be very high. We feel there should be a more tiered approach to give users the opportunity to buy a more tailored product specific to their organizational needs. Datadog could also be more user-friendly. We would like to see deeper application-level insight and better incident management. Using ELK, you can gather authentication information from service providers and determine which identity provider is not performing properly. ELK is very flexible; you can have a number of scenarios and get logs from all of them. ELK is a very cost-effective solution. But it can be a complex solution to use. Better integration with 3rd party APMs would be very helpful. Currently, upgrades with ELK are released as stacks. Plugins or extensions would save removal and reinstallation and make the process move seamlessly. Conclusion We researched both of these solutions and concluded Datadog gave us the best visibility, better integration, and helpful, timely support. The logs and error reporting are extremely useful to conduct analysis and root cause analysis. The setup, ease of use, and flexibility with dashboard creation and reporting are just some of the things that our team liked about Datadog.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"The querying and the log-retention capabilities are pretty powerful. Those provide some of the biggest value-add for us.""The most useful feature for us, because of some of the issues we had previously, was the simplicity of log integrations. It's much easier with this platform to integrate log sources that might not have standard logging and things like that.""The alerting is much better than I anticipated. We don't get as many alerts as I thought we would, but that nobody's fault, it's just the way it is.""The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events.""The most valuable feature is that it has native MSSP capabilities and maintains perfect data separation. It does all of that in a very easy-to-manage cloud-based solution.""The thing that Devo does better than other solutions is to give me the ability to write queries that look at multiple data sources and run fast. Most SIEMs don't do that. And I can do that by creating entity-based queries. Let's say I have a table which has Okta, a table which has G Suite, a table which has endpoint telemetry, and I have a table which has DNS telemetry. I can write a query that says, 'Join all these things together on IP, and where the IP matches in all these tables, return to me that subset of data, within these time windows.' I can break it down that way.""One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful.""The strength of Devo is not only in that it is pretty intuitive, but it gives you the flexibility and creativity to merge feeds. The prime examples would be using the synthesis or union tables that give you phenomenal capabilities... The ability to use a synthesis or union table to combine all those feeds and make heads or tails of what's going on, and link it to go down a thread, is functionality that I hadn't seen before."

More Devo Pros →

"The most valuable aspect is the APM which can monitor the metrics and latencies.""Because of our client focus, it is easy for us to sell. This is because it is easy to use and easy to set up.""The service catalog helped improve our organization by giving a good view of the flow for our microservices applications.""The most valuable features are the dashboards and the reporting.""Dashboards and their versatility are among the most valuable features.""The flexibility to create notebooks and dashboards and fully customize them gives us a lot of power to track the exact services and endpoints we are working on.""The biggest thing I liked was the combination of all the things - monitoring, log aggregation, and profiling.""We have hundreds of microservices, and knowing how top-level requests weave throughout all of them is invaluable."

More Datadog Pros →

"Elastic is straightforward, easy to integrate, and highly customizable.""The indexes allow you to get your results quickly. The filtering and log passing is the advantage of Logstash.""It is very quick to react. I can set it to check anomalies or suspicious behavior every 30 seconds. It is very fast.""Elastic Security allows us to deliver visibility in a few hours, which makes our customers more confident in our service.""I like the indexing of the logs.""Its flexibility is most valuable. We can have a number of scenarios, and we can get logs from anything. If we know how to use Logstash, we can tweak it in many ways. This makes the logging search on Elastic very easy.""The solution is quite stable. The performance has been good.""One of the most valuable features of this solution is that it is more flexible than AlienVault."

More Elastic Security Pros →

Cons
"The overall performance of extraction could be a lot faster, but that's a common problem in this space in general. Also, the stock or default alerting and detecting options could definitely be broader and more all-encompassing. The fact that they're not is why we had to write all our own alerts.""There are some issues from an availability and functionality standpoint, meaning the tool is somewhat slow. There were some slow response periods over the past six to nine months, though it has yet to impact us terribly as we are a relatively small shop. We've noticed it, however, so Devo could improve the responsiveness.""We only use the core functionality and one of the reasons for this is that their security operation center needs improvement.""Where Devo has room for improvement is the data ingestion and parsing. We tend to have to work with the Devo support team to bring on and ingest new sources of data.""One major area for improvement for Devo... is to provide more capabilities around pre-built monitoring. They're working on integrations with different types of systems, but that integration needs to go beyond just onboarding to the platform. It needs to include applications, out-of-the-box, that immediately help people to start monitoring their systems. Such applications would include dashboards and alerts, and then people could customize them for their own needs so that they aren't starting from a blank slate.""From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments.""Some of the documentation could be improved a little bit. A lot of times it doesn't go as deep into some of the critical issues you might run into. They've been really good to shore us up with support, but some of the documentation could be a little bit better.""Technical support could be better."

More Devo Cons →

"They should continue expanding and integrating with more third-party apps.""While the tool is robust with many different capabilities, users would greatly benefit from more examples in the documentation.""Once Datadog has gained wide adoption, it can often be overwhelming to both know and understand where to go to find answers to questions.""The sheer amount of products that are included can be overwhelming.""When it comes to storing the logs with Datadog, I'm not sure why it costs so much to store gigabytes or terabytes of information when it's a fraction of the cost to do so myself.""Sometimes it’s difficult to customize certain queries to find specific things, specifically with the logging solution.""The documentation could be improved regarding setting up the agent properly and debugging.""At times, it can be hard to generate metrics out of logs."

More Datadog Cons →

"The problem with ELK is it's difficult to administer. When you have a problem, it can be very, very difficult to rebuild indexes.""With Elastic, you have to build the use cases for the specific requirement. Other products have a simple integration and more use cases to integrate out-of-the-box solutions for SIEM.""Its documentation should be a bit better. I have to spend at least a couple of hours to find the solution for a simple thing. When we buy Elastic, training is not included for free with Elastic. We have to pay extra for the training. They should include training in the price.""An area for improvement in Elastic Security is the pricing. It could be better. Right now, when you increase the volume of logs to be collected, the price also increases a lot.""Better integration with third-party APMs would be really good.""Elastic Security provides a huge amount of searchable data, which is a great advantage in itself but is costly in terms of the number of servers used.""This type of monitoring is not very mature just yet. We need more real-time information in a way that's easier to manage.""The solution does not have a UI and this is one of the reasons we are looking for another solution."

More Elastic Security Cons →

Pricing and Cost Advice
  • "I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."
  • "Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."
  • "[Devo was] in the ballpark with at least a couple of the other front-runners that we were looking at. Devo is a good value and, given the quality of the product, I would expect to pay more."
  • "Be cautious of metadata inclusion for log types in pricing, as there are some "gotchas" with that."
  • "Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products."
  • "Our licensing fees are billed annually and per terabyte."
  • "I like the pricing very much. They keep it simple. It is a single price based on data ingested, and they do it on an average. If you get a spike of data that flows in, they will not stick it to you or charge you for that. They are very fair about that."
  • "Pricing is based on the number of gigabytes of ingestion by volume, and it's on a 30-day average. If you go over one day, that's not a big deal as long as the average is what you expected it to be."
  • More Devo Pricing and Cost Advice →

  • "Pricing is somewhat affordable compared to other solutions but in order to really lower the costs of other products you need to plan very carefully your resources usage, otherwise, it can get expensive real quick."
  • "It is easy to run up a large bill, so become familiar with the cost of each piece of your bill and use the metrics they supply to estimate and monitor your bill."
  • "Pricing seemed easy until the bill came in and some things were not accounted for."
  • "The cost is high and this can be justified if the scale of the environment is big."
  • "My advice is to really keep an eye on your overage costs, as they can spiral really fast."
  • "If you do your homework, you'll find that if you're really concerned with cost, it's good."
  • "It has a module-based pricing model."
  • "I am not satisfied with its licensing. Its payment is based on the exported data, and there was an explosion of the data for three or four weeks. My customer was not alerted, and there was no way for them to see that there has been an explosion of data. They got a big invoice for one or two months. The pricing model of Datadog is based on the data. The customer was quite surprised about not being alerted about this explosion of data. They should provide some kind of alert when there is an increase in usage."
  • More Datadog Pricing and Cost Advice →

  • "It is easy to deploy, easy to use, and you get everything you need to become operational with it, and have nothing further to pay unless you want the OLED plugin."
  • "Compared to other products such as Dynatrace, this is one of the cheaper options."
  • "The solution is free."
  • "Its price is fine. Its licensing works on a yearly basis. We have to renew the license every year. I also have a good experience with Darktrace. When we buy Darktrace, we get training free of cost, which is not there in Elastic. We have to pay extra for training. There is certainly room for improvement."
  • "I find it better than Splunk in terms of cost-effectiveness. For cost-effectiveness, I would rate it a nine out of 10."
  • "Affordable but with additional costs"
  • "When compared to other products, the price is average or on the low side."
  • "The standard license's features are very similar to the free version, so if you don't need to use Elastic Security as an emergency service, you could go for the free version."
  • More Elastic Security Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Log Management solutions are best for your needs.
    653,522 professionals have used our research since 2012.
    Answers from the Community
    HAPPY BHALLA
    Aji Joseph - PeerSpot reviewerAji Joseph
    Reseller

    It depends on your requirement. If you are looking for a SIEM/log management solution ELK would be a better option. 


    But if you are looking for more of a monitoring solution Datadog would be better. Also, Datadog provides out-of-the-box integrations with a lot of cloud applications. ELK could be cost-effective but a bit challenging to configure & finetune.   

    Shibu Babuchandran - PeerSpot reviewerShibu Babuchandran
    Real User

    Datadog: Unify logs, metrics, and traces from across your distributed infrastructure. Datadog is the leading service for cloud-scale monitoring. It is used by IT, operations, and development teams who build and operate applications that run on dynamic or hybrid cloud infrastructure. Start monitoring in minutes with Datadog!


    Datadog features offered are:

    200+ turn-key integrations for data aggregation
    Clean graphs of StatsD and other integrations




    Elasticsearch: Open Source, Distributed, RESTful Search Engine. Elasticsearch is a distributed, RESTful search and analytics engine capable of storing data and searching it in near real time. Elasticsearch, Kibana, Beats and Logstash are the Elastic Stack (sometimes called the ELK Stack).


    Elasticsearch provides the following key features:

    Distributed and Highly Available Search Engine.
    Multi Tenant with Multi Types.
    Various set of APIs including RESTful

    reviewer1584621 - PeerSpot reviewerreviewer1584621 (Cyber Security Consultant at a tech services company with 11-50 employees)
    Real User

    Dear,


    Unfortunately, I can't say much about Datadog but I have used ELK for a short period. 


    And I can tell you not everything works the way it should. For example, I noticed heavy CPU usage for a Windows client on MS AD servers. I advise you to consider this if it's important to you.


    Good luck!

    reviewer1352679 - PeerSpot reviewerreviewer1352679 (IT Technical Architect at a insurance company with 5,001-10,000 employees)
    Real User

    Where do you want to spend your money, on people or licenses?


    ELK requires a long-term investment in engineering resources to manage the system and to provide the capability.  


    Datadog provides capabilities for you so you only need some administrators. What are the capabilities?  Some critical ones include availability, scalability, consuming log files, platform upgrades, ...

    If you are consuming smaller data sets (100's of GB) with shorter retention, the size and scaling are much easier making ELK easier.

    Do you have admins or engineers?  If your team doesn't have dedicated time & skills to spend developing solutions like elastic-alert you should look for a vendor to provide capabilities.

    I expect some capabilities in Datadog you will not be able to replicate in ELK....  so that answer makes this obvious.

    We are going to evaluate the same for our org. We do about 10 TB a day consumption in ELK and are looking to see if we can shift $$$ from engineers and infra to SaaS.

    Ovais Reza - PeerSpot reviewerOvais Reza
    Real User

    I have used both ELK and Datadog, and there are lots of variables to consider here. The three important points that I looked at are:


    - Cost. In addition to service costs, you have to consider egress and ingress costs as well.


    - Real-time observability that you need during development vs long-term Observability. Keep in mind, when you export data over the internet, it comes with the same reliability issues as any other service on the internet. Regardless of how Datadog classifies its service as real-time, it is not real-time, IMO. It very much depends on your definition of real-time.


    - Deployment and maintenance complexity. When your ELK cluster grows it has some pain points you need to be aware of.


    My general approach is to deploy ELK for development, tune the data, and then pivot toward commercial solutions if I need to. This gives you insight into your data and what you should be preserving and that way you are not paying high costs, when or if you do decide to take advantage of a commercial solution.

    it_user860751 - PeerSpot reviewerit_user860751 (IT Manager at a healthcare company with 201-500 employees)
    Real User

    Can you tell me what you actually want to do so that I can help you?

    Questions from the Community
    Top Answer:Devo, like other vendors, doesn't charge extra for playbooks and automation. That way, you are only paying for the side… more »
    Top Answer:I need more empowerment in reporting. For example, when I'm using Qlik or Power BI in terms of reporting for the… more »
    Top Answer:There are many factors and we know little about your requirements (size of org, technology stack, management systems… more »
    Top Answer:With Datadog, we have near-live visibility across our entire platform. We have seen APM metrics impacted several times… more »
    Top Answer:Our organization ran comparison tests to determine whether the Datadog or Dynatrace network monitoring software was the… more »
    Top Answer:The stability of the solution is good.
    Top Answer:The solution could offer better reporting features.
    Comparisons
    Also Known As
    Elastic SIEM, ELK Logstash
    Learn More
    Overview

    Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

    Datadog is a cloud monitoring solution that is designed to assist administrators, IT teams, and other members of an organization who are charged with keeping a close eye on their networks. Administrators can use Datadog to set real-time alerts and schedule automated report generation. They can deal with issues as they arise and keep up to date with the overall health of their network while still being able to focus on other tasks. Users can also track the historical performance of their networks and ensure that they operate at the highest possible level.

    Datadog Benefits

    Some of the ways that organizations can benefit by deploying Datadog include:

    • Gain an integrated view of the services and programs that IT teams are employing across their networks. Users can view and monitor all of the disparate programs that they have running across their networks with this one solution. They can track these programs across the entirety of the data’s life cycle.
    • Analyze and utilize massive amounts of data in real time. Datadog’s dashboards gather data in real time. Administrators can utilize their network’s data the minute that it becomes relevant to them. Decisions can be made based on the most current information available.
    • Keep your cloud network secured against digital threats. Datadog enables users to create alerts that will notify the minute that threats arise. IT teams and administrators can rapidly address any issue that comes up and prevent any existing problem from growing worse.
    • Easily get it up and running. Users can set up Datadog, configure it, and employ API integrations to connect it to external solutions with ease.

    Datadog Features

    • Customizable and prefabricated monitoring dashboards. Administrators are supplied with two different types of dashboards that they can choose from when they are setting up Datadog. They can customize the dashboards to fit any specialized monitoring need. Additionally, users can choose to use prefabricated dashboards that come with the solution.
    • Disaster recovery feature. Datadog has a built-in feature that enables organizations to continue functioning if some disaster strikes their network. If the network suffers damage, Datadog can restore lost data and infrastructure. Should a digital threat do damage to the network, Datadog ensures that the damage is not irreparable.
    • Vulnerability scanning tool. Users can keep ahead of threats to their networks by employing Datadog’s vulnerability scanning feature. This tool scans the entirety of a user’s network and warns them if a vulnerability is detected. Users can then move to patch these holes in their security before the threat to their network can escalate.

    Reviews from Real Users

    Datadog is a solution that stands out when compared to many of its competitors. It can offer organizations many advantages. Two major advantages are the dashboards that users can create and the monitoring capability that it gives system administrators.

    A senior manager in charge of site reliability engineering at Extra Space Storage writes, “The dashboards we created are core indicators of the health of our system, and it is one of the most reliable sources we have turned to, especially as we have seen APM metrics impacted several times lately. We can usually rely on logs to tell us what the apps are doing.”

    Housecall Pro’s senior director of DevOps writes, “We value the monitoring capability since it allows us to be pushed alerts, rather than having to observe graphs continually.

    Unify SIEM, endpoint security, and cloud security
    Elastic Security modernizes security operations — enabling analytics across years of data, automating key processes, and bringing native endpoint security to every host.
    Elastic Security equips teams to prevent, detect, and respond to threats at cloud speed and scale — securing business operations with a unified, open platform.
    Offer
    See Devo in Action

    See how Devo allows you to free yourself from data management, and make machine data and insights accessible.

    Learn more about Datadog
    Learn more about Elastic Security
    Sample Customers
    United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel
    Adobe, Samsung, facebook, HP Cloud Services, Electronic Arts, salesforce, Stanford University, CiTRIX, Chef, zendesk, Hearst Magazines, Spotify, mercardo libre, Slashdot, Ziff Davis, PBS, MLS, The Motley Fool, Politico, Barneby's
    Texas A&M, U.S. Air Force, NuScale Power, Martin's Point Health Care
    Top Industries
    REVIEWERS
    Computer Software Company50%
    Comms Service Provider10%
    Retailer10%
    Insurance Company10%
    VISITORS READING REVIEWS
    Computer Software Company21%
    Comms Service Provider12%
    Financial Services Firm9%
    Government9%
    REVIEWERS
    Financial Services Firm24%
    Computer Software Company16%
    Comms Service Provider9%
    Insurance Company6%
    VISITORS READING REVIEWS
    Computer Software Company21%
    Financial Services Firm12%
    Comms Service Provider11%
    Insurance Company6%
    REVIEWERS
    Financial Services Firm36%
    Computer Software Company21%
    Comms Service Provider14%
    Healthcare Company7%
    VISITORS READING REVIEWS
    Computer Software Company20%
    Comms Service Provider16%
    Financial Services Firm9%
    Government9%
    Company Size
    REVIEWERS
    Small Business21%
    Midsize Enterprise21%
    Large Enterprise58%
    VISITORS READING REVIEWS
    Small Business22%
    Midsize Enterprise16%
    Large Enterprise62%
    REVIEWERS
    Small Business39%
    Midsize Enterprise19%
    Large Enterprise42%
    VISITORS READING REVIEWS
    Small Business21%
    Midsize Enterprise14%
    Large Enterprise65%
    REVIEWERS
    Small Business54%
    Midsize Enterprise17%
    Large Enterprise29%
    VISITORS READING REVIEWS
    Small Business22%
    Midsize Enterprise17%
    Large Enterprise61%
    Buyer's Guide
    Datadog vs. Elastic Security
    October 2022
    Find out what your peers are saying about Datadog vs. Elastic Security and other solutions. Updated: October 2022.
    653,522 professionals have used our research since 2012.

    Datadog is ranked 2nd in Log Management with 101 reviews while Elastic Security is ranked 8th in Log Management with 18 reviews. Datadog is rated 8.6, while Elastic Security is rated 7.4. The top reviewer of Datadog writes "Provides insightful analytics and good visibility that assist with making architectural decisions". On the other hand, the top reviewer of Elastic Security writes "It is quite comprehensive and you're able to do a lot of tasks". Datadog is most compared with Dynatrace, New Relic APM, Azure Monitor, Amazon CloudWatch and AppDynamics, whereas Elastic Security is most compared with Wazuh, Splunk, Graylog, Microsoft Sentinel and Nagios Log Server. See our Datadog vs. Elastic Security report.

    See our list of best Log Management vendors.

    We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.