IT Central Station is now PeerSpot: Here's why

Datadog vs Elastic Security comparison

Cancel
You must select at least 2 products to compare!
Devo Logo
Read 16 Devo reviews.
12,676 views|5,065 comparisons
Datadog Logo
46,524 views|36,999 comparisons
Elastic Logo
32,492 views|27,678 comparisons
Executive Summary
Updated on March 30, 2022

We performed a comparison between Datadog and Elastic Security (formerly ELK Logstash) based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.

  • Ease of Deployment: Most users of Datadog felt the setup and deployment was straightforward, as long as they were familiar with the software. Users of Elastic Security said setup and deployment was easy, but with each additional server, it became more complex.
  • Features: Datadog users felt the software had great integration and error reporting, and that it provided great visibility, which helped proactivity around incident management. But users had a problem with stability and didn’t like that there was not enough monitoring through the dashboard.

    Elastic Security users thought the software was very flexible and scalable but felt the monitor was not mature enough. They also had difficulty retrieving data, and were unhappy that the solution didn’t offer predictive maintenance.
  • Pricing: Users of Datadog found the software expensive and the pricing model confusing. Users of Elastic Security said that licensing was expensive yet competitively priced.
  • Service and Support: Most Datadog users were satisfied with the level of support. On the other hand, Elastic Security users had mixed reviews regarding support; some said that response time took a while.
  • ROI: Users of Datadog had mixed reviews on the ROI; some thought the product was too expensive, which was why they hadn’t seen ROI yet.

Comparison Results: Datadog and Elastic Security have a similar user rating for ease of deployment, and users of both felt that the solutions were expensive. Users felt Elastic Security took too long to respond when it came to service and support. In terms of features, reviewers of Datadog had a problem with stability and felt there wasn’t enough monitoring through their dashboard. Reviewers of Elastic Security said they had difficulty retrieving data and felt the solution should offer predictive maintenance.

Q&A Highlights
Question: Datadog vs ELK: which one is good in terms of performance, cost and efficiency?
Answer: With Datadog, we have near-live visibility across our entire platform. We have seen APM metrics impacted several times lately using the dashboards we have created with Datadog; they are very good core indicators of the health of our system. You can build very useful dashboards right out of the box using this solution. Our developers are able to see how code is running in production, and having custom built-in metrics gives us a wealth of knowledge and historical data that helps keep our system running smoothly. The pricing with Datadog can be very high. We feel there should be a more tiered approach to give users the opportunity to buy a more tailored product specific to their organizational needs. Datadog could also be more user-friendly. We would like to see deeper application-level insight and better incident management. Using ELK, you can gather authentication information from service providers and determine which identity provider is not performing properly. ELK is very flexible; you can have a number of scenarios and get logs from all of them. ELK is a very cost-effective solution. But it can be a complex solution to use. Better integration with 3rd party APMs would be very helpful. Currently, upgrades with ELK are released as stacks. Plugins or extensions would save removal and reinstallation and make the process move seamlessly. Conclusion We researched both of these solutions and concluded Datadog gave us the best visibility, better integration, and helpful, timely support. The logs and error reporting are extremely useful to conduct analysis and root cause analysis. The setup, ease of use, and flexibility with dashboard creation and reporting are just some of the things that our team liked about Datadog.
Featured Review
Buyer's Guide
Datadog vs. Elastic Security
May 2022
Find out what your peers are saying about Datadog vs. Elastic Security and other solutions. Updated: May 2022.
598,116 professionals have used our research since 2012.
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"The most valuable feature is that it has native MSSP capabilities and maintains perfect data separation. It does all of that in a very easy-to-manage cloud-based solution.""The real-time analytics of security-related data are super. There are a lot of data feeds going into it and it's very quick at pulling up and correlating the data and showing you what's going on in your infrastructure. It's fast. The way that their architecture and technology works, they've really focused on the speed of query results and making sure that we can do what we need to do quickly. Devo is pulling back information in a fast fashion, based on real-time events.""One of the biggest features of the UI is that you see the actual code of what you're doing in the graphical user interface, in a little window on the side. Whatever you're doing, you see the code, what's happening. And you can really quickly switch between using the GUI and using the code. That's really useful.""Devo helps us to unlock the full power of our data because they have more than 450 parsers, which means that we can ingest pretty much any type of log data.""The strength of Devo is not only in that it is pretty intuitive, but it gives you the flexibility and creativity to merge feeds. The prime examples would be using the synthesis or union tables that give you phenomenal capabilities... The ability to use a synthesis or union table to combine all those feeds and make heads or tails of what's going on, and link it to go down a thread, is functionality that I hadn't seen before.""Devo provides a multi-tenant, cloud-native architecture. This is critical for managed service provider environments or multinational organizations who may have subsidiaries globally. It gives organizations a way to consolidate their data in a single accessible location, yet keep the data separate. This allows for global views and/or isolated views restricted by access controls by company or business unit.""The querying and the log-retention capabilities are pretty powerful. Those provide some of the biggest value-add for us.""The user experience [is] well thought out and the workflows are logical. The dashboards are intuitive and highly customizable."

More Devo Pros →

"The most valuable feature is the dashboards that are provided out of the box, as well as ones we were able to configure.""Having a wealth of information has helped us investigate outages, and having historical data helps us tune our system.""The most valuable features are the dashboards and the reporting.""The application performance monitoring is pretty good.""Its logs are most valuable.""They have a very good foundation in capturing metrics, logs, and traces. It's a very nice tool for that and it allows you to apply these monitoring tools in almost any technology.""Sometimes it's more user friendly for development teams. There are some parts of Datadog that are more understandable for development teams. For example, the APM in Datadog works more manually and works like the tools in New Relic or Grafana, or Elastic. It is easier to understand for software development teams.""The most valuable features are logging, the extensive set of integrations, and easy jumpstart."

More Datadog Pros →

"The solution is quite stable. The performance has been good.""The indexes allow you to get your results quickly. The filtering and log passing is the advantage of Logstash.""The most valuable feature is the search function, which allows me to go directly to the target to see the specific line a customer is searching for.""We've found the initial setup to be quite straightforward.""ELK is open-source, and it will give you the framework you need to build everything from scratch.""Elastic has a lot of beats, such as Winlogbeat and Filebeat. Beats are the agents that have to be installed on the terminals to send the data. When we install beats or Elastic agents on every terminal, they don't overload the terminals. In other SIEM solutions such as Splunk or QRadar, when beats or agents are installed on endpoints, they are very heavy for the terminals. They consume a lot of power of the terminals, whereas Elastic agents hardly consume any power and don't overload the terminals.""Enables monitoring of application performance and the ability to predict behaviors.""Its flexibility is most valuable. We can have a number of scenarios, and we can get logs from anything. If we know how to use Logstash, we can tweak it in many ways. This makes the logging search on Elastic very easy."

More Elastic Security Pros →

Cons
"The overall performance of extraction could be a lot faster, but that's a common problem in this space in general. Also, the stock or default alerting and detecting options could definitely be broader and more all-encompassing. The fact that they're not is why we had to write all our own alerts.""The Activeboards feature is not as mature regarding the look and feel. Its functionality is mature, but the look and feel is not there. For example, if you have some data sets and are trying to get some graphics, you cannot change anything. There's just one format for the graphics. You cannot change the size of the font, the font itself, etc.""There is room for improvement in the ability to parse different log types. I would go as far as to say the product is deficient in its ability to parse multiple, different log types, including logs from major vendors that are supported by competitors. Additionally, the time that it takes to turn around a supported parser for customers and common log source types, which are generally accepted standards in the industry, is not acceptable. This has impacted customer onboarding and customer relationships for us on multiple fronts.""An admin who is trying to audit user activity usually cannot go beyond a day in the UI. I would like to have access to pages and pages of that data, going back as far as the storage we have, so I could look at every command or search or deletion or anything that a user has run. As an admin, that would really help. Going back just a day in the UI is not going to help, and that means I have to find a different way to do that.""Technical support could be better.""Some basic reporting mechanisms have room for improvement. Customers can do analysis by building Activeboards, Devo’s name for interactive dashboards. This capability is quite nice, but it is not a reporting engine. Devo does provide mechanisms to allow third-party tools to query data via their API, which is great. However, a lot of folks like or want a reporting engine, per se, and Devo simply doesn't have that. This may or may not be by design.""There's always room to reduce the learning curve over how to deal with events and machine data. They could make the machine data simpler.""There's room for improvement within the GUI. There is also some room for improvement within the native parsers they support. But I can say that about pretty much any solution in this space."

More Devo Cons →

"I'd like to see better pricing and more integration in the next release.""The setup was a bit complex.""It could use some additional features when working with metrics like Grafana or like New Relic has. Datadog does not use library technologies like Dynatrace does. Datadog has machine learning too, but it does not have this option in all layers of monitoring like infrastructure service process in applications.""I found the solution to be stable, I did not experience any bugs or glitches. However, some of the managing team did.""In the past two years, there have been a couple of outages.""Datadog has a lot of features kind of cramped into one dashboard. It's quite hard to get around what feature does exactly what. There was a steep learning curve, trying to navigate through menus.""We have recently had a number of issues with stability and delays on logging, monitoring, metric evaluation, and alerts.""Lacks some flexibility in the customization."

More Datadog Cons →

"The training that is offered for Elastic is in need of improvement because there is no depth to it.""Its documentation should be a bit better. I have to spend at least a couple of hours to find the solution for a simple thing. When we buy Elastic, training is not included for free with Elastic. We have to pay extra for the training. They should include training in the price.""This type of monitoring is not very mature just yet. We need more real-time information in a way that's easier to manage.""We're using the open-source edition, for now, I think maybe they can allow their OLED plugin to be open source, as at the moment it is commercialised.""We are paying dearly for the guy who is working on the ELK Stack. That knowledge is quite rare and hard to come by. For difficulty and availability of resources, I would rate it a five out of 10.""The solution needs to be more reactive to investigations. We need to be able to detect and prevent any attacks before it can damage our infrastructure. Currently, this solution doesn't offer that.""With Elastic, you have to build the use cases for the specific requirement. Other products have a simple integration and more use cases to integrate out-of-the-box solutions for SIEM.""There should be a simulation environment to check whether my Elastic implementation is functioning perfectly fine. Other solutions have their own Android and iOS applications that I can install on my mobile so that I am continuously connected to the SIEM."

More Elastic Security Cons →

Pricing and Cost Advice
  • "We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."
  • "I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."
  • "Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."
  • "[Devo was] in the ballpark with at least a couple of the other front-runners that we were looking at. Devo is a good value and, given the quality of the product, I would expect to pay more."
  • "Be cautious of metadata inclusion for log types in pricing, as there are some "gotchas" with that."
  • "Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products."
  • "Our licensing fees are billed annually and per terabyte."
  • "I like the pricing very much. They keep it simple. It is a single price based on data ingested, and they do it on an average. If you get a spike of data that flows in, they will not stick it to you or charge you for that. They are very fair about that."
  • More Devo Pricing and Cost Advice →

  • "It didn't scale well from the cost perspective. We had a custom package deal."
  • "Pricing is somewhat affordable compared to other solutions but in order to really lower the costs of other products you need to plan very carefully your resources usage, otherwise, it can get expensive real quick."
  • "It is easy to run up a large bill, so become familiar with the cost of each piece of your bill and use the metrics they supply to estimate and monitor your bill."
  • "Pricing seemed easy until the bill came in and some things were not accounted for."
  • "The cost is high and this can be justified if the scale of the environment is big."
  • "My advice is to really keep an eye on your overage costs, as they can spiral really fast."
  • "If you do your homework, you'll find that if you're really concerned with cost, it's good."
  • "It has a module-based pricing model."
  • More Datadog Pricing and Cost Advice →

  • "This is an open-source product, so there are no costs."
  • "It's a monthly cost with Elastic SIEM, but I am not sure of the exact cost."
  • "It is easy to deploy, easy to use, and you get everything you need to become operational with it, and have nothing further to pay unless you want the OLED plugin."
  • "Compared to other products such as Dynatrace, this is one of the cheaper options."
  • "The solution is free."
  • "Its price is fine. Its licensing works on a yearly basis. We have to renew the license every year. I also have a good experience with Darktrace. When we buy Darktrace, we get training free of cost, which is not there in Elastic. We have to pay extra for training. There is certainly room for improvement."
  • "I find it better than Splunk in terms of cost-effectiveness. For cost-effectiveness, I would rate it a nine out of 10."
  • "Affordable but with additional costs"
  • More Elastic Security Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Log Management solutions are best for your needs.
    598,116 professionals have used our research since 2012.
    Answers from the Community
    HAPPY BHALLA
    Aji Joseph - PeerSpot reviewerAji Joseph
    Reseller

    It depends on your requirement. If you are looking for a SIEM/log management solution ELK would be a better option. 


    But if you are looking for more of a monitoring solution Datadog would be better. Also, Datadog provides out-of-the-box integrations with a lot of cloud applications. ELK could be cost-effective but a bit challenging to configure & finetune.   

    Shibu Babuchandran - PeerSpot reviewerShibu Babuchandran
    Real User

    Datadog: Unify logs, metrics, and traces from across your distributed infrastructure. Datadog is the leading service for cloud-scale monitoring. It is used by IT, operations, and development teams who build and operate applications that run on dynamic or hybrid cloud infrastructure. Start monitoring in minutes with Datadog!


    Datadog features offered are:

    200+ turn-key integrations for data aggregation
    Clean graphs of StatsD and other integrations




    Elasticsearch: Open Source, Distributed, RESTful Search Engine. Elasticsearch is a distributed, RESTful search and analytics engine capable of storing data and searching it in near real time. Elasticsearch, Kibana, Beats and Logstash are the Elastic Stack (sometimes called the ELK Stack).


    Elasticsearch provides the following key features:

    Distributed and Highly Available Search Engine.
    Multi Tenant with Multi Types.
    Various set of APIs including RESTful

    reviewer1584621 - PeerSpot reviewerreviewer1584621 (Cyber Security Consultant at a tech services company with 11-50 employees)
    Real User

    Dear,


    Unfortunately, I can't say much about Datadog but I have used ELK for a short period. 


    And I can tell you not everything works the way it should. For example, I noticed heavy CPU usage for a Windows client on MS AD servers. I advise you to consider this if it's important to you.


    Good luck!

    reviewer1352679 - PeerSpot reviewerreviewer1352679 (IT Technical Architect at a insurance company with 5,001-10,000 employees)
    Real User

    Where do you want to spend your money, on people or licenses?


    ELK requires a long-term investment in engineering resources to manage the system and to provide the capability.  


    Datadog provides capabilities for you so you only need some administrators. What are the capabilities?  Some critical ones include availability, scalability, consuming log files, platform upgrades, ...

    If you are consuming smaller data sets (100's of GB) with shorter retention, the size and scaling are much easier making ELK easier.

    Do you have admins or engineers?  If your team doesn't have dedicated time & skills to spend developing solutions like elastic-alert you should look for a vendor to provide capabilities.

    I expect some capabilities in Datadog you will not be able to replicate in ELK....  so that answer makes this obvious.

    We are going to evaluate the same for our org. We do about 10 TB a day consumption in ELK and are looking to see if we can shift $$$ from engineers and infra to SaaS.

    it_user860751 - PeerSpot reviewerit_user860751 (IT Manager at a healthcare company with 201-500 employees)
    Real User

    Can you tell me what you actually want to do so that I can help you?

    Questions from the Community
    Top Answer: 
    The querying and the log-retention capabilities are pretty powerful. Those provide some of the biggest value-add for us.
    Top Answer: 
    The way Devo prices things is based on the amount of data, and I wish the tiers had more granularity. Maybe at this… more »
    Top Answer: 
    Where Devo has room for improvement is the data ingestion and parsing. We tend to have to work with the Devo support… more »
    Top Answer: 
    With Datadog, we have near-live visibility across our entire platform. We have seen APM metrics impacted several times… more »
    Top Answer: 
    Our organization ran comparison tests to determine whether the Datadog or Dynatrace network monitoring software was the… more »
    Top Answer: 
    Datadog is constantly adding new features.
    Top Answer: 
    It's not very complicated to install Elastic.
    Top Answer: 
    Elastic is still priced far less than other commercial products.
    Top Answer: 
    Elastic doesn't have the features like other competitors in SIEM. For example, Dynatrace as a solution for SIEM has… more »
    Comparisons
    Also Known As
    Elastic SIEM, ELK Logstash
    Learn More
    Overview

    Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

    Datadog is a monitoring service for IT, Dev and Ops teams who write and run applications at scale, and want to turn the massive amounts of data produced by their apps, tools and services into actionable insight.
    Unify SIEM, endpoint security, and cloud security
    Elastic Security modernizes security operations — enabling analytics across years of data, automating key processes, and bringing native endpoint security to every host.
    Elastic Security equips teams to prevent, detect, and respond to threats at cloud speed and scale — securing business operations with a unified, open platform.
    Offer
    See Devo in Action

    See how Devo allows you to free yourself from data management, and make machine data and insights accessible.

    Learn more about Datadog
    Learn more about Elastic Security
    Sample Customers
    United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel
    Adobe, Samsung, facebook, HP Cloud Services, Electronic Arts, salesforce, Stanford University, CiTRIX, Chef, zendesk, Hearst Magazines, Spotify, mercardo libre, Slashdot, Ziff Davis, PBS, MLS, The Motley Fool, Politico, Barneby's
    Texas A&M, U.S. Air Force, NuScale Power, Martin's Point Health Care
    Top Industries
    REVIEWERS
    Computer Software Company63%
    Comms Service Provider13%
    Retailer13%
    Insurance Company13%
    VISITORS READING REVIEWS
    Computer Software Company26%
    Comms Service Provider21%
    Government8%
    Financial Services Firm7%
    REVIEWERS
    Computer Software Company23%
    Financial Services Firm13%
    Transportation Company6%
    Comms Service Provider6%
    VISITORS READING REVIEWS
    Computer Software Company28%
    Comms Service Provider20%
    Financial Services Firm9%
    Insurance Company5%
    REVIEWERS
    Financial Services Firm38%
    Computer Software Company23%
    Comms Service Provider15%
    Healthcare Company8%
    VISITORS READING REVIEWS
    Comms Service Provider26%
    Computer Software Company22%
    Government9%
    Financial Services Firm7%
    Company Size
    REVIEWERS
    Small Business24%
    Midsize Enterprise18%
    Large Enterprise59%
    VISITORS READING REVIEWS
    Small Business49%
    Midsize Enterprise15%
    Large Enterprise37%
    REVIEWERS
    Small Business45%
    Midsize Enterprise21%
    Large Enterprise34%
    VISITORS READING REVIEWS
    Small Business29%
    Midsize Enterprise13%
    Large Enterprise58%
    REVIEWERS
    Small Business50%
    Midsize Enterprise17%
    Large Enterprise33%
    VISITORS READING REVIEWS
    Small Business23%
    Midsize Enterprise11%
    Large Enterprise66%
    Buyer's Guide
    Datadog vs. Elastic Security
    May 2022
    Find out what your peers are saying about Datadog vs. Elastic Security and other solutions. Updated: May 2022.
    598,116 professionals have used our research since 2012.

    Datadog is ranked 2nd in Log Management with 30 reviews while Elastic Security is ranked 7th in Log Management with 18 reviews. Datadog is rated 8.4, while Elastic Security is rated 7.6. The top reviewer of Datadog writes "Provides insightful analytics and good visibility that assist with making architectural decisions". On the other hand, the top reviewer of Elastic Security writes "It is quite comprehensive and you're able to do a lot of tasks". Datadog is most compared with Dynatrace, New Relic APM, Azure Monitor, Splunk and Amazon CloudWatch, whereas Elastic Security is most compared with Splunk, Graylog, Wazuh, IBM QRadar and syslog-ng. See our Datadog vs. Elastic Security report.

    See our list of best Log Management vendors.

    We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.