

LogRhythm SIEM and Elastic Observability are key competitors in IT monitoring. Elastic Observability often has an advantage due to its robust features, justifying its higher costs.
Features: LogRhythm provides comprehensive security analytics, incident response, and reliable support options. Elastic Observability offers versatile data analytics, adaptability across environments, and advanced features that cater to intricate monitoring tasks.
Room for Improvement: LogRhythm would benefit from updates for performance and better integration options. Elastic Observability faces challenges with achieving optimal customization and needs more comprehensive user documentation. Both products can improve user satisfaction through targeted enhancements.
Ease of Deployment and Customer Service: LogRhythm offers a straightforward deployment process and reliable support. Elastic Observability delivers a flexible deployment model with mixed feedback on support quality, affecting user experiences despite its flexibility.
Pricing and ROI: LogRhythm is attractive to cost-conscious buyers with lower setup costs. Elastic Observability provides strong ROI, making its higher price worthwhile for its enhanced capabilities, as reflected in user reviews.
Elastic Observability has saved us time as it's much easier to find relevant pieces across the system in one screen compared to our own software, and it has saved resources too since the same resources can use less time.
Elastic support really struggles in complex situations to resolve issues.
Their excellent documentation typically helps me solve any issues I encounter.
The technical support is good; we have a separate portal for partners, and since we are paying for the service, they provide a response timeframe based on severity—critical issues are addressed within four hours, medium issues within one day, and non-urgent issues may take a couple of days.
LogRhythm SIEM is quite complex, but that complexity allows us to specifically tailor a solution to the customer while some others are not as flexible.
Customer support is very helpful and effectively solves my problems.
I rate the scalability of Elastic Observability as a ten, as we have never seen issues even with a lot of data coming in from more customers, provided we have the appropriate configuration.
Elastic Observability seems to have a good scale-out capability.
Elastic Observability is easy in deployment in general for small scale, but when you deploy it at a really large scale, the complexity comes with the customizations.
LogRhythm SIEM is highly scalable as it has modular components allowing me to expand storage, indexing, or other resources as needed.
LogRhythm SIEM is scalable; it can handle about 200 or 500 devices without much difference.
The scalability of LogRhythm SIEM is good enough, warranting an eight out of ten rating.
There are some bugs that come with each release, but they are keen always to build major versions and minor versions on time, including the CVE vulnerabilities to fix it.
It is very stable, and I would rate it ten out of ten based on my interaction with it.
I would rate the stability of Elastic Observability as a ten, as we don't experience any issues.
The platform needs regular updates to fix problems encountered with each quarterly patch and version release.
LogRhythm SIEM still needs improvement regarding stability, particularly in environments with heavy data consumption.
For instance, if you have many error logs and want to create a rule with a custom query, such as triggering an alert for five errors in the last hour, all you need to do is open the AI bot, type this question, and it generates an Elastic query for you to use in your alert rules.
It lacked some capabilities when handling on-prem devices, like network observability, package flow analysis, and device performance data on the infrastructure side.
Some areas such as AI Ops still require data scientists to understand machine learning and AI, and it doesn't have a quick win with no-brainer use cases.
I have noticed some problems with parsing errors, event mismatches, and data mismatching, so ensuring accurate parsing and continuous improvement according to device updates are my basic expectations as a detection engineer.
There is currently no way to determine how much data is being consumed in terms of gigabytes, terabytes, or petabytes from particular devices or environments.
If LogRhythm SIEM could make a lightweight version of their solution, that would be quite competitive because some of my customers have a very large need but refuse to go with LogRhythm SIEM due to its complexity and high resource intensity.
The license is reasonably priced, however, the VMs where we host the solution are extremely expensive, making the overall cost in the public cloud high.
Elastic Observability is cost-efficient and provides all features in the enterprise license without asset-based licensing.
Observability is actually cheaper compared to logs because you're not indexing huge blobs of text and trying to parse those.
The license cost is around $10 per MPS.
I find LogRhythm SIEM affordable, as it is a bit less costly than QRadar.
The most valuable feature is the integrated platform that allows customers to start from observability and expand into other areas like security, EDR solutions, etc.
the most valued feature of Elastic is its log analytics capabilities.
All the features that we use, such as monitoring, dashboarding, reporting, the possibility of alerting, and the way we index the data, are important.
The seamless integration for case management, along with a user-friendly dashboard user interface, makes tasks like threat hunting more efficient.
We have enough budget for cloud deployment, but we choose to keep it on-prem to ensure data privacy; cyberattacks are a concern, but data privacy is the foremost priority due to sensitive government information.
This helps SOC analysts significantly as they can monitor all log sources through a dashboard, quickly identifying which sources haven't reported within their specified timeframes.
| Product | Mindshare (%) |
|---|---|
| LogRhythm SIEM | 2.8% |
| Elastic Observability | 1.2% |
| Other | 96.0% |


| Company Size | Count |
|---|---|
| Small Business | 9 |
| Midsize Enterprise | 4 |
| Large Enterprise | 16 |
| Company Size | Count |
|---|---|
| Small Business | 38 |
| Midsize Enterprise | 39 |
| Large Enterprise | 83 |
Elastic Observability offers a comprehensive suite for log analytics, application performance monitoring, and machine learning. It integrates seamlessly with platforms like Teams and Slack, enhancing data visualization and scalability for real-time insights.
Elastic Observability is designed to support production environments with features like logging, data collection, and infrastructure tracking. Centralized logging and powerful search functionalities make incident response and performance tracking efficient. Elastic APM and Kibana facilitate detailed data visualization, promoting rapid troubleshooting and effective system performance analysis. Integrated services and extensive connectivity options enhance its role in business and technical decision-making by providing actionable data insights.
What are the most important features of Elastic Observability?Elastic Observability is employed across industries for critical operations, such as in finance for transaction monitoring, in healthcare for secure data management, and in technology for optimizing application performance. Its data-driven approach aids efficient event tracing, supporting diverse industry requirements.
LogRhythm SIEM offers advanced threat intelligence, scalable deployment, and streamlined log management. It enhances security posture with AI-driven threat detection and comprehensive monitoring.
LogRhythm SIEM stands out for its AI-driven threat correlation, ease of log aggregation, and robust reporting. Offering real-time visibility and analytics through consistent navigation and dashboards, it integrates with security components for enhanced monitoring and response. Advanced threat intelligence and customizable alerts streamline processes and bolster security. While it faces challenges with log parsing, reporting, and dashboard intuitiveness, plans to enhance cloud integration and transition to Linux are noted.
What are the standout features?In industries like banking and finance, organizations utilize LogRhythm SIEM for centralized log management, security monitoring, and compliance. It helps detect insider threats, analyze server logs, correlate events, and monitor user behaviors. Appreciated for log ingestion and anomaly identification, it ensures robust cybersecurity and incident response by integrating data from multiple sources.
We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.