Try our new research platform with insights from 80,000+ expert users

Elastic Security vs Logstash comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Elastic Security
Ranking in Log Management
8th
Average Rating
7.8
Reviews Sentiment
6.8
Number of Reviews
66
Ranking in other categories
Security Information and Event Management (SIEM) (5th), Endpoint Detection and Response (EDR) (15th), Security Orchestration Automation and Response (SOAR) (5th), Extended Detection and Response (XDR) (8th)
Logstash
Ranking in Log Management
26th
Average Rating
9.0
Reviews Sentiment
5.6
Number of Reviews
5
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of January 2026, in the Log Management category, the mindshare of Elastic Security is 2.9%, down from 4.1% compared to the previous year. The mindshare of Logstash is 0.8%, up from 0.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Market Share Distribution
ProductMarket Share (%)
Elastic Security2.9%
Logstash0.8%
Other96.3%
Log Management
 

Featured Reviews

Laurentiu Popescu - PeerSpot reviewer
Chief Product Officer at ClusterPower
Has improved threat detection with deep log analysis and streamlined investigation workflows
The most useful features I find in Elastic Security are the forensic ones that allow us to carry deeper analysis into the logs for in-depth investigations, and the dashboards, with the reporting dashboard being quite user-friendly. Elastic Security is quite good at identifying threats, as it is part of the deep investigation tool that I mentioned before. Unless we need to look further into a certain log, we can carry out a deeper analysis and forensics on those particular logs. I can assess the impact of Elastic Security's real-time data analysis on our threat response efficiency as working pretty good. We are looking for real-time analysis because we have a continuous inflow of logs from different sources: from our cloud, from Active Directory, from our network. So it works pretty well.
Mohammed-Abdelalim - PeerSpot reviewer
Assistant Vice President at QualityKiosk Technologies Pvt. Ltd.
Exploring resilience and integration capabilities while navigating complexity and technical challenges
Logstash lacks a graphical user interface, necessitating a strong programming background to handle it effectively. It is challenging for business users who need a skilled team for its operation. Changing pipelines is not easy because Logstash requires pipelines to be programmed and cannot just be dragged and dropped like other data solutions. Additionally, Logstash does not automatically make actions based on the data it receives; integrating automation tools is required.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature of Elastic Security is that you can install agents, and they are not separately licensed."
"It's simple and easy to use."
"Elastic provides the capability to index quickly due to the reverse indexes it offers. This data is crucial as it contains critical information. The reverse index allows fast data indexing because of Elastic's efficient search engine."
"It is scalable."
"The solution's most valuable features are anomaly detection and connectivity reporting."
"It's open-source and free to use."
"Elastic Security is very customizable, and the dashboards are very easy to build."
"The most valuable feature is the speed, as it responds in a very short time."
"Everything aligns well with improving our organization."
"The transformation means we ship the logs in the way that we want them to be presented in Kibana, which is the main function we use Logstash for."
"The functionality of Logstash is quite easy to implement and the plugin ecosystem of Logstash is great, with plugins for shell script monitoring and SQL monitoring working well with the tool."
"I can collect logs from various data sources, including hardware."
"We have three or four Logstash servers for high availability."
"Logstash has numerous plugins for inputs and outputs, allowing it to work well in environments that do not contain other Elastic components."
 

Cons

"There is room for improvement in the Kibana dashboard and in the asset management for the program."
"Installation is a little bit overwhelming, so improvements on the installation site could make it easier."
"The setup process is complex. You need a solid working knowledge of networking, operating systems, and a little programming."
"It could use maybe a little more on the Linux side."
"One limitation of Elastic Security is that it does not have built-in workflows for all tasks. For example, if you need a workflow for compliance, you will need to create a custom workflow."
"In terms of improvement, there could be more automation in responding to and evaluating detections."
"The process of designing dashboards is a little cumbersome in Kibana. Unless you are an expert, you will not be able to use it. The process should be pretty straightforward. The authentication feature is what we are looking for. We would love to have a central authentication system in the open-source edition without the need for a license or an enterprise license. If they can give at least a simple authentication system within a company. In a large organization, authentication is very essential for security because logs can contain a lot of confidential data. Therefore, an authentication feature for who accesses it should be there."
"We set up a cron job to delete old logs so that we wouldn't hit a disk space issue. Such a feature should be available in the UI, where old logs can be deleted automatically. (Don’t know if this feature is already there)."
"Almost all the research can be very bad. We still have a problem with importing the log system."
"There can be a UI to implement with Logstash. Currently, I have to work with config files and everything."
"An enhancement we could implement is the ability to cluster Logstash to exist in more than one node."
"Elastic does not provide proper support for Logstash worldwide, and I rate their technical support as one out of ten."
"We still have a problem with importing the log system."
"The product needs to improve its compatibility."
 

Pricing and Cost Advice

"The pricing is in the middle. I think it is not an expensive experience if we compare it with big names, for example, QRadar, and also Oxide. I think Elastic Security is quite cheap. I would rate the pricing of this solution a five out of ten."
"It's a monthly cost with Elastic SIEM, but I am not sure of the exact cost."
"This is an open-source product, so there are no costs."
"The base product is open-source but if you need advanced security features then you need to pay for the subscription. Elastic Security's price is reasonable in some cases and in other cases it's not."
"Its price is fine. Its licensing works on a yearly basis. We have to renew the license every year. I also have a good experience with Darktrace. When we buy Darktrace, we get training free of cost, which is not there in Elastic. We have to pay extra for training. There is certainly room for improvement."
"We use the open-source version, so there is no charge for this solution."
"The tool's pricing is flexible and comes at unit cost. You don't have to pay for everything."
"There is no charge for using the open-source version."
Information not available
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
881,114 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
12%
Government
10%
Comms Service Provider
8%
Manufacturing Company
7%
Financial Services Firm
16%
Computer Software Company
10%
Manufacturing Company
8%
Real Estate/Law Firm
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business40
Midsize Enterprise11
Large Enterprise15
No data available
 

Questions from the Community

Datadog vs ELK: which one is good in terms of performance, cost and efficiency?
With Datadog, we have near-live visibility across our entire platform. We have seen APM metrics impacted several times lately using the dashboards we have created with Datadog; they are very good c...
What do you like most about Elastic Security?
Elastic provides the capability to index quickly due to the reverse indexes it offers. This data is crucial as it contains critical information. The reverse index allows fast data indexing because ...
What is your experience regarding pricing and costs for Elastic Security?
I am satisfied with the pricing, setup cost, and licensing cost. It is a pure 10.
What do you like most about Logstash?
I can collect logs from various data sources, including hardware.
What needs improvement with Logstash?
Customization can be automated with Logstash, but it is at the developer's disposal. The developer has to do it, not the tool as such. There is scope for optimization, but that is all outside the t...
What is your primary use case for Logstash?
The purposes for which I am using Logstash largely include log aggregation and application monitoring.
 

Comparisons

 

Also Known As

Elastic SIEM, ELK Logstash
No data available
 

Overview

 

Sample Customers

Texas A&M, U.S. Air Force, NuScale Power, Martin's Point Health Care
Information Not Available
Find out what your peers are saying about Elastic Security vs. Logstash and other solutions. Updated: December 2025.
881,114 professionals have used our research since 2012.