undefined | Better HN

0 pointsuser59944615y ago0 comments

I've used all of Splunk, ELK and Graylog. Should write a longer blog post on the differences.

Splunk is miles ahead when it comes to search and visualizations. You can just do things and join that the other tools don't support at all.

The only downside is speed, Splunk can only find a few hundreds thousands results a second so it's slow as hell when there are lots of matches. (Kibana doesn't give more than the first 500 results so it's totally cheating on that aspect).

ElasticSearch and everything built on top of it has catastrophic issues with typing. Every field is typed, say integer or string, and sending/having data in the wrong type will prevent to do operations (smaller than, greater than, sum, additional) and can crash the database. It's wild whereas Splunk can ingest and aggregate mixed data just fine.

0 comments

2 comments · 1 top-level

dublin5y ago· 1 in thread

FWIW, Awk and a good SyslogNG catcher is a really good old-school alternative to all these fancy expensive tools, and there is pretty much nothing that you can't do with them...

user5994461OP5y ago

I'd certainly recommend syslog-ng rather than logstash, to forward logs to graylog/splunk/kibana.

However there is no alternative to these when it comes to search and accessibility. SSH somewhere and awk is not a real option.

j / k navigate · click thread line to collapse