The searcher is usually running an ELK-style stack that began as a free download and turned into a cluster somebody has to babysit, or is on Elastic Cloud and watching the ingest and retention lines grow. They move to a search-engine sibling, to a label-indexed or single-binary log store, or to a hosted service with one published rate.
Short answer: The first three alternatives to Elastic in our log management software ranking are OpenSearch, Graylog and Grafana Loki. The first three places are kept for challengers when the category has enough of them; the best-known brands come after that, in ranked order. Choose OpenSearch if you want to stay on a Lucene-style search engine but under a foundation and a permissive licence. These 14 products are all in Best Log Management Software in 2026; the notes say how each one compares with Elastic.
A vendor can pay to be shown on this site. What we write about its product stays the same either way. Details.
Pricing: Serverless logs from $0.07 per GB ingested and $0.017 per GB retained; self-managed Basic free; paid self-managed by quote
Established in: Netherlands
Built for: Teams that already run Elasticsearch for search or security and want logs on the same cluster
Not for: Teams that want one flat monthly price or a single binary with no tier planning
01
Why buyers look past Elastic
01
The licence history left a question mark
Elasticsearch moved to ELv2 and SSPL, and Elastic's own announcement says AGPL was then added as a third option next to them without removing either. Procurement and legal teams who took the earlier change as a reason to review the stack still have the paperwork open, and a few use it as the moment to compare other engines.
02
A cluster is a job, not a download
Self-managed Elastic means running the Elasticsearch nodes, Kibana, shippers and the data-tier and lifecycle settings that decide where old logs sit. Elastic lists searchable snapshots, index lifecycle management and data tiers as features of the stack. Each one is a thing a person on your team configures and upgrades.
03
The paid tiers are now fewer and quoted
Elastic's subscriptions page marks Gold as discontinued and Platinum as open to existing customers only, and tells everyone else to contact sales for self-managed licensing. Cloud users get published serverless rates instead, so the choice is between a quote and a meter, and neither is a flat fee.
you want a small hosted log service with a published monthly price and a free entry tier
#8
03
What each one does differently
1
OpenSearch
Not applicable (Linux Foundation project) · See profile
A community search and analytics suite under Apache 2.0, run by the OpenSearch Software Foundation within the Linux Foundation since September 2024. It has no commercial vendor behind the project itself; hosting comes from providers such as Amazon OpenSearch Service, billed by instance hour or by serverless compute units, so the bill shifts to whoever you pick.
Switch from Elastic if you want to stay on a Lucene-style search engine but under a foundation and a permissive licence.
A log-focused product with a free Open edition (source-available under SSPL, no volume cap, community support) and quoted tiers above it. Enterprise starts at $15,000 a year from 10 GB a day, and the Security tier at $18,000. Search stays text-first, but it does not cover site search or vector workloads the way Elastic does.
Switch from Elastic if logs are the only job and you want a log tool with a free edition and a yearly licence above it.
Indexes only labels on each log stream, not the text of the lines, and keeps data in object storage under AGPLv3. That is cheaper to hold but means queries lean on labels first. Grafana Cloud hosts it with 50 GB a month ingest free and 14 days of retention, and a $19 monthly platform fee on Pro.
Switch from Elastic if you already run Grafana and Prometheus and can live with label-first search over full-text indexing.
One executable under Apache 2.0 with a query language of its own, LogsQL, and a built-in web UI. Its documentation lists Filebeat, Logstash and Fluentd setup pages, which is relevant to ELK shippers, and a vendor-authored claim of using less RAM and disk than Elasticsearch. Enterprise features and support are paid and quoted.
Switch from Elastic if your cost problem is hardware for the cluster and you want a single binary instead of a node fleet.
Combines logs, traces and metrics in one product, billed at $0.30 per GB of logs ingested after a $49 monthly minimum that includes $49 of usage. Data centres are listed in the US, the EU and India, and there is a self-hosted route with enterprise support. It is an observability product, so pure search workloads are out of scope.
Switch from Elastic if you want logs next to traces and metrics and a per-GB price without host or user charges.
Cloud is $0.50 per GB ingested plus $0.01 per GB queried, with 30 days for logs and 15 months for metrics included, and extra non-metric retention at $0.02 per GB per 30 days. The core is AGPL-3.0, and the self-hosted Enterprise edition is free to 50 GB a day. Cloud has a 14-day trial, not a permanent free plan.
Switch from Elastic if you want a per-GB price with query charges stated up front and an open-source core you can self-host.
Three editions: an open-source one at no cost (SQL, dashboards, OIDC SSO, but a single query node and no SSO groups), a Cloud plan that includes 365 days of retention, and an Enterprise plan with dedicated support and data residency options. Prices are shown through a calculator rather than a table, so the figure arrives after you enter volumes.
Switch from Elastic if you are comfortable with SQL queries over object storage and want a year of retention without a retention surcharge.
Puts logs inside an incident product with on-call, status pages and uptime checks, so the log price is only part of the bill. Logs and traces are priced per GB ingested and per GB retained a month, a free plan keeps 3 GB of logs for 3 days, and there is a 60-day money-back guarantee. Better Stack, Inc. is a Delaware company per its terms.
Switch from Elastic if you want alerting, on-call and status pages bundled with logs and no search-engine tuning.
Fully managed with a flat $25 monthly platform fee plus usage, a permanent Personal plan with 30-day retention, and SSO, RBAC and audit logs sold as separate monthly add-ons from $50 to $100. Queries are written in APL. The pricing page lists a managed service only, so there is no self-hosted route.
Switch from Elastic if you want to stop operating anything and are happy to learn a new query language.
Charges per GB with different rates by pipeline (logs at $0.42 per GB on the pricing page), uses units at $1.50 as a common currency, and keeps data in a bucket you own with unlimited retention. Every account includes SSO, RBAC and unlimited users. The unit model takes a while to read before you can predict a bill.
Switch from Elastic if you want data in your own object store and enterprise controls without a separate tier.
Consumption pricing is $0.92 per ingested GB per day with 7 days of retention, and a subscription option exists alongside it. Annual billing is the default and monthly costs 1.2 times as much. It offers a warm and cold tier, drop filters and archive restore, and the pricing page also sells AI agent workflows at $10 per million tokens.
Switch from Elastic if you want a managed log product with tiers for warm and cold data and accept annual billing.
A self-hosted server for structured logs from Datalust of Brisbane. Licences are yearly: Individual at $0 for one user and 50 GB, Team at $1,090 for ten users, Standard at $2,990, Datacenter at $10,990 with clustering. Data never leaves your machine, and every plan keeps unlimited retention. It has no hosted offering.
Switch from Elastic if you ship structured application logs, want data on your own servers and prefer a flat yearly licence.
SolarWinds Papertrail is a plain hosted log viewer: unlimited systems and users, search alerts, archives copied to Amazon S3, starting at $5 per GB a month. When the limit is hit you choose whether logs stop or continue at a 30% higher per-GB rate up to 200% extra. There is no dashboard layer comparable to Kibana.
Switch from Elastic if you want hosted tail-and-search for syslog-style logs and nothing to administer.
Also owned by SolarWinds, with a Lite plan at no cost, Standard from $79 a month and Pro from $159 a month on annual billing, both with unlimited users. Pro adds API access, archive to Amazon S3 and custom derived fields. The pricing page points new buyers toward SolarWinds Observability SaaS.
Switch from Elastic if you want a small hosted log service with a published monthly price and a free entry tier.
Elastic remains the right choice if logs are only one use of the cluster. The same Elasticsearch also serves search and security work, Kibana already holds your dashboards and alert rules, and the cloud serverless rates (from $0.07 per GB ingested on Logs Essentials) sit below the ingest rates listed by SigNoz, Coralogix and OpenObserve, though retention and egress are billed on top. Self-managed Basic is free, and AGPL is available now. A team with Elastic skills in house and several workloads on the cluster gains little from splitting them.
05
What moving off Elastic involves
01
Shippers are the easy part, dashboards are not
Beats, Logstash and Fluentd configurations usually carry across, and VictoriaLogs documents setup pages for Filebeat and Logstash. What does not carry is everything saved inside Kibana: saved searches, dashboards and alert rules have to be rebuilt in the new tool's own query language, so count them before you pick a date.
02
Decide what retention you actually use
Elastic's data tiers and lifecycle policies hide a lot of decisions about how long logs stay searchable. Write the periods down first. Some alternatives include a fixed window (Axiom Personal 30 days, OpenObserve 30 days, Parseable Cloud 365 days), others bill by the extra month, and Coralogix keeps data in your own bucket.
03
Run both for a month
Send a copy of the logs to the new tool while Elastic keeps receiving them. Compare the monthly bills with real volumes, because the per-GB rates are quoted on different bases: ingest only, ingest plus query, per day of retention, or a platform fee on top.
06
Questions about replacing Elastic
6 answers
Is Elasticsearch open source again?
Elastic's announcement says AGPL, an OSI-approved licence, was added as another option next to ELv2 and SSPL, and that nothing was removed. Which licence applies to you depends on which one you choose when you download or deploy the software.
Which Elastic alternatives can I host myself?
Seq, Graylog Open, Grafana Loki, VictoriaLogs, OpenSearch and the open-source Parseable edition are all published to self-host, and OpenObserve and SigNoz document self-hosted routes. Axiom lists managed deployment only, and Papertrail and Loggly are hosted by SolarWinds.
Which alternative has a free plan?
Better Stack, Axiom (Personal), Grafana Cloud, Loggly (Lite), Seq (Individual) and Graylog Open all have a plan or edition at no cost.
Their limits differ widely: 50 GB a month on Grafana Cloud, one user on Seq Individual, 3 GB retained for 3 days on Better Stack.
Is Elastic Cloud expensive for logs?
Serverless Logs Essentials lists ingest from $0.07 per GB and retention from $0.017 per GB a month, with 50 GB of egress free and then $0.05 per GB.
Complete is from $0.09 per GB. Support is a percentage of consumption, from 5% to 15% above the included Limited level.
Can OpenSearch replace Elastic without changes?
It is a different project under a foundation and a different licence, and managed OpenSearch on AWS bills by instance hour or serverless compute units. Compatibility of your clients, dashboards and plugins is something to test on a copy, not to assume.
What is the quickest way to cut an Elastic log bill?
Check what you ingest before choosing a new tool. Elastic's Streams feature and the data tiers can reduce spend inside the stack, and a label-indexed store such as Loki or a per-GB service only helps when the volume you ship is the volume you need.
Founder of The Knowledge Engineers and of 2 Steps Ahead, an AI search visibility agency. Editorially responsible for every page on this site; research and drafting are AI-assisted.
Checked and edited by Sebastiaan Smits, last on 30 October 2026. The editorial process explains the method.
