Best Observability & Log Management Software in 2026
Observability and log management software ingests logs, metrics and traces from running infrastructure and applications so a team can search, correlate and alert on them in one place, rather than piecing together evidence from separate tools during an incident.
This guide ranks on where the data actually lives, what the ingest bill becomes at real volume, and whether SIEM-grade retention is available for the security teams who need it — not on feature counts. It sits deliberately apart from our narrower application performance monitoring guide: the tools here are full-stack data platforms for logs, metrics and traces, or dedicated log-and-security specialists, not APM-first products.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
In short
What observability & log management software does
Observability and log management software collects logs, metrics and distributed traces from running systems into a searchable store, so an engineer or analyst can correlate an error, a slow request and a resource spike back to one cause. For the SIEM-capable tools in this category, it also retains and queries security-relevant events for compliance and threat detection.
In this order: setup effort, what it really costs, how your data comes back out, whether you can leave, and who each observability & log management tool is built for. On top of them sits one rule. The top three places are for challengers, which means vendors outside the big names, where the category has any, and the household brands come in from fourth place. Reasons for the choice of tests, and for skipping a score out of ten, can be read on the how we work page.
Two plans (Essentials, Enterprise Suite) on Sumo credits; Flex option charges $0 ingest and bills per TB scanned; calculator estimate, otherwise quoted; 14-day trial only
—
Cloud-native log analytics, observability and Cloud SIEM with ingest cost decoupled from search cost
Free, open source; published subscriptions: RHEL, SLES and Amazon Linux packages €5,000/year, enterprise modules €2,000/year, support from €15,000/year
Yes
Infrastructure teams that manage monitoring as code in Git
Danish SIEM and security-log management with node-based licensing and an EU-sovereignty focus
Ranked #1 of 16 in Best Observability & Log Management Software in 2026.
Self-hostablePricing on requestEurope
Rebranded from Logpoint in March 2026, with the platform now sold as the Guardsix Command Centre, Guardsix is a converged SIEM, SOAR, UEBA and network-detection platform built log-first for security teams rather than general infrastructure monitoring.
Node-based licensing avoids the volume-based bill shock common in SIEM, and self-hosted, air-gappable deployment answers data-sovereignty requirements directly, but the structured taxonomy and query language need real onboarding time.
What stands out
SIEM
Self-hostable
EU sovereignty
DenmarkFour packages (Govern, Detect, Defend, Respond) priced by nodes, devices or entities, quoted on request
Cost-optimized full observability that routes logs and traces to different tiers by business value
Ranked #2 of 16 in Best Observability & Log Management Software in 2026.
Published pricingMiddle East
Coralogix's TCO Optimizer routes each log or trace to a High, Medium, Low or blocked processing tier by business value rather than charging one flat rate for everything ingested; the vendor puts the per-GB saving at 25% on logs and 50% on traces even in the top tier, rising to 60% and 75% in the compliance tier, and it covers logs, metrics and traces in one platform.
It is smaller and less recognised than Datadog or Splunk, and it is Israeli-founded and controlled.
What stands out
TCO Optimizer
Usage-based
Full observability
IsraelPer GB at published rates (logs from $0.42, traces $0.16, metrics $0.06); unlimited users and hosts; 14-day trial
Hybrid IT infrastructure monitoring with agentless-first discovery and AIOps event intelligence
Ranked #3 of 16 in Best Observability & Log Management Software in 2026.
Self-hostablePublished pricingNorth America
The pitch is that you stop maintaining the monitoring system. Collectors go into each location, the templates already know your hardware, and upgrades happen without you. For a small team responsible for a large mixed estate that trade is usually correct.
The friction is commercial: the unit conversion is published (one device or cloud instance per Hybrid Unit, seven PaaS resources, five access points), but minimum quantities and contract terms set the bill, the count only goes up, and renewal is where the flexibility disappears. Fix the hybrid unit allocation in writing before signing.
What stands out
Agentless-first
Hybrid IT/cloud
AIOps (Edwin AI)
Where it costs you
List price is a starting point; minimums and contract terms set the bill
Dependent on the vendor's cloud remaining reachable
Right for
Lean IT teams covering hybrid estates without running the platform
Wrong for
Organisations that must keep monitoring entirely in house
United StatesThree packages at published list prices of $16, $27 and $53 per Hybrid Unit per month, on standard minimum quantities and terms; 15-day trial
Full-stack observability with automatic dependency mapping and a unified data lakehouse for logs, metrics and traces
Ranked #4 of 16 in Best Observability & Log Management Software in 2026.
Published pricingNorth America
Dynatrace earns its place when the estate is too big to map by hand: one agent per host and the dependency graph appears, including the services nobody remembered. Root-cause suggestions are better than the market average, and seats are unlimited. The cost is independence.
The platform assumes its own agent, and although the rates are published, consumption pricing across host hours, memory, ingest and retention resists forecasting, and the product is sold and implemented in a way that expects a procurement process rather than a card.
What stands out
US-headquartered
Auto-instrumentation
Unified data lakehouse
Where it costs you
Consumption pricing is difficult to forecast before you run it
The good features assume the OneAgent, not OTLP
Right for
Large estates nobody fully documented, where auto-discovery pays
Wrong for
Small teams that want a fixed monthly price they can forecast
United StatesConsumption-based per host hour and per GiB ingested, published rates
Logs, traces and metrics in one self-hostable, search-based store built on the ELK stack
Ranked #5 of 16 in Best Observability & Log Management Software in 2026.
Self-hostablePublished pricingEurope
Putting logs, traces and metrics in one searchable index removes the correlation problem that costs the most time during an incident. Elastic accepts OTLP and can be self-hosted, so the exit exists.
The trade, unless you take the serverless edition that Elastic runs for you, is that you are operating a search cluster: shard counts, index lifecycle and retention tiers decide both performance and cost. Licence direction has changed twice, which is worth remembering when planning five years out.
What stands out
Self-hostable
Log-first architecture
Search-based
Where it costs you
Costs follow ingest and retention, and retention is easy to set badly
Hosted and self-managed clusters need tuning skills the team may not have
Right for
Organisations that already run Elasticsearch and want one store
Wrong for
Teams with no Elasticsearch experience wanting a narrow developer APM tool
NetherlandsServerless billed per GB ingested and retained at published rates; Hosted is resource-based; self-managed licensed by node RAM
Cloud-native log analytics, observability and Cloud SIEM with ingest cost decoupled from search cost
Ranked #6 of 16 in Best Observability & Log Management Software in 2026.
Pricing on requestNorth America
Sumo Logic's Flex model separates the cost of ingesting data from the cost of searching and storing it, which suits a high-volume, low-query workload that plain per-GB-ingested pricing punishes, and its Enterprise Suite bundles Cloud SIEM and Cloud SOAR alongside observability.
Taken private by Francisco Partners in 2023, it is now US-controlled, and the credit system is genuinely harder to forecast than a flat per-GB number.
What stands out
Log analytics
Cloud SIEM
Flex credit pricing
United StatesTwo plans (Essentials, Enterprise Suite) on Sumo credits; Flex option charges $0 ingest and bills per TB scanned; calculator estimate, otherwise quoted; 14-day trial only
Log management and SIEM with a genuinely uncapped free tier, German engineering roots
Ranked #7 of 16 in Best Observability & Log Management Software in 2026.
Free tierOpen sourcePublished pricingNorth America
Enterprise adds data lake routing, hot, warm and archive data tiering, a correlation engine, Graylog-maintained parsers and dashboards, SSO, LDAP roles and user audit logs. The Security tier adds SIEM features such as ATT&CK-mapped detection rules and Sigma support. Graylog Accelerator onboarding is included.
What stands out
Free tier, no data cap
Log-first
US-controlled
Where it costs you
Open edition support is community-only and the vendor frames it as for teams with engineering time.
Enterprise and Security start at a yearly floor and are bought through a sales contact.
Right for
Operations teams that want a log-specific tool with a free edition and a path to a paid licence
Wrong for
Teams that want usage-based pricing from the first gigabyte
United StatesGraylog Open free with unlimited ingest; Enterprise from $15,000/year and Security from $18,000/year, published; Cloud from roughly $1,250/month
Munich-built infrastructure monitoring with 2,000+ integration checks, extending into full-stack observability
Ranked #8 of 16 in Best Observability & Log Management Software in 2026.
Published pricingEurope
Automatic service discovery is the feature that justifies the price. Point Checkmk at a host and it finds the filesystems, interfaces and services and configures sensible checks, so the first hundred hosts take a day rather than a month.
The enterprise price list is public, which is rare here. Its weakness is the network side proper: for interface-level traffic questions you will still add ntopng or a flow collector, and the map is functional rather than illuminating.
What stands out
Auto-discovery
Open core
PSG Equity-owned
Where it costs you
Network topology and traffic features trail the specialists
Configuration model is unusual for Nagios veterans
Right for
Mixed estates of servers and network gear wanting fast setup
Wrong for
Deep traffic analysis or carrier-scale flow work
GermanyCommunity free (about 100 hosts); Pro from €190/month; Ultimate from €275/month; Cloud from €240/month
Paris-built IT and network monitoring extended into full-stack observability, open-source core
Ranked #9 of 16 in Best Observability & Log Management Software in 2026.
Free tierSelf-hostablePublished pricingEurope
Centreon occupies a specific slot: European supplier, open source engine, commercial support and business-service views that a service manager can read. French public bodies and large enterprises buy it for the jurisdiction as much as the features.
Outside that context the calculation is harder. The 100-host cap on the free commercial edition pushes you onto the paid per-host tiers quickly, the valuable modules are all paid, and a team comfortable with Zabbix or Icinga will not find a technical reason to pay.
What stands out
Open core
French company
Self-hostable
Where it costs you
Free IT-100 edition is capped at 100 hosts
English documentation and partners are thin outside France
Right for
French and EU organisations wanting a supported open source core
Wrong for
Small teams that will never buy the commercial modules
FranceFree IT-100 edition up to 100 hosts and free open-source core; self-hosted IT Edition from €283/month for 125 hosts, SaaS from €425/month, published
Zabbix removes the licence conversation entirely: monitor ten thousand interfaces and pay nothing. The proxy architecture is the underrated part, letting remote sites keep collecting and buffering while a link is down, then backfilling when it returns.
The bill arrives as effort. Templates need adapting, alert thresholds need tuning, and the upgrade path between major versions demands attention. Without a named owner, a Zabbix installation slowly turns into a wall of ignored alerts.
What stands out
Open source
Founder-owned
No feature gating
Where it costs you
Interface and default alerting need substantial work
All support and expertise costs your own hours
Right for
Teams with an engineer who wants total control and no licence
Wrong for
Departments with nobody to own the configuration
LatviaFree, open source; support subscriptions from $325 (€245)/month billed annually, published; Zabbix Cloud from €50/month
Open-source infrastructure monitoring configured as code, the Nagios successor, with paid enterprise modules
Ranked #11 of 16 in Best Observability & Log Management Software in 2026.
Free tierOpen sourcePublished pricingEurope
Icinga is the right answer when monitoring configuration belongs in the same repository and pipeline as everything else, generated from your source of truth rather than clicked in a console. Two decades of Nagios plugins mean a check exists for almost anything.
It asks for an engineer who wants that job. Discovery, dashboards and reporting are all things you build, and the separate components for the core, the database layer and the web interface each have their own upgrade notes.
What stands out
Open source
Configuration as code
Paid enterprise modules
Where it costs you
No meaningful automatic discovery
Components must be assembled and upgraded separately
Right for
Infrastructure teams that manage monitoring as code in Git
Wrong for
Teams who want a product rather than a toolkit
GermanyFree, open source; published subscriptions: RHEL, SLES and Amazon Linux packages €5,000/year, enterprise modules €2,000/year, support from €15,000/year
Per-node infrastructure monitoring with an open-source agent and a free tier
Ranked #12 of 16 in Best Observability & Log Management Software in 2026.
Free tierPublished pricingElsewhere
Netdata installs an agent per node and collects metrics at per-second resolution, with machine-learning anomaly detection included in the agent. Infrastructure is $7 per node a month on annual billing ($8.75 monthly) and APM $15, with volume discounts from 51 nodes.
Network devices cost from $2 each, and Enterprise adds custom quotas and on-premise deployment. Logs and traces are capped by pooled monthly quotas, which limits its use as a general log platform.
What stands out
Infrastructure monitoring
Open-source agent
Per-node pricing
Where it costs you
Application logs and traces use pooled quotas, with extra events billed at $0.10 per million
Country of establishment is not stated on its pricing or company pages
Right for
Platform teams that mainly watch hosts and containers and want per-node prices
Wrong for
Security teams needing a SIEM or long-term log search
Not stated by the vendorPer node per month, free on 5 nodes; add-ons priced separately; 14-day Business trial
Open source ClickHouse-based observability for logs, traces, metrics and replays
Ranked #13 of 16 in Best Observability & Log Management Software in 2026.
Free tierOpen sourcePublished pricingElsewhere
Starter includes 50 GB a month, 30 days of retention and unlimited users at a flat rate. Extra data costs USD 0.40 per GB and metrics USD 0.40 per 100. Enterprise adds custom retention, SAML single sign-on and volume discounts through sales.
The Starter trial lasts 14 days and collects no payment details. The footer reads Made with love in San Francisco, and no formal country statement was found.
What stands out
Open source
ClickHouse
OpenTelemetry
Where it costs you
The free tier allows one user and only three days of retention, so any team needs a paid plan quickly.
The privacy policy and terms links returned errors, so no registered address or legal terms could be checked.
Right for
Small engineering teams wanting unified telemetry billed by data volume, not seats
Wrong for
Buyers who must review legal terms before purchase
Not stated by the vendorFree tier with 3 GB a month; Starter billed by data volume with 14-day trial; Enterprise on request
eBPF-based monitoring that maps services and finds causes without code changes
Ranked #14 of 16 in Best Observability & Log Management Software in 2026.
Published pricingElsewhere
The service map is discovered automatically, alongside continuous profiling and OpenTelemetry support. Database views cover PostgreSQL, MongoDB and MySQL, and Kubernetes is covered, with a testimonial naming Nomad.
Premium adds phone support, onboarding, capacity planning, air-gapped installation help and team training. The repository names the Apache-2.0 licence, and a testimonial describes the product as fully self-hosted. A live demo is linked from the home page, and setup is described as taking two minutes.
What stands out
eBPF
Service map
Kubernetes
Where it costs you
Standard support is business hours only, by email, chat or ticket, while round-the-clock phone support sits in the Premium plan.
The copyright notice names Coroot Inc. but no country of establishment is stated.
Right for
Platform teams running Kubernetes who want automatic service maps priced by CPU core
Wrong for
Organisations needing round-the-clock support without a sales conversation
Not stated by the vendorStandard billed per monitored CPU core per month, published; Premium quoted by sales; 14-day trial; Community Edition on GitHub
OpenTelemetry-native traces, metrics and logs on ClickHouse, cloud or self-hosted
Ranked #15 of 16 in Best Observability & Log Management Software in 2026.
Self-hostablePublished pricingElsewhere
Billing counts gigabytes ingested and active timeseries, with metrics priced per million datapoints and falling with volume. Default Cloud retention is four weeks, extendable to 100 weeks through cold storage.
Data is ingested from OpenTelemetry, Prometheus, Vector, FluentBit and CloudWatch. SAML and OIDC single sign-on are supported, and the repository names the AGPL-3.0 licence. Self-hosting runs through Docker, Ansible or Kubernetes, and paid on-premises licences exist.
What stands out
OpenTelemetry-native
ClickHouse
Self-hosted edition
Where it costs you
No legal entity or registered address is given, and the terms page returned an error when read.
The home page states two conflicting free allowances, so the starting volume cannot be confirmed.
Right for
Teams already instrumented with OpenTelemetry who want per-volume billing and an option to self-host
Wrong for
Buyers needing a named legal entity and fixed plan tiers
Not stated by the vendorUsage-based, per ingested volume and active timeseries, published; no per-seat fees; 14-day trial; self-hosted Community Edition at no cost
Distributed tracing platform from the CNCF, free to download and run
Ranked #16 of 16 in Best Observability & Log Management Software in 2026.
Free tierOpen sourcePublished pricingElsewhere
The site presents four uses: monitoring distributed workflows, finding and fixing performance bottlenecks, tracking down root causes and analysing service dependencies. OpenTelemetry trace data can be received over OTLP since version 1.35.
A native ClickHouse storage backend arrived in version 2.18.0. The project lists Get started, Download and a live demo, and the code carries the Apache-2.0 licence on the official GitHub repository, with copyright held by The Jaeger Authors. The page shows no price list.
What stands out
Distributed tracing
CNCF graduated
OTLP ingest
Where it costs you
The site describes no hosted option, so you operate the platform and its storage yourself.
No vendor country is stated, and the pages read show no commercial support terms.
Right for
Engineering teams already running microservices who want open source tracing they operate themselves
Wrong for
Teams wanting hosted logs, metrics and alerting in one product
Not stated by the vendorFree to download; no paid tier shown on the site
How to choose observability & log management software
Observability and log management software collects logs, metrics and distributed traces from running systems into a searchable store, so an engineer or analyst can correlate an error, a slow request and a resource spike back to one cause. For the SIEM-capable tools in this category, it also retains and queries security-relevant events for compliance and threat detection. Work through these questions in order; they separate the products better than a feature matrix does.
01
Decide whether you need a published price
2 vendors on this page sell by quote, while 14 publish a pricing model you can read today: Coralogix, LogicMonitor, Dynatrace, Elastic Observability, Graylog, Checkmk, Centreon, Zabbix, Icinga, Netdata, HyperDX, Coroot, Uptrace, Jaeger.
02
Look at where the vendor sits
Look at the contracting entity: these 16 vendors sit in 8 countries, split by region as Europe 6, Elsewhere 5, North America 4, Middle East 1. The servers can be anywhere; the legal obligations follow the company.
03
Consider whether you want the source
Source code is available for Graylog, Zabbix, Icinga, HyperDX, Jaeger. Running it yourself swaps the licence fee for your own upkeep.
Half this page watches state, the other half searches events
Checkmk, Centreon, Zabbix and Icinga come from infrastructure monitoring: they check whether hosts and services are healthy and treat logs as an addition.
Elastic Observability, Graylog and Sumo Logic start from the log line and the search box. Dynatrace spans both through its own agent. Settle which question wakes your team at night first, because the two groups barely overlap.
List your last five incidents and note whether each was found by a status check or by searching logs.
If Zabbix or Icinga is on the shortlist, decide which separate tool will hold searchable logs.
Confirm whether you need distributed tracing, which is not where LogicMonitor is strongest.
Host hour, gigabyte, credit, node or unit: five meters on one page
Dynatrace bills per host hour and per GiB ingested. Coralogix charges per GB with no host, user or query fee. Sumo Logic sells Flex credits that price ingest apart from search, Guardsix licenses per node and LogicMonitor counts Hybrid Units.
A chatty application on a few hosts and a quiet estate of many hosts will receive opposite quotes from these same vendors.
Measure daily log volume per host for a full week before requesting any quote.
Decide which log streams could sit in a cheaper processing tier, the way Coralogix's TCO Optimizer sorts them.
With Sumo Logic, estimate how often you query, since Flex separates ingest cost from search cost.
Free in this market means you run the database
Zabbix holds nothing back behind a paid tier, Icinga's core is free with enterprise modules sold separately, Graylog Open has no ingest cap, and Checkmk and Centreon offer free editions with host or device limits.
What each asks in return is an engineer: database tuning for Zabbix, separately upgraded components for Icinga, shard and retention decisions for self-hosted Elastic. The licence saving is real only if that person exists.
Name the person who will own upgrades, then read the notes for the most recent major version.
Check whether Graylog Open's SSPL licence is acceptable to your legal team.
Count hosts against Checkmk Community's limit of about 100 and Centreon's capped free edition.
Security retention is a different purchase from debugging
Guardsix, Sumo Logic and Graylog carry SIEM capability; most of the monitoring-led tools here make no such claim. A security team wants months of retained events, detection content and sometimes an air-gapped install, which Guardsix supports.
An operations team wants fast search over last week. One store can serve both only when retention is priced for the longer requirement.
Write down the retention period your auditor requires and price exactly that figure.
If logs may not leave your network, confirm self-hosting: Guardsix, Elastic and Graylog all offer it.
Ask whether security and operations staff query one copy of the data or pay for two.
What goes wrong most often when buying observability & log management software
Choosing Zabbix or Icinga for log search when both are built around state and metrics.
Forecasting a consumption bill from host count alone when ingest volume is the part that moves.
Calling a self-hosted edition free without naming who tunes the database and handles upgrades.
Standardising on OpenTelemetry and then expecting Dynatrace's strongest features to work without its OneAgent.
07
Frequently asked questions
8 answers
What is the best observability & log management in 2026?
First of 16 on this page is Guardsix (formerly Logpoint). Rebranded from Logpoint in March 2026, with the platform now sold as the Guardsix Command Centre, Guardsix is a converged SIEM, SOAR, UEBA and network-detection platform built log-first for security teams rather than general infrastructure monitoring.
Node-based licensing avoids the volume-based bill shock common in SIEM, and self-hosted, air-gappable deployment answers data-sovereignty requirements directly, but the structured taxonomy and query language need real onboarding time.
Which observability & log management tools publish their pricing?
14 of the 16, with the pricing model each one publishes:
Coralogix: Per GB at published rates (logs from $0.42, traces $0.16, metrics $0.06); unlimited users and hosts; 14-day trial.
LogicMonitor: Three packages at published list prices of $16, $27 and $53 per Hybrid Unit per month, on standard minimum quantities and terms; 15-day trial.
Dynatrace: Consumption-based per host hour and per GiB ingested, published rates.
Elastic Observability: Serverless billed per GB ingested and retained at published rates; Hosted is resource-based; self-managed licensed by node RAM.
Graylog: Graylog Open free with unlimited ingest; Enterprise from $15,000/year and Security from $18,000/year, published; Cloud from roughly $1,250/month.
Checkmk: Community free (about 100 hosts); Pro from €190/month; Ultimate from €275/month; Cloud from €240/month.
Centreon: Free IT-100 edition up to 100 hosts and free open-source core; self-hosted IT Edition from €283/month for 125 hosts, SaaS from €425/month, published.
Zabbix: Free, open source; support subscriptions from $325 (€245)/month billed annually, published; Zabbix Cloud from €50/month.
Icinga: Free, open source; published subscriptions: RHEL, SLES and Amazon Linux packages €5,000/year, enterprise modules €2,000/year, support from €15,000/year.
Netdata: Per node per month, free on 5 nodes; add-ons priced separately; 14-day Business trial.
HyperDX: Free tier with 3 GB a month; Starter billed by data volume with 14-day trial; Enterprise on request.
Coroot: Standard billed per monitored CPU core per month, published; Premium quoted by sales; 14-day trial; Community Edition on GitHub.
Uptrace: Usage-based, per ingested volume and active timeseries, published; no per-seat fees; 14-day trial; self-hosted Community Edition at no cost.
Jaeger: Free to download; no paid tier shown on the site.
The other 2 quote per organisation.
Is there a free observability & log management tool?
Graylog, Centreon, Zabbix, Icinga, Netdata, HyperDX, Jaeger offer a free tier or a free self-hosted edition.
Where are these observability & log management vendors established?
In 8 countries across 4 regions: Europe 6, Elsewhere 5, North America 4, Middle East 1.
Guardsix (formerly Logpoint): Denmark.
Coralogix: Israel.
LogicMonitor: United States.
Dynatrace: United States.
Elastic Observability: Netherlands.
Sumo Logic: United States.
Graylog: United States.
Checkmk: Germany.
Centreon: France.
Zabbix: Latvia.
Icinga: Germany.
Netdata: Not stated by the vendor.
HyperDX: Not stated by the vendor.
Coroot: Not stated by the vendor.
Uptrace: Not stated by the vendor.
Jaeger: Not stated by the vendor.
Which observability & log management tools are open source?
Graylog, Zabbix, Icinga, HyperDX, Jaeger.
Which observability & log management tools can you host yourself?
Guardsix (formerly Logpoint), LogicMonitor, Elastic Observability, Centreon, Zabbix, Uptrace. The remaining 10 run only on the vendor's servers.
What should you use instead of Guardsix (formerly Logpoint)?
The next in line are Coralogix, aimed at Cost-optimized full observability that routes logs and traces to different tiers by business value, and LogicMonitor, aimed at Lean IT teams covering hybrid estates without running the platform.
Who should not buy Guardsix (formerly Logpoint)?
Rebranded from Logpoint in March 2026, with the platform now sold as the Guardsix Command Centre, Guardsix is a converged SIEM, SOAR, UEBA and network-detection platform built log-first for security teams rather than general infrastructure monitoring.
Node-based licensing avoids the volume-based bill shock common in SIEM, and self-hosted, air-gappable deployment answers data-sovereignty requirements directly, but the structured taxonomy and query language need real onboarding time.
This list covers 16 observability & log management products. A product we left out can be put to us by its maker, with a short note on its purpose and its customers; we decide on inclusion ourselves. The rules are under software advice.
