It's important to consider whether your requirements include long-term retention and search of data, or only recent search and dashboards. Many of the open-sour

It's important to consider whether your requirements include long-term retention and search of data, or only recent search and dashboards. Many of the open-source solutions such as Graylog-free or ELK don't retain information long-term by default, so if long-term data retention is your goal, you should take that into account (Graylog offers it, but only for $$$). On the other hand, if your primary use-case is near-term searches and reviews of data (e.g. "we just need to see the last 90 days of information for troubleshooting and stats"), you'll be pleasantly surprised with the capabilities in both Graylog and ELK without the additional overhead of Splunk. I'll say, too, that I found working with Filebeat for ingestion to be a lot easier and automation-friendly than working with Splunk forwarders—so much so that we're basically adopting an "only use Splunk for indexing" approach to ingestion and using everything else to get data into it.