I've used all of Splunk, ELK and Graylog. Should write a longer blog post on the differences. Splunk is miles ahead when it comes to search and visualizations.

I've used all of Splunk, ELK and Graylog. Should write a longer blog post on the differences. Splunk is miles ahead when it comes to search and visualizations. You can just do things and join that the other tools don't support at all. The only downside is speed, Splunk can only find a few hundreds thousands results a second so it's slow as hell when there are lots of matches. (Kibana doesn't give more than the first 500 results so it's totally cheating on that aspect). ElasticSearch and everything built on top of it has catastrophic issues with typing. Every field is typed, say integer or string, and sending/having data in the wrong type will prevent to do operations (smaller than, greater than, sum, additional) and can crash the database. It's wild whereas Splunk can ingest and aggregate mixed data just fine.