I’ve seen it go the other way. The in-house elastic search clusters ended up being expensive to run and a burden with staff / hosting which resulted in rent vs

I’ve seen it go the other way. The in-house elastic search clusters ended up being expensive to run and a burden with staff / hosting which resulted in rent vs buy and Splunk/Datdog being used to replace the in-house log storage. In those situations both solutions ended running in parallel with some teams using one service over the other depending what was available when the services where developed and how much hassle it is to migrate. Log migration always being lowest priority for a team if it’s currently working and a backlog full of other stuff.