Logz.io Blog

ODFE has a security plugin and supports auditing, RBAC and support for node to node encryption[1][2]. The security plugin is based on Search Guard[3].I have run Elastisearch clusters using both the Elastics Co opensource versions as well as ODFE and have personally found the security plugin of ODFE preferable to Elastic Co's X-pack. ODFE also has some additional features included like PerfAnalyzer and SQL interface. In terms of managing the Open Source Elasticsearch vs ODFE they are pretty much the same. I have not used the managed AWS Elasticsearch offering but I read the blog post and felt it had very little to do with ODFE. There is a good feature comparison matrix here:

https://logz.io/blog/open-distro-for-elasticsearch/

[1] https://opendistro.github.io/for-elasticsearch-docs/docs/security-configuration/

[2] https://opendistro.github.io/for-elasticsearch-docs/docs/security-audit-logs/

[3] https://search-guard.com/

Hi snewman,

I am currently using logdna as my splunk alternative, but it's not very good.

Why should I try scalyr next, over the other alternatives ?

My main constraint is the solution should be at least half as good as splunk, and cost less than $50 a month (I generate less than 1G a day).

Your pricing seems to be reasonable. But how do you compare to splunk on features ?

Here are the other tools I am considering trying

https://www.humio.com/

https://www.sumologic.com/

https://sematext.com/logsene/

https://www.datadoghq.com/log-management/

https://logz.io/pricing/

https://www.chaossearch.io/

https://www.papertrail.com/

https://www.loggly.com/

https://www.graylog.org/products/enterprise

ELK is a good option - I'm a fan of open source.
You can build it on your own (http://logz.io/blog/deploy-elk-production/) or you can use ELK as a service (disclaimer, I work for Logz.io which offers such service).

We see customers use ELK to detect intrusion attempts by monitoring and alerting on:
- Access from specific countries
- Internal connections to specific countries
- SSH auth request
- Correlation between failed logins across multiple machines
- kernel exceptions (which may be buffer overflow attempts)
- AWS VPC Logs
- AWS Cloudtrail logs - we internally use it extensively to audit access

HTH

Perhaps because many devs, like me, haven't heard of "grok patterns"[0] before. Because of that, it took me a while to understand what your post was saying, since I was reading "grok" as a normal word.

It's not a bad idea, though you'd want to make it a more formal standard; since it's just used internally in one project, it may be subject to change based on that project's own needs. There could also be more documentation, showing examples of strings that are accepted and not accepted by each pattern, as well as advice for generating compliant strings.

0: https://logz.io/blog/logstash-grok/

Hello! I didn't quite understand -- are looking for a log analysis tool that also helps with related web analytics? Disclosure: I work for Logz.io (http://logz.io) and our log analytics platform can do exactly that.

To learn more about the intersection of log analytics and web analytics, you might want to see this Moz post I wrote a few weeks ago on using log data to analyze search engine crawl rates, crawl budgets, bad response codes, crawl priorities, duplicate URL crawling, and more:

https://moz.com/blog/technical-seo-log-analysis

I hope it might help! (Again, full disclosure repeated. :)