License & Deployment Mix: 30 tools – 19 OSS, 8 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)

What Is Log Management?

Log management is the practice of collecting, aggregating, storing, searching, and analyzing log data generated by applications, operating systems, network devices, and infrastructure components. Logs are timestamped records of discrete events – application errors, HTTP requests, authentication attempts, configuration changes, and system state transitions.

Observability extends log management by unifying the three telemetry pillars – logs, metrics, and traces – into a coherent picture of system behavior. Where monitoring asks “is it broken?”, observability asks “why is it broken?” by correlating structured logs, time-series metrics, and distributed traces to pinpoint root causes across complex, distributed systems.

Enterprise log management and observability platforms provide:

• Centralized log aggregation – collect logs from thousands of sources (servers, containers, cloud services, network devices, applications) into a single searchable repository; eliminate SSH-and-grep workflows; enable cross-system correlation
• Structured logging – parse unstructured log lines into structured fields (JSON, key-value pairs) for efficient querying; normalize disparate log formats into a common schema; enrich logs with metadata (hostname, region, service name)
• Full-text search – index and search billions of log lines in near real-time; query languages (Lucene, LogQL, SQL, SPL) for ad-hoc exploration; saved searches and scheduled queries
• Log-based alerting – trigger notifications when log patterns match predefined conditions (error rate spikes, authentication failures, specific error messages); integration with on-call systems (PagerDuty, OpsGenie, GoAlert)
• Retention and archival – hot/warm/cold storage tiers for cost-effective long-term retention; configurable retention policies per log source; compliance-driven archival to object storage (S3, GCS, MinIO)
• Data pipelines – route, transform, filter, and enrich log data in transit; reduce storage costs by dropping noise; replicate logs to multiple destinations (analytics, compliance, SIEM)
• Dashboards and visualization – real-time log exploration; aggregate log data into charts, histograms, and heatmaps; drill from dashboards into individual log lines
• Correlation – link logs with metrics and traces to build end-to-end request timelines; exemplar links between metrics spikes and corresponding log entries; trace-to-log pivoting for root cause analysis
• Multi-tenancy – isolate log data by customer, team, or environment; per-tenant retention, access control, and query limits; essential for MSPs and SaaS platforms

Log management is foundational to operations, security, and compliance. Without centralized log management, troubleshooting requires manual log file inspection across dozens of servers, security incidents go undetected, and audit requirements cannot be met.

The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.

Comparison

This evaluation covers the full log management and observability landscape.

Overview Comparison

Log Collection & Ingestion

Storage & Search

Observability Features

Data Pipeline & Routing

SSO / OIDC Comparison

OIDC is the preferred SSO protocol. The table notes each tool’s behaviour with Authentik as the IdP.

* = requires enterprise or paid license

Best SSO support: Splunk, Datadog, New Relic, Dynatrace, Sumo Logic, Coralogix, Falcon LogScale, Cribl (OIDC + SAML + SCIM)

No SSO needed: Pipeline agents (Fluent Bit, Fluentd, Vector, Logstash, Filebeat, Promtail, rsyslog, syslog-ng) and CLI tools (GoAccess) – no user-facing UI

OIDC among OSS: OpenSearch (Security plugin), OpenObserve, Grafana (for Loki/Tempo access)

Monitoring Integration

How each tool integrates with a Telegraf (metrics) / Fluent Bit (logs) / Grafana (dashboards) monitoring stack.

Deployment & Scale

Tools

30 tools.

Axiom

Axiom is an observability platform designed around the principle of “store everything, query anything.” Unlike traditional log management platforms that charge per GB of indexed data, Axiom separates ingest costs from query costs by storing…

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

Coralogix

Coralogix is a cloud-native observability platform that differentiates through its Streama technology – an approach that analyzes data in-stream before storage, enabling real-time insights without indexing all data.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

Cribl

Cribl is a commercial observability pipeline platform that routes, reduces, enriches, and transforms data between any source and any destination.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Datadog Logs

Datadog is a leading cloud-native monitoring and observability SaaS platform providing unified infrastructure monitoring, APM, log management, security monitoring, synthetics, and real user monitoring.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

Dynatrace

Dynatrace is an AI-powered, full-stack observability and security platform that provides automatic discovery, dependency mapping, and root cause analysis across hybrid and multi-cloud environments.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

Elastic Observability

Elastic Observability is an integrated observability solution built on the Elastic Stack (Elasticsearch, Kibana, Elastic Agent).

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Elasticsearch

Elasticsearch is the original search and analytics engine that defined the modern log management landscape.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Falcon LogScale

Falcon LogScale (formerly Humio) is a log management and observability platform that uses an index-free architecture for streaming ingestion and real-time search.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Filebeat

Filebeat is a lightweight log shipper from the Elastic Beats family, designed to forward log data from servers to Elasticsearch, Logstash, or other destinations.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Fluent Bit

Fluent Bit is a lightweight, high-performance log processor and forwarder designed for resource- constrained environments, IoT, containers, and bare-metal servers.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Fluentd

Fluentd is a CNCF-graduated open-source data collector that unifies logging with a pluggable, tag-based routing architecture and over 1,000 plugins for input, parsing, filtering, and output.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

GoAccess

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal or generates standalone HTML reports.

License: MIT (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Grafana Loki

Grafana Loki is a horizontally scalable, highly available log aggregation system inspired by Prometheus.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Grafana Tempo

Grafana Tempo is a high-volume, minimal-dependency distributed tracing backend. Like Grafana Loki’s approach to logs, Tempo takes a cost-efficient approach to traces by storing them on object storage (S3, GCS, Azure Blob) without requiring…

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Graylog

Graylog is a centralized log management platform that combines log collection, parsing, search, alerting, and dashboards in a single product.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Jaeger

Jaeger is a CNCF-graduated open-source distributed tracing platform, originally from Uber, for monitoring and troubleshooting microservices with latency analysis, service dependency graphs, and OpenTelemetry support.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Logstash

Logstash is a server-side data processing pipeline that ingests data from multiple sources, transforms it, and sends it to a destination.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Mezmo

Mezmo (formerly LogDNA) is a developer-focused log management platform that emphasizes simplicity, fast search, and real-time log tailing.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

New Relic Logs

New Relic is a full-stack observability platform providing APM, infrastructure monitoring, log management, browser monitoring, mobile monitoring, synthetics, and AI-assisted operations.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

OpenObserve

OpenObserve (formerly ZincObserve, successor to ZincSearch) is a cloud-native observability platform that handles logs, metrics, and traces in a single system.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

OpenSearch

OpenSearch is a community-driven, Apache-2.0 licensed search and analytics engine forked from Elasticsearch 7.10.2 by AWS in 2021 after Elastic changed Elasticsearch’s license from Apache-2.0 to SSPL/ELv2.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Parseable

Parseable is a lightweight, cloud-native log analytics platform built in Rust. It stores log data in Apache Parquet columnar format on object storage (S3, MinIO, GCS, Azure Blob), providing cost-efficient log storage with SQL-based query ca…

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Promtail

Promtail is the default log collection agent for Grafana Loki. It discovers log sources, attaches labels to log streams, and pushes them to a Loki instance via the Loki push API.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Quickwit

Quickwit is a cloud-native search engine designed for log management and distributed tracing. Built in Rust, it stores data directly on object storage (S3, MinIO, GCS, Azure Blob) while providing sub-second search performance.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

rsyslog

rsyslog is a high-performance syslog daemon that serves as the default system logging service on most major Linux distributions including RHEL, CentOS, Ubuntu, Debian, and SUSE.

License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

SigNoz

SigNoz is an open-source, OpenTelemetry-native observability platform that provides logs, metrics, and traces in a unified interface.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source

Splunk

Splunk is a market-leading enterprise log management, search, and security analytics platform, using its SPL query language for analysis, alerting, and SIEM, available self-hosted or as Splunk Cloud.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Sumo Logic

Sumo Logic is a cloud-native machine data analytics platform that provides log management, security analytics, and observability.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

syslog-ng

syslog-ng is a high-performance syslog daemon and log management tool that extends traditional syslog with reliable transport, flexible filtering, content-based routing, and structured logging support.

License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

Vector

Vector is a high-performance observability data pipeline built in Rust by Datadog. It can collect, transform, and route logs, metrics, and traces from any source to any destination.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native, docker · SSO: none

Website · Source