How we make this list: we compare pricing pages, product documentation and public user reviews. Rankite is independent; if a vendor ever pays for a featured spot, that listing is clearly labeled Partner.
Key takeaways
- Log management is priced like a utility: per gigabyte ingested, per million events indexed, or per host. Your log volume decides the bill more than the feature list.
- Datadog ($0.10/GB ingested; $1.70 per million indexed events) is the managed default for teams already in its observability ecosystem.
- Grafana Loki (free for 50GB/month; Pro from $19/month) and SigNoz (free self-hosted; Cloud from $49/month) are the cost-efficient answers for Kubernetes and OpenTelemetry shops.
- New Relic (100GB/month free) and Better Stack (3GB/month free) have the most generous free tiers for small teams.
- Splunk and Sumo Logic are quote-based enterprise plays; Elastic publishes usage rates from $0.07/GB ingested for its serverless tier.
Quick comparison
| Tool | Best for | Starting price | Free plan |
|---|
 Datadog | Teams already in the Datadog ecosystem | $0.10/GB ingested | Free trial |
 New Relic | Teams wanting a generous free tier | Free (100GB/month); then $0.40/GB | Yes |
 Better Stack | Small teams that want fast setup | Free (3GB/month); from ~$0.10/GB ingested | Yes |
 Sumo Logic | Cloud operations and compliance analytics | See website (quote-based) | Free trial |
 Grafana Loki | Kubernetes and Grafana environments | Free (50GB/month on Cloud); Pro $19/month | Yes |
 Elastic | Full-text search and flexible pipelines | From $0.07/GB ingested (serverless) | Free trial |
 SigNoz | OpenTelemetry-native observability | Free (self-hosted); Cloud from $49/month | Yes |
 Graylog | Self-hosted syslog centralization | Free (Open); Enterprise from $15,000/year | Yes |
 Splunk | Enterprise search, security and compliance at scale | See website (quote-based) | Free trial |
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Logs are how you find out what broke, who did what, and whether you are compliant. The tools that collect, store and search them range from free open-source stacks to enterprise platforms with per-gigabyte meters. The nine below cover the real options, with the pricing models explained honestly because the meter matters more than the marketing.
Managed SaaS: logs without infrastructure
Starting price$0.10/GB ingested
Free planFree trial
Datadog's log management is the default for teams already paying for its APM or infrastructure monitoring. Log ingestion costs $0.10 per GB, and indexed logs (the ones you can actually search fast) cost $1.70 per million events at 15-day retention, with longer retention priced higher. Having logs, traces and metrics in one query interface is the real value.
The honest complaint is bill complexity. Ingest and index are separate meters, retention multiplies costs, and high-volume environments produce surprising invoices. Use inclusion filters and index only what you will search; archive the rest cheaply. If you are not already a Datadog shop, the log product alone rarely justifies the platform.
What we like- Published per-GB pricing ($0.10 to ingest, $1.70 per million indexed events at 15-day retention)
- Logs sit next to APM, infrastructure and RUM in one platform
- 900-plus integrations
Watch out for- The two-meter model (ingest plus index) confuses cost forecasting
- Bills grow fast with log volume and retention
- SaaS-only, no self-hosted option
Starting priceFree (100GB/month); then $0.40/GB
Free planYes
New Relic's pricing is refreshingly simple for the category: 100GB of log ingest a month free, then $0.40 per GB. Small teams and side projects get real log management at zero cost, and growing teams face one clear meter instead of Datadog's two.
The platform play is the same as Datadog's: logs are most valuable next to APM and infrastructure data. If you already run New Relic for observability, its logs are the path of least resistance. As a standalone log tool evaluated against Loki or SigNoz, the $0.40/GB rate is honest but not the cheapest.
What we like- 100GB a month free, the most generous free tier in managed logging
- Simple $0.40/GB beyond that
- Logs unified with APM and infrastructure monitoring
Watch out for- The free tier ends abruptly at 100GB with no middle step
- Advanced features push toward the full platform
- Smaller log-specific community than Datadog or Elastic
Starting priceFree (3GB/month); from ~$0.10/GB ingested
Free planYes
Better Stack is the tool for teams that want logging working this afternoon. Signup to searchable logs takes minutes, the free tier covers 3GB a month, and paid ingest runs roughly $0.10 to $0.15 per GB depending on region. Bundling logs with uptime monitoring and on-call paging makes it a neat small-team operations package.
It is not the tool for complex log analytics at scale: query depth and ecosystem trail the bigger platforms. But for startups and small SaaS teams whose alternative is no centralized logging at all, the low friction and honest pricing win.
What we like- 3GB a month free with genuinely fast onboarding
- Simple per-GB pricing around $0.10 to $0.15 by region
- Pairs logs with uptime monitoring and on-call in one vendor
Watch out for- The free tier is small for anything beyond tiny workloads
- Less depth for complex querying than Elastic or Loki
- Younger platform with a smaller ecosystem
Starting priceSee website (quote-based)
Free planFree trial
Sumo Logic built its reputation on cloud log analytics for operations and security teams, with compliance content that regulated industries value. The platform handles the full pipeline from collection to dashboards to alerting, with editions tuned for observability and security use cases.
Pricing is quote-based on plan, ingest tier and credits, so it shows "See website" here. The credit model makes forecasting harder than Datadog's published per-GB rates. Evaluate it when compliance reporting and multi-cloud coverage matter more than price transparency, and get the credit burn in writing during the trial.
What we like- Strong multi-cloud log analytics with compliance-oriented content
- Mature platform with security and observability editions
- Good for regulated industries
Watch out for- Quote-based pricing with credit tiers that are hard to forecast
- No published per-GB rate for the SIEM/analytics tiers
- Enterprise sales motion
Starting priceFree (50GB/month on Cloud); Pro $19/month
Free planYes
Loki's insight is that most log queries filter by labels (service, environment, level) before searching text, so it indexes labels instead of full text. The result is a fraction of Elasticsearch's storage and compute cost. The open-source core is free, Grafana Cloud includes 50GB a month free, and Pro starts at $19 a month plus $0.55 per GB.
The trade-off is search: ad-hoc full-text exploration across huge volumes is slower than Elastic. Teams running Kubernetes with Prometheus already have the ecosystem; Loki slots in naturally. For cost-efficient log aggregation at scale, it is the most proven open-source answer.
What we like- Label-based indexing makes it dramatically cheaper to run than full-text search
- Free open source plus 50GB a month free on Grafana Cloud
- Native fit for Prometheus and Grafana shops
Watch out for- Label-based design means slower full-text search than Elasticsearch
- High-cardinality labels can explode costs
- Querying needs LogQL learning
Starting priceFrom $0.07/GB ingested (serverless)
Free planFree trial
Elasticsearch remains the gold standard for searching logs as text. The serverless Logs Essentials tier starts at $0.07 per GB ingested with retention at $0.017 per GB per month, which makes the meter legible, and Elastic Cloud's hosted tiers start around $95 a month for resource-based plans. The ecosystem of beats, integrations and community knowledge is unmatched.
Running it yourself is the classic trade: no license fees, but you operate the cluster. Teams with existing ELK expertise get the most powerful log search for infrastructure cost only. Everyone else should weigh the operational burden against Loki's or SigNoz's lighter footprints.
What we like- The most powerful full-text log search available
- Serverless pricing from $0.07/GB ingested with $0.017/GB monthly retention
- Huge ecosystem and talent pool
Watch out for- Self-hosting Elasticsearch at scale is real operational work
- The pricing has multiple meters across deployment options
- Resource-hungry compared to Loki
Starting priceFree (self-hosted); Cloud from $49/month
Free planYes
SigNoz is the open-source answer to the Datadog-style unified platform: logs, metrics and traces in one tool, ingested via OpenTelemetry. The self-hosted core is free, and SigNoz Cloud starts at $49 a month (including $49 of usage) with log ingestion at $0.30 per GB.
For teams standardizing on OpenTelemetry that want a single open-source backend, it is the most coherent option. The project is younger than Loki or Elastic, so the ecosystem and battle-testing are thinner. But the pricing, free to start and legible to scale, is exactly what cost-conscious platform teams ask for.
What we like- Free open-source core with logs, metrics and traces in one
- OpenTelemetry-native ingestion
- Cloud from $49 a month including $49 of usage with $0.30/GB log ingestion
Watch out for- Younger project with a smaller ecosystem than Elastic or Loki
- Self-hosting needs operational effort
- Enterprise features still maturing
Starting priceFree (Open); Enterprise from $15,000/year
Free planYes
Graylog is the veteran of self-hosted log centralization. Graylog Open costs nothing and handles syslog, infrastructure and application logs competently on your own hardware. It is a fixture in organizations that must keep logs on-premises for compliance or policy reasons.
The jump to Enterprise at $15,000 a year is steep, and the product shows its age next to Loki and SigNoz in query experience. But for the specific job of free, self-hosted, compliance-friendly log centralization, it remains a dependable choice with years of production history.
What we like- Free Open version with no license fee for centralized logging
- Strong syslog heritage for network and infrastructure logs
- Straightforward on-premises deployment
Watch out for- Enterprise pricing starts at $15,000 a year, a steep step from free
- The interface and query language trail modern alternatives
- Cloud offering is less mature
#9
Splunk
Best for: Enterprise search, security and compliance at scale
Visit splunk.com
Starting priceSee website (quote-based)
Free planFree trial
Splunk is the enterprise log platform by adoption: unmatched search depth, an app for nearly every data source, and the ability to handle volumes that break other tools. Splunk Cloud removes the infrastructure burden, and the Observability Cloud products cover APM and infrastructure alongside logs.
The pricing is the industry's cautionary tale, entirely quote-based on ingest, workload or entity models, with a long-earned reputation as the most expensive option. Organizations choose Splunk when log analytics is mission-critical at enterprise scale and the budget matches. Everyone else should exhaust the options above first, because the price-to-value math rarely favors Splunk below serious enterprise volumes.
What we like- The deepest log search and analytics language (SPL) in the industry
- Massive integration and app ecosystem
- Handles the largest enterprise volumes
Watch out for- Quote-based pricing with the highest cost reputation in the category
- Ingestion economics punish high volumes
- Implementation and staffing are enterprise-grade efforts
Open source and cost-efficient: control the meter
Starting price$0.10/GB ingested
Free planFree trial
Datadog's log management is the default for teams already paying for its APM or infrastructure monitoring. Log ingestion costs $0.10 per GB, and indexed logs (the ones you can actually search fast) cost $1.70 per million events at 15-day retention, with longer retention priced higher. Having logs, traces and metrics in one query interface is the real value.
The honest complaint is bill complexity. Ingest and index are separate meters, retention multiplies costs, and high-volume environments produce surprising invoices. Use inclusion filters and index only what you will search; archive the rest cheaply. If you are not already a Datadog shop, the log product alone rarely justifies the platform.
What we like- Published per-GB pricing ($0.10 to ingest, $1.70 per million indexed events at 15-day retention)
- Logs sit next to APM, infrastructure and RUM in one platform
- 900-plus integrations
Watch out for- The two-meter model (ingest plus index) confuses cost forecasting
- Bills grow fast with log volume and retention
- SaaS-only, no self-hosted option
Starting priceFree (100GB/month); then $0.40/GB
Free planYes
New Relic's pricing is refreshingly simple for the category: 100GB of log ingest a month free, then $0.40 per GB. Small teams and side projects get real log management at zero cost, and growing teams face one clear meter instead of Datadog's two.
The platform play is the same as Datadog's: logs are most valuable next to APM and infrastructure data. If you already run New Relic for observability, its logs are the path of least resistance. As a standalone log tool evaluated against Loki or SigNoz, the $0.40/GB rate is honest but not the cheapest.
What we like- 100GB a month free, the most generous free tier in managed logging
- Simple $0.40/GB beyond that
- Logs unified with APM and infrastructure monitoring
Watch out for- The free tier ends abruptly at 100GB with no middle step
- Advanced features push toward the full platform
- Smaller log-specific community than Datadog or Elastic
Starting priceFree (3GB/month); from ~$0.10/GB ingested
Free planYes
Better Stack is the tool for teams that want logging working this afternoon. Signup to searchable logs takes minutes, the free tier covers 3GB a month, and paid ingest runs roughly $0.10 to $0.15 per GB depending on region. Bundling logs with uptime monitoring and on-call paging makes it a neat small-team operations package.
It is not the tool for complex log analytics at scale: query depth and ecosystem trail the bigger platforms. But for startups and small SaaS teams whose alternative is no centralized logging at all, the low friction and honest pricing win.
What we like- 3GB a month free with genuinely fast onboarding
- Simple per-GB pricing around $0.10 to $0.15 by region
- Pairs logs with uptime monitoring and on-call in one vendor
Watch out for- The free tier is small for anything beyond tiny workloads
- Less depth for complex querying than Elastic or Loki
- Younger platform with a smaller ecosystem
Starting priceSee website (quote-based)
Free planFree trial
Sumo Logic built its reputation on cloud log analytics for operations and security teams, with compliance content that regulated industries value. The platform handles the full pipeline from collection to dashboards to alerting, with editions tuned for observability and security use cases.
Pricing is quote-based on plan, ingest tier and credits, so it shows "See website" here. The credit model makes forecasting harder than Datadog's published per-GB rates. Evaluate it when compliance reporting and multi-cloud coverage matter more than price transparency, and get the credit burn in writing during the trial.
What we like- Strong multi-cloud log analytics with compliance-oriented content
- Mature platform with security and observability editions
- Good for regulated industries
Watch out for- Quote-based pricing with credit tiers that are hard to forecast
- No published per-GB rate for the SIEM/analytics tiers
- Enterprise sales motion
Starting priceFree (50GB/month on Cloud); Pro $19/month
Free planYes
Loki's insight is that most log queries filter by labels (service, environment, level) before searching text, so it indexes labels instead of full text. The result is a fraction of Elasticsearch's storage and compute cost. The open-source core is free, Grafana Cloud includes 50GB a month free, and Pro starts at $19 a month plus $0.55 per GB.
The trade-off is search: ad-hoc full-text exploration across huge volumes is slower than Elastic. Teams running Kubernetes with Prometheus already have the ecosystem; Loki slots in naturally. For cost-efficient log aggregation at scale, it is the most proven open-source answer.
What we like- Label-based indexing makes it dramatically cheaper to run than full-text search
- Free open source plus 50GB a month free on Grafana Cloud
- Native fit for Prometheus and Grafana shops
Watch out for- Label-based design means slower full-text search than Elasticsearch
- High-cardinality labels can explode costs
- Querying needs LogQL learning
Starting priceFrom $0.07/GB ingested (serverless)
Free planFree trial
Elasticsearch remains the gold standard for searching logs as text. The serverless Logs Essentials tier starts at $0.07 per GB ingested with retention at $0.017 per GB per month, which makes the meter legible, and Elastic Cloud's hosted tiers start around $95 a month for resource-based plans. The ecosystem of beats, integrations and community knowledge is unmatched.
Running it yourself is the classic trade: no license fees, but you operate the cluster. Teams with existing ELK expertise get the most powerful log search for infrastructure cost only. Everyone else should weigh the operational burden against Loki's or SigNoz's lighter footprints.
What we like- The most powerful full-text log search available
- Serverless pricing from $0.07/GB ingested with $0.017/GB monthly retention
- Huge ecosystem and talent pool
Watch out for- Self-hosting Elasticsearch at scale is real operational work
- The pricing has multiple meters across deployment options
- Resource-hungry compared to Loki
Starting priceFree (self-hosted); Cloud from $49/month
Free planYes
SigNoz is the open-source answer to the Datadog-style unified platform: logs, metrics and traces in one tool, ingested via OpenTelemetry. The self-hosted core is free, and SigNoz Cloud starts at $49 a month (including $49 of usage) with log ingestion at $0.30 per GB.
For teams standardizing on OpenTelemetry that want a single open-source backend, it is the most coherent option. The project is younger than Loki or Elastic, so the ecosystem and battle-testing are thinner. But the pricing, free to start and legible to scale, is exactly what cost-conscious platform teams ask for.
What we like- Free open-source core with logs, metrics and traces in one
- OpenTelemetry-native ingestion
- Cloud from $49 a month including $49 of usage with $0.30/GB log ingestion
Watch out for- Younger project with a smaller ecosystem than Elastic or Loki
- Self-hosting needs operational effort
- Enterprise features still maturing
Starting priceFree (Open); Enterprise from $15,000/year
Free planYes
Graylog is the veteran of self-hosted log centralization. Graylog Open costs nothing and handles syslog, infrastructure and application logs competently on your own hardware. It is a fixture in organizations that must keep logs on-premises for compliance or policy reasons.
The jump to Enterprise at $15,000 a year is steep, and the product shows its age next to Loki and SigNoz in query experience. But for the specific job of free, self-hosted, compliance-friendly log centralization, it remains a dependable choice with years of production history.
What we like- Free Open version with no license fee for centralized logging
- Strong syslog heritage for network and infrastructure logs
- Straightforward on-premises deployment
Watch out for- Enterprise pricing starts at $15,000 a year, a steep step from free
- The interface and query language trail modern alternatives
- Cloud offering is less mature
#9
Splunk
Best for: Enterprise search, security and compliance at scale
Visit splunk.com
Starting priceSee website (quote-based)
Free planFree trial
Splunk is the enterprise log platform by adoption: unmatched search depth, an app for nearly every data source, and the ability to handle volumes that break other tools. Splunk Cloud removes the infrastructure burden, and the Observability Cloud products cover APM and infrastructure alongside logs.
The pricing is the industry's cautionary tale, entirely quote-based on ingest, workload or entity models, with a long-earned reputation as the most expensive option. Organizations choose Splunk when log analytics is mission-critical at enterprise scale and the budget matches. Everyone else should exhaust the options above first, because the price-to-value math rarely favors Splunk below serious enterprise volumes.
What we like- The deepest log search and analytics language (SPL) in the industry
- Massive integration and app ecosystem
- Handles the largest enterprise volumes
Watch out for- Quote-based pricing with the highest cost reputation in the category
- Ingestion economics punish high volumes
- Implementation and staffing are enterprise-grade efforts
Enterprise quote-based: Splunk
Starting price$0.10/GB ingested
Free planFree trial
Datadog's log management is the default for teams already paying for its APM or infrastructure monitoring. Log ingestion costs $0.10 per GB, and indexed logs (the ones you can actually search fast) cost $1.70 per million events at 15-day retention, with longer retention priced higher. Having logs, traces and metrics in one query interface is the real value.
The honest complaint is bill complexity. Ingest and index are separate meters, retention multiplies costs, and high-volume environments produce surprising invoices. Use inclusion filters and index only what you will search; archive the rest cheaply. If you are not already a Datadog shop, the log product alone rarely justifies the platform.
What we like- Published per-GB pricing ($0.10 to ingest, $1.70 per million indexed events at 15-day retention)
- Logs sit next to APM, infrastructure and RUM in one platform
- 900-plus integrations
Watch out for- The two-meter model (ingest plus index) confuses cost forecasting
- Bills grow fast with log volume and retention
- SaaS-only, no self-hosted option
Starting priceFree (100GB/month); then $0.40/GB
Free planYes
New Relic's pricing is refreshingly simple for the category: 100GB of log ingest a month free, then $0.40 per GB. Small teams and side projects get real log management at zero cost, and growing teams face one clear meter instead of Datadog's two.
The platform play is the same as Datadog's: logs are most valuable next to APM and infrastructure data. If you already run New Relic for observability, its logs are the path of least resistance. As a standalone log tool evaluated against Loki or SigNoz, the $0.40/GB rate is honest but not the cheapest.
What we like- 100GB a month free, the most generous free tier in managed logging
- Simple $0.40/GB beyond that
- Logs unified with APM and infrastructure monitoring
Watch out for- The free tier ends abruptly at 100GB with no middle step
- Advanced features push toward the full platform
- Smaller log-specific community than Datadog or Elastic
Starting priceFree (3GB/month); from ~$0.10/GB ingested
Free planYes
Better Stack is the tool for teams that want logging working this afternoon. Signup to searchable logs takes minutes, the free tier covers 3GB a month, and paid ingest runs roughly $0.10 to $0.15 per GB depending on region. Bundling logs with uptime monitoring and on-call paging makes it a neat small-team operations package.
It is not the tool for complex log analytics at scale: query depth and ecosystem trail the bigger platforms. But for startups and small SaaS teams whose alternative is no centralized logging at all, the low friction and honest pricing win.
What we like- 3GB a month free with genuinely fast onboarding
- Simple per-GB pricing around $0.10 to $0.15 by region
- Pairs logs with uptime monitoring and on-call in one vendor
Watch out for- The free tier is small for anything beyond tiny workloads
- Less depth for complex querying than Elastic or Loki
- Younger platform with a smaller ecosystem
Starting priceSee website (quote-based)
Free planFree trial
Sumo Logic built its reputation on cloud log analytics for operations and security teams, with compliance content that regulated industries value. The platform handles the full pipeline from collection to dashboards to alerting, with editions tuned for observability and security use cases.
Pricing is quote-based on plan, ingest tier and credits, so it shows "See website" here. The credit model makes forecasting harder than Datadog's published per-GB rates. Evaluate it when compliance reporting and multi-cloud coverage matter more than price transparency, and get the credit burn in writing during the trial.
What we like- Strong multi-cloud log analytics with compliance-oriented content
- Mature platform with security and observability editions
- Good for regulated industries
Watch out for- Quote-based pricing with credit tiers that are hard to forecast
- No published per-GB rate for the SIEM/analytics tiers
- Enterprise sales motion
Starting priceFree (50GB/month on Cloud); Pro $19/month
Free planYes
Loki's insight is that most log queries filter by labels (service, environment, level) before searching text, so it indexes labels instead of full text. The result is a fraction of Elasticsearch's storage and compute cost. The open-source core is free, Grafana Cloud includes 50GB a month free, and Pro starts at $19 a month plus $0.55 per GB.
The trade-off is search: ad-hoc full-text exploration across huge volumes is slower than Elastic. Teams running Kubernetes with Prometheus already have the ecosystem; Loki slots in naturally. For cost-efficient log aggregation at scale, it is the most proven open-source answer.
What we like- Label-based indexing makes it dramatically cheaper to run than full-text search
- Free open source plus 50GB a month free on Grafana Cloud
- Native fit for Prometheus and Grafana shops
Watch out for- Label-based design means slower full-text search than Elasticsearch
- High-cardinality labels can explode costs
- Querying needs LogQL learning
Starting priceFrom $0.07/GB ingested (serverless)
Free planFree trial
Elasticsearch remains the gold standard for searching logs as text. The serverless Logs Essentials tier starts at $0.07 per GB ingested with retention at $0.017 per GB per month, which makes the meter legible, and Elastic Cloud's hosted tiers start around $95 a month for resource-based plans. The ecosystem of beats, integrations and community knowledge is unmatched.
Running it yourself is the classic trade: no license fees, but you operate the cluster. Teams with existing ELK expertise get the most powerful log search for infrastructure cost only. Everyone else should weigh the operational burden against Loki's or SigNoz's lighter footprints.
What we like- The most powerful full-text log search available
- Serverless pricing from $0.07/GB ingested with $0.017/GB monthly retention
- Huge ecosystem and talent pool
Watch out for- Self-hosting Elasticsearch at scale is real operational work
- The pricing has multiple meters across deployment options
- Resource-hungry compared to Loki
Starting priceFree (self-hosted); Cloud from $49/month
Free planYes
SigNoz is the open-source answer to the Datadog-style unified platform: logs, metrics and traces in one tool, ingested via OpenTelemetry. The self-hosted core is free, and SigNoz Cloud starts at $49 a month (including $49 of usage) with log ingestion at $0.30 per GB.
For teams standardizing on OpenTelemetry that want a single open-source backend, it is the most coherent option. The project is younger than Loki or Elastic, so the ecosystem and battle-testing are thinner. But the pricing, free to start and legible to scale, is exactly what cost-conscious platform teams ask for.
What we like- Free open-source core with logs, metrics and traces in one
- OpenTelemetry-native ingestion
- Cloud from $49 a month including $49 of usage with $0.30/GB log ingestion
Watch out for- Younger project with a smaller ecosystem than Elastic or Loki
- Self-hosting needs operational effort
- Enterprise features still maturing
Starting priceFree (Open); Enterprise from $15,000/year
Free planYes
Graylog is the veteran of self-hosted log centralization. Graylog Open costs nothing and handles syslog, infrastructure and application logs competently on your own hardware. It is a fixture in organizations that must keep logs on-premises for compliance or policy reasons.
The jump to Enterprise at $15,000 a year is steep, and the product shows its age next to Loki and SigNoz in query experience. But for the specific job of free, self-hosted, compliance-friendly log centralization, it remains a dependable choice with years of production history.
What we like- Free Open version with no license fee for centralized logging
- Strong syslog heritage for network and infrastructure logs
- Straightforward on-premises deployment
Watch out for- Enterprise pricing starts at $15,000 a year, a steep step from free
- The interface and query language trail modern alternatives
- Cloud offering is less mature
#9
Splunk
Best for: Enterprise search, security and compliance at scale
Visit splunk.com
Starting priceSee website (quote-based)
Free planFree trial
Splunk is the enterprise log platform by adoption: unmatched search depth, an app for nearly every data source, and the ability to handle volumes that break other tools. Splunk Cloud removes the infrastructure burden, and the Observability Cloud products cover APM and infrastructure alongside logs.
The pricing is the industry's cautionary tale, entirely quote-based on ingest, workload or entity models, with a long-earned reputation as the most expensive option. Organizations choose Splunk when log analytics is mission-critical at enterprise scale and the budget matches. Everyone else should exhaust the options above first, because the price-to-value math rarely favors Splunk below serious enterprise volumes.
What we like- The deepest log search and analytics language (SPL) in the industry
- Massive integration and app ecosystem
- Handles the largest enterprise volumes
Watch out for- Quote-based pricing with the highest cost reputation in the category
- Ingestion economics punish high volumes
- Implementation and staffing are enterprise-grade efforts
Taming the meter: how to keep log bills sane
Four practices separate reasonable log bills from horror stories. First, filter at collection: most log volume is debug noise nobody will ever query, so drop it before ingestion. Second, separate index from archive: index (fast, expensive) only what you will search in the next 30 days; archive everything else to cheap object storage. Third, set retention deliberately: compliance may demand a year, but only 30 days needs to be searchable. Fourth, alert on the bill itself: every platform here can notify you when ingest spikes, which is how you catch a runaway service before month-end.
How we chose
We compared on what decides log management purchases: ingestion and indexing pricing transparency, query power and speed, retention options and costs, OpenTelemetry and agent support, alerting, deployment flexibility (SaaS, self-hosted, hybrid), and the true monthly cost at 10GB, 100GB and 1TB per day. Prices come from vendor-published rates as reported by 2026 publisher comparisons; Splunk and Sumo Logic do not publish log pricing, so they show "See website." We read engineering reviews on G2 and practitioner discussions on Reddit for the recurring complaints: unpredictable bills, retention costs and query performance at scale.
When to self-host vs buy SaaS
Self-host (Loki, SigNoz, Graylog, Elastic) when you have platform engineering capacity, compliance requires data residency, or log volumes make SaaS meters punishing. Buy SaaS (Datadog, New Relic, Better Stack) when you want logging working today with no operational burden and your volumes fit the free or low tiers. The crossover point is usually team capacity, not price: a team without someone to run the cluster will spend more in engineering time than SaaS costs. Be honest about which team you have.
Frequently asked questions
What is the best free log management tool?
Grafana Loki (free open source, 50GB/month free on Cloud), SigNoz (free self-hosted) and Graylog Open (free) are the strongest free options. New Relic's 100GB/month free tier is the most generous managed free tier.
How much does log management cost?
Datadog charges $0.10/GB ingested plus $1.70 per million indexed events. Elastic serverless starts at $0.07/GB ingested. New Relic is $0.40/GB after 100GB free. Loki Pro is $19/month plus $0.55/GB. Splunk and Sumo Logic are quote-based. Self-hosted open-source tools cost infrastructure only.
Datadog vs Splunk for logs: which is better?
Datadog is simpler to buy and run, with published pricing and logs unified with APM. Splunk has deeper search analytics and handles larger enterprise volumes but costs significantly more with quote-based pricing. Most teams below enterprise scale choose Datadog, Loki or Elastic.
What is the difference between log management and SIEM?
Log management collects, stores and searches logs for operations and debugging. SIEM adds security correlation, threat detection and compliance workflows on top. Tools like Splunk and Elastic span both; Datadog and Loki are primarily observability.
How long should I retain logs?
Keep 30 days searchable (hot) for debugging, 90 days to a year in cheap archive storage for investigations, and meet your compliance minimum (often a year) in the archive tier. Only the searchable window needs expensive indexed storage.
Sources we checked (12)
- https://www.datadog.com/pricing/
- https://grafana.com/pricing/
- https://www.elastic.co/pricing
- https://newrelic.com/pricing
- https://signoz.io/pricing/
- https://betterstack.com/pricing/
- https://www.graylog.org/pricing/
- https://www.splunk.com
- https://www.sumologic.com
- https://signoz.io/blog/best-log-management-tools/
- https://openobserve.ai/blog/log-management-tools/
- https://kurums.com/best-log-management-software-2026-comparison/
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Shihab Mia · Founder, Rankite
Shihab has spent more than a decade helping SaaS and e-commerce brands grow through search. He writes Rankite's software buying guides from pricing pages, documentation and public user reviews. More about Shihab.