How we make this list: we compare pricing pages, product documentation and public user reviews. Rankite is independent; if a vendor ever pays for a featured spot, that listing is clearly labeled Partner.
Key takeaways
- For full log management with search, dashboards and alerting, shortlist Graylog, OpenSearch and Grafana Loki: all three are genuinely open source with production track records.
- Fluentd is the collector, not the destination: pair it with one of the storage backends above for a complete pipeline.
- Watch the licenses: Elasticsearch is source-available (SSPL), not OSI open source, while OpenSearch is fully Apache 2.0. It matters if you resell or embed.
- Self-hosting trades license cost for engineering time. Budget for storage, retention tuning and on-call before declaring victory over per-GB pricing.
Here is the uncomfortable truth about "free" log management: the software costs nothing and the infrastructure costs plenty. Open source log tools win when your log volume is high enough that per-GB SaaS pricing hurts, or when compliance keeps your data on your own servers. They lose when nobody on your team wants to run a distributed system at 3 a.m. These seven are the ones that survive that trade-off.
#1
Graylog
Best for: Teams wanting a complete open source log platform with SIEM built in
Visit graylog.org
Starting priceFree (open source edition)
Free planYes
Graylog started in 2009 as an open source log management project and evolved into a full SIEM on the same codebase, which shows in the design: log handling is the foundation, not an afterthought. Collection, parsing, search, dashboards, alerting and reporting all work out of the box, and the open source edition is genuinely capable rather than a demo. For teams that want one tool covering both operational logs and security use cases, it is the most complete free option here.
The honest catch is scale and the edition split. Graylog handles serious volume, but multi-terabyte estates need proper cluster design, not a single node. And while the open source core is strong, features like advanced correlation and some compliance content live in the paid tier. Start with the open edition and pay only when you hit a named limitation.
What we like- Full pipeline from collection to dashboards, alerting and reporting
- Grew from a 2009 open source project into a mature SIEM
- Straightforward to deploy for small and mid-size estates
Watch out for- Very large deployments need careful architecture
- The most advanced features sit in the paid enterprise edition
#2
Elastic Stack (ELK)
Best for: Organizations standardizing on Elasticsearch for logs, search and security
Visit elastic.co
Starting priceFree (self-managed)
Free planYes
The ELK stack (Elasticsearch, Logstash/Beats, Kibana) remains the default answer for log management, and for good reasons: unmatched full-text search, a giant integration ecosystem, and one platform that stretches from ops logs to SIEM. The free self-managed tier is generous, and the talent pool that knows Elasticsearch is the largest in the industry.
The caveat is licensing, and it matters. Since 2021 Elasticsearch has shipped under SSPL and the Elastic License, which are source-available but not OSI-approved open source. You can self-host freely for internal use, but you cannot offer Elasticsearch as a managed service to others. If strict open source licensing matters to your legal team, OpenSearch below is the Apache 2.0 alternative. Also budget real hardware: Elasticsearch eats memory and disk the way the category demands.
What we like- The most widely deployed log search engine in the world
- Huge ecosystem of integrations, documentation and hiring talent
- Kibana dashboards and Elastic Security included
Watch out for- Elasticsearch is source-available (SSPL/Elastic License), not OSI open source
- Resource-hungry at scale
- License terms restrict offering it as a managed service
#3
Grafana Loki
Best for: Kubernetes and cloud-native teams already using Grafana
Visit grafana.com
Starting priceFree (open source)
Free planYes
Loki takes a different architectural bet: instead of indexing every word like Elasticsearch, it indexes metadata labels and compresses the log chunks. The result is a log system that costs a fraction to operate, which is exactly why it dominates Kubernetes shops that already live in Grafana. If your team thinks in Prometheus labels, Loki feels native from day one.
The trade-off is search style. Loki is excellent at "show me logs for service X in namespace Y over the last hour" and weaker at "find every occurrence of this string across all logs ever." Know which query pattern dominates your incident response before choosing. It is AGPL licensed, which is proper open source with the usual copyleft considerations for modified distribution.
What we like- Indexes labels instead of full log text, so it is dramatically cheaper to run than Elasticsearch
- Native fit with Prometheus and Grafana dashboards
- AGPL open source with a huge community
Watch out for- Label-based design is weaker for ad-hoc full-text search
- Very high cardinality labels can hurt performance
#4
Fluentd
Best for: Standardizing log collection across a messy, heterogeneous estate
Visit fluentd.org
Starting priceFree
Free planYes
Fluentd solves the unglamorous half of log management: getting logs off thousands of machines, containers and applications into one pipeline. Its 500-plus plugins connect nearly any source to nearly any destination, and as a CNCF graduated project it has a decade-plus production record, including users collecting from tens of thousands of servers.
Be clear about what it is not: Fluentd does not store, index or search logs. It is the plumbing. Pair it with Graylog, OpenSearch, Loki or Elasticsearch as the backend. Its value is architectural: standardize collection once in Fluentd, and you can swap the expensive backend later without touching every application.
What we like- 500+ plugins connecting nearly any source to any destination
- CNCF project with long production history
- Decouples collection from storage so backends can change
Watch out for- It is a collector and router, not a search or dashboard tool
- Ruby-based with a learning curve on configuration
#5
OpenSearch
Best for: Teams that want Elasticsearch-style power under a true open source license
Visit opensearch.org
Starting priceFree
Free planYes
OpenSearch is the fork AWS created when Elasticsearch changed its license, and it is now the answer for teams that need Elasticsearch-class search under a genuine open source license. It is fully Apache 2.0 from ingest to dashboard, governed by the OpenSearch Software Foundation under the Linux Foundation, with security analytics and observability features built in.
Migration from Elasticsearch is deliberately eased by API compatibility, which is why many teams switched rather than accepting SSPL terms. The honest gap is ecosystem momentum: Elasticsearch still has more integrations, more blog posts and more available hires. Choose OpenSearch when license purity or AWS alignment matters; choose Elasticsearch when ecosystem size wins.
What we like- Fully Apache 2.0 licensed, now a Linux Foundation project
- Elasticsearch-compatible APIs ease migration
- Strong observability and security analytics features
Watch out for- Smaller ecosystem than Elasticsearch
- Some newer Elastic features have no OpenSearch equivalent
#6
SigNoz
Best for: Teams wanting logs, metrics and traces in one open source platform
Visit signoz.io
Starting price$49/month (SigNoz Cloud); self-hosted version free
Free planYes (self-hosted)
SigNoz positions itself as the open source Datadog alternative, and the architecture is modern: OpenTelemetry-native ingestion, ClickHouse columnar storage, and one interface for logs, metrics, traces, exceptions and alerts. For teams standardizing on OpenTelemetry, having all signals in one queryable place beats correlating across three tools.
The trade-off is maturity. It does not have Graylog's or Elasticsearch's decade of edge cases solved, and the self-hosted route means you operate the stack. The cloud pricing is refreshingly simple ($49/month Teams tier, usage-based, no per-seat math), but the open source argument is the self-hosted version: free software, your infrastructure, no per-GB billing.
What we like- Single OpenTelemetry-native UI for logs, traces, metrics and alerts
- ClickHouse-backed storage keeps costs down
- No per-seat or per-host pricing on cloud
Watch out for- Newer project than the incumbents, so the integration catalog is thinner
- Self-hosting means operating ClickHouse yourself
#7
Wazuh
Best for: Security teams needing open source SIEM with log management included
Visit wazuh.com
Starting priceFree
Free planYes
Wazuh is the open source security platform that happens to be a capable log manager. It collects logs from endpoints and cloud workloads, correlates them against threat detections, and adds active response, all free and open source with a massive community. If your log management project is driven by security and compliance rather than developer debugging, Wazuh covers both in one deployment.
The honest catch is perspective: it thinks like a SOC tool, not like an observability tool. Developers tracing a latency spike will prefer Loki or SigNoz. But for the team that needs SIEM, intrusion detection, vulnerability detection and log management without a six-figure license, nothing else free comes close.
What we like- Free and open source XDR/SIEM with log collection, detection and response
- Huge community with millions of protected endpoints
- Managed Wazuh Cloud option available
Watch out for- Security-first design means the ops-log UX is less polished than Grafana
- Tuning detection rules takes security expertise
Quick comparison
| Tool | Best for | Starting price | Free plan |
|---|
| Graylog | Teams wanting a complete open source log platform with SIEM built in | Free (open source edition) | Yes |
| Elastic Stack (ELK) | Organizations standardizing on Elasticsearch for logs, search and security | Free (self-managed) | Yes |
| Grafana Loki | Kubernetes and cloud-native teams already using Grafana | Free (open source) | Yes |
| Fluentd | Standardizing log collection across a messy, heterogeneous estate | Free | Yes |
| OpenSearch | Teams that want Elasticsearch-style power under a true open source license | Free | Yes |
| SigNoz | Teams wanting logs, metrics and traces in one open source platform | $49/month (SigNoz Cloud); self-hosted version free | Yes (self-hosted) |
| Wazuh | Security teams needing open source SIEM with log management included | Free | Yes |
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
How we chose
We started with the searches engineers run: open source log management, self-hosted log aggregation and ELK alternatives. For each candidate we opened the vendor or project homepage to confirm it is actively maintained and genuinely available as open source, checked documentation and community activity, and compared architecture, license and operational fit. License notes above reflect each project's stated license; where a project is source-available rather than OSI open source, we said so.
The real cost model: software is free, infrastructure is not
Every tool here is free to download, and every tool here will send you an infrastructure bill. Log management cost is dominated by three things: ingestion volume, index storage and retention period. Elasticsearch and OpenSearch index everything, which makes search fast and disks full. Loki indexes labels only, which makes it cheap and changes how you query. Graylog and Wazuh sit in between with tunable retention.
Before choosing, measure your daily log volume in GB and decide your retention policy: 30 days hot, 90 days warm, a year cold is a common shape. Then price the disks. A team generating 100 GB/day that keeps a year of logs is storing 36 TB before replication; at that point the "free" software decision is really a storage architecture decision. The second cost is people: someone owns upgrades, index tuning and the 3 a.m. page. If that someone does not exist on your team, the managed cloud version of one of these tools (or a SaaS log platform) is cheaper than the outage.
License guide: what "open source" actually means here
Not everything called open source carries the same license, and the differences have teeth. Apache 2.0 (OpenSearch, Fluentd) is the most permissive: use it, modify it, embed it, sell services around it. AGPL (Grafana Loki) is copyleft with a network clause: if you modify Loki and let users interact with it over a network, you must share the modifications. For internal use this rarely bites; for embedding in a commercial product, get legal advice.
SSPL and the Elastic License (Elasticsearch) are source-available, not OSI open source: free to use and self-host internally, but you may not offer the software as a managed service competing with the vendor. Graylog's open core model means the core is open source while advanced features are proprietary. None of these licenses charge you for internal log management. They matter when you resell, embed or offer multi-tenant services. When in doubt, the rule is simple: internal use is safe everywhere here; commercial redistribution needs a license review.
Frequently asked questions
What is the best open source log management tool?
Graylog is the most complete all-in-one open source option, OpenSearch is the best Apache 2.0 search backend, and Grafana Loki is the cheapest to run for Kubernetes teams. Most real deployments pair a collector (Fluentd) with one of these backends.
Is the ELK stack still open source?
Elasticsearch and Kibana are source-available under SSPL and the Elastic License, not OSI-approved open source. They are free to self-host for internal use. Teams needing a strictly open source license usually choose OpenSearch, the Apache 2.0 fork.
How much does it cost to run open source log management?
The software is free; the infrastructure is the cost. Budget for storage (the dominant expense, driven by daily volume times retention), compute for indexing and search, and engineering time for operations. A small deployment can run on a single server; large estates need a designed cluster.
Can open source tools replace Datadog or Splunk?
For log collection, search, dashboards and alerting, yes: Graylog, OpenSearch, Loki and SigNoz cover the core workflows. The gaps are usually managed-service convenience, some advanced security content, and the breadth of integrations. Teams with strong platform engineering do fine; teams without it often prefer the SaaS.
What is the difference between Fluentd and the other tools?
Fluentd is a log collector and router: it gathers logs from sources and forwards them to destinations. The other tools store, index and search logs. A complete pipeline usually includes both: Fluentd (or the OpenTelemetry Collector) for collection, plus a backend like OpenSearch or Loki for storage and search.
Do I need Kubernetes to use these tools?
No. All seven run on plain virtual machines or bare metal. Loki and SigNoz are popular in Kubernetes environments but do not require it, and Graylog, OpenSearch, Wazuh and the Elastic Stack have long histories on traditional infrastructure.
Sources we checked (7)
- https://graylog.org/
- https://www.elastic.co
- https://grafana.com/
- https://www.fluentd.org
- https://opensearch.org
- https://signoz.io
- https://wazuh.com/
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Shihab Mia · Founder, Rankite
Shihab has spent more than a decade helping SaaS and e-commerce brands grow through search. He writes Rankite's software buying guides from pricing pages, documentation and public user reviews. More about Shihab.