Free equivalent for Splunk log manager

Question

What might be a free alternative for Splunk?

What I want:

• easy installation (RPM packages preferred)

• logs gathering and indexing

• searching log

• monitoring and alerting

• web GUI

My log files are rather small (small volume). What might be a good substitute?

Answer 1

Relatively good Splunk replacement: logstash with kibana. Obviously, setting it up is way more complicated than setting up Splunk, but it offers similar - but not as complete - feature set.

First, your requirements:

Easy installation: fail. Installing logstash and kibana requires multiple steps. No official rpm packages are available. I recently evaluated all free log managers I could find, and there were no feature rich alternatives that were easy to install.

logs gathering and indexing: check. logstash collects and indexes logs from files or through syslog, among other mechanisms. Everything is indexed to ElasticSearch.

searching logs: check. ElasticSearch provides good searching and filtering facilities.

monitoring and alerting: check? logstash supports alerts based on message rates and values.

web gui: check. Kibana offers decent web GUI for logstash.

---

In my experience, the main differences between Splunk and logstash/kibana are following:

• In Splunk, virtually everything is configurable from UI, and built-in. This includes things like user authentication. With logstash/kibana, that's not the case. Both logstash ("backend") and Kibana ("frontend") have plenty of options that are not too well documented, and require tweaking settings files or templates (or code).
• Splunk has better performance (but that comes with high cost). logstash architecture supports horizontal scaling to multiple servers, if needed.
• Splunk looks better. For sysadmins, that often does not matter, but for average user, it often makes the difference.
• Splunk parses some log entries better than logstash. However, field parsing in logstash is good enough, and easily configurable.
• With logstash, you have to make more manual decisions (indexing, retention, filters, metrics etc.). Parts of the configuration are hard to change afterwards. With Splunk, virtually everything is configurable at any time, and defaults are good.

Answer 2

There are quite a few long monitoring tools out there, we've been using Logscape The difference between the open source and commercial solution would be how long it takes you to get started.

Logscape and Splunk have similar features and will be fine for what you want to do. Excluding the differences around data tenuring and data modelling the main difference is the volume of data you can use with the free version of these tools. Splunk will be capped but Logscape is unlimited as long as you use only the data collection agents. The other system components provide more enterprisey features.