Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. The largest vendors in observability and log management software
cannot hold places 1 to 3. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category,
wherever the category has them; the established names follow from place 4 in their ranked order. How it works: placement disclosure ·
editorial process.
The 18 tools, reviewed
#1 Guardsix (formerly LogPoint)
SIEM and security-log management with node-based licensing · Denmark · logpoint.com
SIEM Self-hostable EU sovereignty
Rebranded from LogPoint in March 2026 with the product, contracts and support unchanged, Guardsix is the only tool in this category built log-first specifically for security teams.
- Pricing: Node-based, quote only. Node-based licensing set by the number of nodes, devices or entities, the products chosen and the support level, across four packages (Govern, Detect, Defend, Respond), quoted on request. Free plan: none.
- Best for: Security teams needing SIEM-grade log retention with predictable licensing
- Strengths: SIEM, NDR and SOAR under one Command Centre; UEBA and NDR start at the Defend package, SOAR at Respond; Self-hosted and air-gappable deployment; Node-based licensing rather than log-volume billing.
Where it falls short
The structured taxonomy and query language require real onboarding investment before a security team gets full value from it, pricing is quoted rather than a published, self-serve number, and the full SIEM, NDR and SOAR stack is only in the top Respond package.
Wrong for
A team whose primary need is general infrastructure or application observability rather than security operations and compliance-grade log retention.
Visit Guardsix (formerly LogPoint) →
#2 Coralogix
Cost-optimized observability that routes data by business value · Israel · coralogix.com
TCO Optimizer Usage-based Full observability
Coralogix's TCO Optimizer routes each log or trace to a High, Medium, Low or blocked processing tier by business value rather than charging one flat rate for everything ingested, which the vendor claims saves 25% to 60% on logs and 50% to 75% on traces depending on the tier, and archived data lands in the customer's own S3 bucket.
- Pricing: Usage-based per GB. Usage-based per GB with all features included, published: logs from $0.42/GB, traces $0.16/GB, metrics $0.06/GB, with no per-host, per-user or per-query charges. Free plan: free trial.
- Best for: Teams that want per-GB cost control without losing high-value log detail
- Strengths: TCO Optimizer routes data by business value to different processing tiers; Logs, metrics and traces in one platform; Claimed savings of 25% to 60% on logs and 50% to 75% on traces, depending on pipeline.
Where it falls short
It is smaller and less recognised than Datadog or Splunk, with a thinner integration ecosystem, and it is sold as a hosted service only, so a team cannot run the platform on its own infrastructure, even though archived data sits in its own S3 bucket.
Wrong for
A buyer that defaults to the largest, best-known brand regardless of cost mechanics, or one that needs to self-host the whole observability platform on its own infrastructure.
Visit Coralogix →
#3 Graylog
Log management with a genuinely uncapped free tier · United States · graylog.org
Free tier, no data cap Log-first US-controlled
Graylog Open is free software with no data-volume cap, which is unusual among log-management vendors, and the licence-key upgrade path to Enterprise or Security keeps the same data rather than forcing a migration.
- Pricing: Free open tier + published paid floors. Graylog Open is free with no ingest cap. Free plan: free plan.
- Best for: Teams that want a genuinely free log-management starting point
- Strengths: Graylog Open: free, self-hosted, no ingest cap; Smooth licence-key upgrade from Open to Enterprise or Security; Log-first search and alerting.
Where it falls short
The Open edition is source-available under SSPL, not an OSI-approved open source licence, and Enterprise and Security pricing floors start around $15,000 to $18,000 a year, a steep step up from free.
Wrong for
A buyer that specifically requires an OSI-approved open source licence rather than source-available software, or one that wants a hosted service at a published price.
Visit Graylog →
#4 Checkmk
Auto-discovery infrastructure monitoring, 2,000+ checks · Germany · checkmk.com
Auto-discovery Open core PSG Equity-owned
Checkmk's auto-discovery and huge integration library make onboarding a large, undocumented estate faster than hand-configuring one host at a time, and pricing is published rather than quoted across four real tiers.
- Pricing: Open core, published tiers. Community edition free for roughly 100 hosts. Free plan: open source.
- Best for: IT teams onboarding a large, undocumented estate fast
- Strengths: Auto-discovery of hosts, services and network devices; 2,000+ prebuilt integration checks; Rule-based configuration engine.
Where it falls short
The learning curve is steep, the interface is dated, and major version upgrades mean real configuration rework.
Wrong for
A team that wants a modern interface with a gentle learning curve, or one that cannot spare time for configuration rework at each major version upgrade.
Visit Checkmk →
#5 Centreon
Open-source IT and network monitoring, scaling into observability · France · centreon.com
Open core French company Self-hostable
Centreon extends Nagios-lineage infrastructure and network monitoring toward full-stack observability, with a genuine free open-source edition and a no-time-limit IT-100 Freemium tier rather than a crippled trial, and a strong footprint in French public-sector, enterprise and telecom accounts.
- Pricing: Open core, published tiers. Free Centreon Open Source edition and a free IT-100 Freemium tier (the full IT Edition, up to 100 hosts). Free plan: free plan.
- Best for: IT operations teams wanting an open-source monitoring core that scales
- Strengths: Free Centreon Open Source edition plus IT-100 Freemium up to 100 hosts; IT, Business and MSP editions, self-hosted or SaaS; Metrics, logs and business/SLA-level views.
Where it falls short
Published prices cover only entry points: IT and Business start at fixed host counts, while larger estates and the MSP edition need a quote.
Wrong for
A team whose main need is deep distributed tracing and application performance monitoring rather than infrastructure and network monitoring.
Visit Centreon →
#6 Zabbix
Free infrastructure monitoring with zero feature gating · Latvia · zabbix.com
Open source Founder-owned No feature gating
Zabbix is entirely free software with no host cap and nothing held back behind a paid tier; the Silver, Gold and Platinum subscriptions buy support, not more product. Founder-owned in Riga for twenty years with no outside investors or acquisitions.
- Pricing: Open source + paid support. The software is entirely free and open source with no host cap. Free plan: open source.
- Best for: Infrastructure teams wanting zero licence cost at any scale
- Strengths: Free, open source (AGPLv3 since version 7.0) with no feature-gated edition; Metrics, network and infrastructure monitoring; Log monitoring via agent log items.
Where it falls short
No native distributed tracing or APM, and log monitoring is agent-based rather than a dedicated search product like Elastic or Guardsix.
Wrong for
A team that needs native distributed tracing, or one that wants a hosted product with nothing to operate.
Visit Zabbix →
#7 Icinga
Nagios-successor monitoring, configured as code · Germany · icinga.com
Open source Configuration as code Free core, paid modules
Icinga is the Nagios-lineage monitoring platform most infrastructure teams outgrow Nagios into, operated by Icinga GmbH within Germany's Netways Group with no outside investors found.
- Pricing: Open source + paid subscriptions. Free, open source core with unlimited hosts. Free plan: open source.
- Best for: Teams that want monitoring configured as code on a free, uncapped core
- Strengths: Free, open source core with unlimited hosts and services; Configuration as code; Nagios plugin compatibility.
Where it falls short
The plugin and integration ecosystem is smaller than the Nagios lineage it forked from, self-hosting is the only deployment option, and it monitors state and metrics first, with logs and cloud coverage as an addition rather than the core product.
Wrong for
A team that wants a hosted SaaS product with nothing to run themselves, or a click-first configuration experience rather than code-first.
Visit Icinga →
#8 Dynatrace
Automatic dependency mapping and a unified data lakehouse · United States · dynatrace.com
Full-stack APM Auto-instrumentation Unified data lakehouse
Dynatrace earns its place when the estate is too big to map by hand: one agent per host builds the dependency graph automatically, and Grail keeps logs, metrics, traces and business events in one queryable store instead of three separate products.
- Pricing: Annual commitment, consumption rate card. An annual platform commitment drawn down at published rate-card prices, such as $58/month per 8 GiB host for Full-Stack Monitoring, $29/month per host for Infrastructure Monitoring and $0.20 per GiB of logs ingested. Free plan: free trial.
- Best for: Large estates nobody fully documented, where auto-discovery pays
- Strengths: OneAgent automatic dependency mapping; Grail unified data lakehouse for logs, metrics, traces and events; AI-assisted root-cause analysis.
Where it falls short
Consumption pricing across hosts, ingest and retention is difficult to forecast before running it, and the strongest features assume the proprietary OneAgent rather than a plain OpenTelemetry collector.
Wrong for
A small team that wants a month-to-month plan rather than an annual platform commitment, or one that has standardized on a vendor-neutral OpenTelemetry pipeline and does not want the strongest features locked behind a proprietary agent.
Visit Dynatrace →
#9 Elastic Observability
Log-first observability built on the ELK stack · Netherlands · elastic.co
Self-hostable Log-first architecture Search-based
Elastic Observability grew directly out of Elasticsearch, Logstash and Kibana, which makes it log-first at its core, like Graylog, rather than a metrics-first tool with logs added later, and it can be fully self-hosted for a real exit from the vendor.
- Pricing: Usage, resource or node-based + open source. Elastic Cloud Serverless bills observability per GB ingested and per GB retained, at published rates. Free plan: open source.
- Best for: Teams that want logs, metrics and traces correlated in one searchable index
- Strengths: One searchable index for logs, traces and metrics; Fully self-hostable, including the open source core; AGPL v3-licensed Elasticsearch and Kibana since 2024.
Where it falls short
A buyer is operating a search cluster: shard counts, index lifecycle and retention tiers decide both performance and cost, which is a specialism most teams do not already have.
Wrong for
A team that wants a fully managed product with nothing to tune, or one that cannot staff the shard, index lifecycle and retention work a search cluster needs.
Visit Elastic Observability →
#10 Sumo Logic
Log analytics and Cloud SIEM priced on consumption credits · United States · sumologic.com
Log analytics Cloud SIEM Flex credit pricing
Sumo Logic's Flex licensing, on its Enterprise Suite plan, charges nothing for ingest and bills search separately, which suits a high-volume, low-query workload, like compliance logs, that plain per-GB-ingested pricing punishes, and the same plan offers Cloud SIEM and SOAR alongside observability.
- Pricing: Flex consumption credits. Two published plans, Essentials and Enterprise Suite, paid in Sumo credits and quoted. Free plan: free trial.
- Best for: High-volume, low-query workloads that flat per-GB pricing punishes
- Strengths: Cloud-native log analytics and observability; Cloud SIEM and Cloud SOAR in Enterprise Suite, on activation; Flex licensing on Enterprise Suite: $0 ingest, search billed separately.
Where it falls short
The credit-based model is genuinely harder to forecast than a flat per-GB number, and taken private by Francisco Partners in 2023, the company's product direction is less publicly visible than when it was listed.
Wrong for
A buyer who wants a single, easily forecast monthly bill rather than a credit system with several moving parts.
Visit Sumo Logic →
#11 LogicMonitor
Hybrid infrastructure monitoring with AIOps event intelligence · United States · logicmonitor.com
Agentless-first Hybrid IT/cloud AIOps (Edwin AI)
LogicMonitor covers on-prem, network and cloud infrastructure from one agentless-first platform, which is the classic NOC and IT-ops job that Datadog and New Relic cover less deeply, and Edwin AI adds automated event correlation on top.
- Pricing: Hybrid Units, per-unit. Hybrid Units at starting monthly list prices of $16 (LM Essentials), $27 (LM Advanced) and $53 (LM Signature + Edwin AI) per unit. Free plan: free trial.
- Best for: Classic NOC and IT-ops teams monitoring on-prem, network and cloud together
- Strengths: Agentless-first discovery across on-prem, network and cloud; Edwin AI event correlation and AIOps; Hybrid Units pricing model since September 2025.
Where it falls short
Modern application-layer APM, distributed tracing and high-cardinality workloads are not its strength; its heritage is IT-operations monitoring rather than observability-native design.
Wrong for
A team whose main need is deep application performance monitoring or distributed tracing rather than infrastructure and network visibility.
Visit LogicMonitor →
#12 Grafana
Open source dashboards with a usage-billed cloud for metrics, logs and traces · United States · grafana.com
Open source core Cloud or self-hosted Pay per signal
Grafana Labs maintains Grafana and the Loki, Mimir, Tempo, k6, Pyroscope, Faro, Beyla and Alloy projects, and sells Grafana Cloud on top.
- Pricing: Free tier + usage-based. Grafana Cloud has an always-free tier (for example 10k active metric series and 50 GB of logs a month, with 14-day retention). Free plan: free plan.
- Best for: Teams that want open source building blocks, or to self-host the stack
- Strengths: Grafana visualization, AGPL-3.0 licensed; Grafana Loki for logs, Mimir for metrics, Tempo for traces and Pyroscope for profiles; Grafana Alloy collector with OpenTelemetry and Prometheus support.
Where it falls short
Self-hosting hands you the work of running Loki, Mimir and Tempo, and each signal in the cloud has its own price list, so the bill is metrics plus logs plus traces plus the add-ons you pick.
Wrong for
A team that wants one login, one agent and a single invoice for every signal, and has nobody to configure data sources and dashboards, may prefer a product with fewer pieces to assemble.
Visit Grafana →
#13 New Relic
One platform billed by data ingest and by user type · United States · newrelic.com
100 GB free ingest No per-host charge Per-user seats
New Relic states that it does not charge per host: the price is data ingested plus users, with three user types (basic, core, full platform) whose permissions differ.
- Pricing: Per GB ingested + per user. Usage-based: the free tier has 100 GB of data ingest a month and one full platform user, then $0.40 per GB (Standard and Pro, original data ingest) or $0.60 per GB (Data Plus). Free plan: free plan.
- Best for: Teams that want ingest-based pricing instead of per-host counting
- Strengths: APM with distributed tracing; Infrastructure monitoring; Log management.
Where it falls short
Full platform seats are the expensive part, and Standard caps them at five users. Data stays billed per GB, so a chatty service raises the bill.
Wrong for
A team where most people only need to look at dashboards fits well, but one where every developer needs deep troubleshooting access will pay for each seat on top of the ingest.
Visit New Relic →
#14 SigNoz
OpenTelemetry-native logs, traces and metrics, self-hosted or cloud · United States · signoz.io
OpenTelemetry-native No user or host pricing Self-host option
SigNoz publishes its prices and says it does not bill per user, per host or differently for custom metrics. Most of its code is MIT licensed, with the enterprise directories under a separate licence.
- Pricing: Usage-based per GB + minimum. SigNoz Cloud Teams starts at $49 a month including $49 of usage, then logs and traces are $0.30 per GB ingested and metrics $0.10 per million samples, with no user-based or host-based pricing. Free plan: free trial.
- Best for: Teams that want open source and published per-GB prices
- Strengths: Logs, traces and metrics in one store; APM and distributed tracing; Exceptions view built from trace data.
Where it falls short
Self-hosting means running the database, scaling, upgrades and backups yourself; the cloud service carries a $49 monthly minimum.
Wrong for
A company that needs security products, mobile session replay and a global partner network under one contract will find the product range narrower than the large suites.
Visit SigNoz →
#15 Honeycomb
Event-based observability with unlimited seats and querying · United States · honeycomb.io
Unlimited seats Event-based pricing OTLP ingest
Honeycomb prices by events with unlimited users and queries, so a growing team does not pay per head. It accepts OpenTelemetry data directly over OTLP.
- Pricing: Per event volume. Free covers up to 20M events and 100M metric data points a month. Free plan: free plan.
- Best for: Engineering teams that debug distributed systems through traces and events
- Strengths: Distributed tracing; BubbleUp to compare slow and normal events; Triggers and service-level objectives.
Where it falls short
Pro includes two SLOs and 100 triggers, which a larger estate will outgrow. Sampling to control event volume is a decision you make yourself.
Wrong for
A team whose main need is a server fleet inventory with network and process views, uptime monitors and security products would be buying something built for tracing questions.
Visit Honeycomb →
#16 Better Stack
Uptime, on-call and telemetry in one subscription · Czechia · betterstack.com
Uptime and telemetry together On-call included Dashboard import
Better Stack, Inc., a Delaware corporation per its terms, sells monitoring, on-call and status pages next to logs, traces, metrics and error tracking. The pricing page lists importers for Datadog and Grafana dashboards. Free retention is 3 days for logs and traces.
- Pricing: Per responder + telemetry. Free for personal projects: 10 monitors and heartbeats, 1 status page, 100,000 exceptions and 3 GB of logs and traces a month. Free plan: free plan.
- Best for: Small teams that want monitoring, paging and logs from one vendor
- Strengths: Logs, traces, metrics and web events; Error tracking and session replay; Uptime, transaction and heartbeat monitoring.
Where it falls short
Retention on the free plan is three days, and telemetry volume above the free allowance is priced in a calculator we could not read in full.
Wrong for
A company with thousands of hosts across several clouds, strict audit retention and a security operations team will find a platform of this scope thin.
Visit Better Stack →
#17 Middleware
Flat per-GB observability with a 100 GB free tier · United States · middleware.io
Flat per-GB rate Unlimited users OpenTelemetry agents
Middleware states one rate for metrics, logs and traces ($0.30 per GB), counted on data actually stored after its pipeline drops what you filter out. It was founded in 2022 and lists San Francisco and Ahmedabad offices.
- Pricing: Per GB ingested. Free Forever covers 100 GB of data a month, 1k RUM sessions, 20k synthetic checks and 14-day retention, with unlimited users. Free plan: free plan.
- Best for: Teams that want one flat per-GB rate across signals
- Strengths: Infrastructure monitoring and APM; Log monitoring with ingestion control; Real user monitoring.
Where it falls short
The product is young and its retention is short by default, 14 days on free and 30 on pay as you go.
Wrong for
A buyer who needs long default retention or a deep security module portfolio should compare it carefully against older platforms.
Visit Middleware →
#18 Datadog
Per-product SaaS observability platform billed per host and per volume · United States · datadoghq.com
Per-host pricing Many separate products Auto-renewal terms
Datadog is run from New York and sells each capability as its own product on its own meter: hosts for infrastructure and APM, gigabytes for log ingest, events for log indexing, sessions for browser monitoring.
- Pricing: Per host + per volume, by product. Infrastructure Monitoring has a Free plan (up to 5 hosts, 1 day of metric retention), Pro from $15 per host per month on annual billing ($18 on demand) and Enterprise from $23 ($27 on demand). Free plan: free plan.
- Best for: Teams that want one vendor for infrastructure, APM, logs and security
- Strengths: Infrastructure monitoring with 1,000+ integrations; Application performance monitoring and continuous profiler; Log management with ingest, indexing and archive tiers.
Where it falls short
The bill is the sum of many meters, so cost depends on which products are switched on and how many hosts, containers and custom metrics each one counts.
Wrong for
A team with a handful of services that needs dashboards and uptime alerts does not need a catalogue of this size, and will find the per-product meters harder to forecast than a flat or per-GB price.
Visit Datadog →
