Elastic Agent vs rsyslog

Elastic Agent collects logs, metrics, traces, availability, security, and other host data through one agent. Fleet supplies a web interface for centrally adding and managing agents and integrations, and can distribute upgrades and policies across thousands of agents at runtime. Administrators can track agent status, configuration, overhead, processes, and versions. Elastic Agent and Fleet include dashboards, visualizations, and ingest pipelines for popular services and platforms, with more than 300 ready-to-use integrations listed across search, security, observability, and cloud providers. Packages are provided for Linux, Windows, and macOS architectures and include a separate otelcol binary for OpenTelemetry Collector components. Elastic describes use across infrastructure, applications, and mobile-device telemetry. Elastic Cloud offers a free 14-day trial with one hosted deployment and three Serverless projects. Trial hosted deployments are limited to one active deployment, 4 GB RAM per availability zone for Elasticsearch data nodes, and up to two availability zones. Elastic directs users to documentation and its community forum for assistance. Paid tiers listed are Standard at $99 a month, Gold at $114 a month, Platinum at $131 a month, and Enterprise at $184 a month.

rsyslog is a self-hosted engine for collecting, transforming and routing event data, with a processing model built from inputs, rulesets and actions. The project says it can deliver over one million messages per second to local destinations when processing is limited. Reliability features include on-demand disk spooling, backup destinations and multiple processing threads. Documented outputs include Elasticsearch, OpenSearch, Apache Kafka, HTTP endpoints and syslog forwarding. Database outputs cover MariaDB/MySQL and PostgreSQL, with libdbi support for other databases. TLS-protected syslog and forwarding with peer authentication settings are documented. The core programs use GPLv3, while some runtime files use LGPL. rsyslog is developed for Linux, POSIX and related UNIX-like systems, and is available through source, Git, distribution packages and Docker. It does not run natively on Windows; a separate Windows Agent collects Event Logs and local log files and can relay syslog to rsyslog on Linux. The core software is free; paid support is available from €1,999/yr.